Questions tagged [end-to-end-encryption]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
26 views

How is End to End encryption works in frontend and backend Web application [closed]

We have a web application in which Frontend and Backend are separated. The frontend is an Angular app and the Backend is a Python app that proxy to Home Device (Behind Home Router) My question is how ...
user avatar
  • 113
1 vote
1 answer
49 views

How to deal with targeted attacks from publisher when verifying the integrity of native applications and validating their source code?

I am trying to reason about how native apps can avoid the problems web apps have in dealing with the "Browser Cryptography Chicken and Egg" problem, which has been discussed numerous times ...
user avatar
  • 13
1 vote
0 answers
101 views

How does end-to-end encryption work with whatsapp web as of 2022?

The accepted answer to this question is now outdated, since Whatsapp web does not require an online smartphone to function anymore. How is the key exchange performed securely?
user avatar
1 vote
1 answer
87 views

End To End Encryption Model

I have an architecture which requires a certain subset of data to be more heavily secured and encrypted. The main parameters which I believe meet the scope of the project are as follows: Data should ...
user avatar
2 votes
1 answer
116 views

Is the new Whatsapp Web update compatible with E2E encryption?

You may see this question as a logical successor of this post. With the new Whatsapp Web update it is now usable without keeping the smartphone online. I can't imagine how this is compatible with End-...
user avatar
  • 45
-1 votes
1 answer
29 views

how to fully secure web/mobile/desktop application connected the same backend server [closed]

I have a React/Express application, I want to fully secure it. I'm looking for best practices for these features: data encryption/decryption end-to-end communication access control role management ...
user avatar
1 vote
1 answer
84 views

Is authentication through mail clients safe when encryption is off?

When adding an account on a mail client, the SSL/TLS is usually turned off and the encryption method is 'none' (see Outlook example below). Is the password safely sent through the internet when ...
user avatar
24 votes
7 answers
3k views

Is encryption in transit distinct from end-to-end encryption?

I asked a question about HTTPS encryption as it relates to developing a web app here. On the face of it that question has now been closed twice for not being focused enough, but if the meta discussion ...
user avatar
2 votes
2 answers
199 views

How can I verify the hash of the plain text without being able to decrypt the cipher text?

I am building an E2EE chat app where there is one asymmetric key pair per group. Each user also has one asymmetric key pair. All messages in a group chat are encrypted with the group public key and ...
user avatar
1 vote
1 answer
235 views

Key management for End-to-end encryption for Chat application

I want to implement end-to-end encryption on my chat application (available on android, iOS and web). For that I've following mechanism in mind. Generate Key pairs (Private key and Public key) on ...
user avatar
0 votes
2 answers
291 views

Is end to end encryption over HTTP safe?

If you wrap all your data in an end-to-end encrypted payload is it safe to transmit over HTTP or at worse case self signed HTTPS instead of traditional CA signed SSL?
user avatar
  • 101
1 vote
2 answers
129 views

Can TLS enable end-to-end security between 2 users(not server) in IPv6?

I'm studying iot Secure knowledge. I find that people say that TLS/DTLS can provid e2e security but in HTTP diagram it will stop at Server. A->Server->B and data at Server will be decrypted. In ...
user avatar
  • 11
3 votes
0 answers
122 views

Security vs. User Experience – can this Process still be considered to provide proper End-to-End-Encryption?

I am banging my head about this for a while now and would appreciate opinions/different views. tl;dr There is a system that aims to provide full end-to-end encryption for information (text messages, ...
user avatar
  • 233
0 votes
1 answer
140 views

How to prevent server know what data is being transferred through it between two clients

Imagine a web application in which two computers can communicate with each other by transferring files, through the server linked with some unique password. Every file sent between the clients are ...
user avatar
0 votes
0 answers
71 views

Can I process ITAR data in AWS GovCloud?

I need to build a service that shares and processes ITAR data. From my understanding reading ITAR documentation, the data must be end-to-end encrypted, and the private keys must never be stored in ...
user avatar
  • 101
0 votes
1 answer
129 views

JWT to prevent others from using video in their iframes

I just recently discovered JWT to secure my live stream and have done successful token on server and player but I think it still can be stolen. How I can use it to only have the domains I choose to be ...
user avatar
  • 1
0 votes
1 answer
122 views

E2E-Encrypted storage: What to do when the lifetime of a key is over?

When using AES-GCM-256 with random nonces, a limit of 2^32 encryptions is specified in order to have a low nonce collision probability. A new key has to be generated to take its place afterwards, I am ...
user avatar
  • 697
0 votes
0 answers
19 views

Is there hardware (like u2f-keys) for passwordless client-side encryption & decryption [duplicate]

I know that u2f keys are designed as authentication factors, but I think it would not be far fetched to also add a protocol that the user can use to encrypt or decrypt data on the client-side. This ...
user avatar
  • 697
0 votes
1 answer
160 views

Does End-To-End-Encryption in Web Applications require trust?

In a talk from Moxie Marlinspike he mentioned that Signal does not intend to release a web application because they are impossible to audit. The javascript code is retrieved on each page load, so it ...
user avatar
  • 697
0 votes
3 answers
276 views

Multiple devices encrypting data using the same key?

I want to implement a service that can't read the data you store there. The Idea is that I, like in a password manager, use the password to derive a vault key, which is different from the ...
user avatar
  • 697
0 votes
2 answers
148 views

Need some clarification regards end-to-end encryption process

Let's say I want to make a messaging(just an example, take it as any data) web(react + node) application(more like an email rather than chat) with end-to-end encryption. So at some point, I will want ...
user avatar
1 vote
3 answers
163 views

Is it safe to send an encrypted blob as a URL parameter?

The context is a password reset functionality. The user has requested a password reset, either via the web, or via a call to the help desk. The proposed solution is, behind the scenes: If Self-...
user avatar
2 votes
1 answer
88 views

Can we mask encrypted traffic to look like real traffic [duplicate]

Assumptions: Some places ban or at least think about banning encryption. Encrypted traffic can be easily spotted because it looks like nonsense (or something else?). Question: Suppose I put my ...
user avatar
0 votes
3 answers
324 views

What can my Telco / ISP learn from my Signal (secure messaging app) communications?

To preface this question, I use Signal messaging app for voice, video and text. I understand that the content of all these messages are encrypted and no-one but the sender and recipient can see/hear ...
user avatar
  • 53
12 votes
4 answers
8k views

How To Recover End-To-End Encrypted Data After Losing Private Key?

I'm creating a mobile app which has chat feature in it. Since I wanted to make it secure, I'll do some encryption to messages and the data. I'm thinking of using End-To-End encryption for it but I've ...
user avatar
  • 247
0 votes
2 answers
477 views

How to know whether mysql connection is using SSL or TLS connection?

I want to verify whether mysql remote connection is using tls/ssl connection for security purposes. I ran status command to check initially: mysql> status -------------- mysql Ver 8.0.19 for osx10....
user avatar
2 votes
1 answer
147 views

How to prevent mobile data from being viewed when leaving VPN server?

Please correct me if i'm wrong. As far as i know, when we use vpn service, our datas are only encrypted from us to vpn server. After leaving the server to intended recipient, our data is decrypted and ...
user avatar
3 votes
1 answer
1k views

What is the correct way to create a backup copy of a PGP key pair?

I am using GnuPG 2.2.20 to create my key pair. I have successfully created a key pair, now I want to create a backup copy in case of HDD failure. Following the instruction here, I have tried gpg --...
user avatar
0 votes
0 answers
130 views

Is my own PKI based end-to-end encryption secure?

I implemented a simple chat that (tries to) encrypt messages end-to-end. I approached this problem by making both parties generate an ECDH keypair (P-384) and consequently share their public keys. ...
user avatar
0 votes
1 answer
198 views

How to encrypt data so only clients can read, but not the server

I am building a system where the clients should be able to communicate with each other. However I want all the data to be hidden from the server where the information is stored in a database. How can ...
user avatar
  • 1
2 votes
1 answer
141 views

What's the best encryption strategy to go with when everybody needs to be able to write data but only a select people can view it?

I really just need an encrypted support ticket system essentially. The user who writes the ticket doesn't need to be able to view it afterward but a handful of staff need to be able to decrypt the ...
user avatar
  • 121
2 votes
2 answers
612 views

If Whatsapp media messages are e2e encrypted, what is the point of storing popular messages on the server?

There is something I don't understand about whatsapp's privacy policy. Your Messages. We do not retain your messages in the ordinary course of providing our Services to you. Once your messages (...
user avatar
1 vote
1 answer
258 views

Is it worth using an http proxy?

Sorry for my lack of terminology in the field, that's something I've little (or none any) practical knowledge about. I've browsed similar questions on the security risks of using (web) proxies, but ...
user avatar
  • 113
0 votes
1 answer
170 views

RestApi Libsodium SealedBox end-to-end request encryption scheme

I am making an API that uses the following steps for encryption. All of this is implemented using libsodium. First of all the client has to make an initial request to the server for getting his public ...
user avatar
0 votes
1 answer
156 views

Storing Bob encrypted data, and send them to Alice (who must be able to decrypt the content)

I need to develop a website where a user (Bob) send text, image, or video content to my website. After some time, I need to send this data to another user of his choice (Alice). I want to encrypt user ...
user avatar
  • 101
0 votes
3 answers
208 views

Security impacts of using public wifi

I generally use a free college wifi and sometimes chats on telegram and also send pics can hackers access those pics and chats and can he access my gallery and see pics? And if he hacks and install ...
user avatar
31 votes
3 answers
10k views

Can I use WhatsApp to securely send public key, symmetric key and private key?

I am asking this because WhatsApp says it is end-to-end encrypted. Are there any problems with sending a public key through WhatsApp? There might be some objections to sending symmetric and private ...
user avatar
0 votes
1 answer
145 views

Is automatic E2E encryption possible for chat apps with a backend DB?

This question refers to automatic E2E encryption (i.e., the app creates and shares encryption keys, never the user). Apps such as Discord and Hangouts store messages in a server-side DB thereby ...
user avatar
0 votes
4 answers
824 views

How Whatsapp shows link previews despite E2E encryption?

Someone sends me a link. Whatsapp shows its preview. How can they do that despite being E2E encrypted?
user avatar
0 votes
2 answers
399 views

Is the video/audio traffic from WebRTC TURN relay servers encrypted end-to-end? As with the applications Signal and Jitsi Meet

Today I found a video on YouTube that surprised me (https://www.youtube.com/watch?v=Pkc3sE6iKV4). It is by Rob Braxman, a privacy advocate with a lot of expertise. He talks about all kinds of video ...
user avatar
3 votes
0 answers
214 views

What secure mobile messaging app is publicly known to be the most frustrating for state intelligence to read? [closed]

I imagine like either leaked or otherwise published official memos on efforts and signals intelligence programs to intercept and crack different types of communications either lamenting or chronicling ...
user avatar
1 vote
2 answers
430 views

Encrypt Text Message as Image

Is this a good idea to make the following text message encryption: accept text from the user 1 store the text into a document in the form of some handwritten font convert the document into an image ...
user avatar
40 votes
2 answers
29k views

Why is there no web client for Signal?

I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum, and wonder why they say that the browser is insecure for E2EE and native apps are secure. ...
user avatar
0 votes
3 answers
551 views

Why can't we encrypt the message with sender's private key and receiver's public key in case of sending messages through a server?

I read that why do we need E2EE and can't rely only on HTTPS for sending messages through a messaging app. The reason which i understood is when sender sends the message to the server, the TLS ...
user avatar
  • 103
0 votes
1 answer
136 views

Recovery possibilities with Zero knowledge encryption

I have some encryption understanding however I fail to get my head around following scenarios. I would like to know if they are possible with a zero knowledge encryption system. What the system can or ...
user avatar
  • 53
1 vote
1 answer
160 views

End-To-End Encryption in Cloud file sharing

I am a currently analyzing the available Cloud services allowing End-To-End Encryption for file sharing. It looks like, for each solution I found, if Alice wants to send an encrypted file to Bob, she ...
user avatar
4 votes
1 answer
299 views

How to validate client side safety in a Zero Knowlegde model

What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
user avatar
  • 1,316
2 votes
2 answers
442 views

How to secure a web-only end to end encrypted chat with message persistence?

Currently, I'm trying to create a web-only end to end encrypted chat, with message persistency. I did some readup on how to create an end to end encrypted chat in JS, I found out there are quite some ...
user avatar
4 votes
2 answers
2k views

Remmina RDP Certificate Fingerprint Changed

I've been using Remmina to connect to my RDP server across the internet. When I first connected to the server, I had to accept the certificate. I have not had to do that since the first time I ...
user avatar
  • 41
1 vote
0 answers
91 views

Meaning of unacknowledged pre key messages

I've recently tried to work with the Signal protocol, but the documentation isn't great. I've come across a problem where the messages being sent include the pre key because the client has ...
user avatar
  • 121