Lemmy Support

4651 readers

1 users here now

Support / questions about Lemmy.

Matrix Space: #lemmy-space

founded 5 years ago

MODERATORS

[email protected]

Are dms e2e encrypted between recipients? (lemmy.ml)

submitted 4 years ago by [email protected] to c/[email protected]

8 comments fedilink hide all child comments

Just curious if that is the case. I assume not as Lemmy does not advertise it's encryption at all.

Would this ever be planned for Lemmy?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 1 year ago (1 children)

I don't get what makes it hard to implement the same stuff using libraries provided, encryption should be optional for servers administrators to enable

[–] [email protected] 2 points 1 year ago (1 children)

Encryption is hard to get right. Which doesn't help when it's essentially useless unless you get it right

https://github.com/soatok/mastodon-e2ee-specification was a thing but it doesn't seem to be updated for months now.

[–] themoonisacheese 1 points 1 year ago

Encryption is also pretty much useless if the thing performing the decryption is served by the people encryption is protecting you against. It would be trivial for a Lemmy instance to serve you backdoored JavaScript as the decryption Algo.

E2e encryption is a legal device used by companies to remove their liability to give your messages to the government. Because united states v Apple (which didn't have a ruling but the case made was pretty strong), code is speech and the US gov cannot compel you to change your code, therefore companies that have e2e encrypted comms can say "we don't know, we have a way of knowing but you can't make us" whenever the US gov comes in with a subpoena.

Bear in mind this is only US jurisprudence, there exist jurisdictions in which the government could legally compel an instance admin to serve you backdoored JavaScript and read your messages.