On: Telegram publishes users' locations online

[frigid]

Out of curiosity, how can end-to-end encryption be verified when both the clients and the servers are closed-source?

[Hnrobert42 → frigid]

How can you know it’s not E2EE? The absence of evidence is not the evidence of absence, or something like that.

I agree that closed source is harder to verify, but that’s not the same as insecure.

[anoncake → Hnrobert42]

If you can't verify your messages are E2EE, you have to trust the vendor. But if you trust the vendor, you don't need E2EE to begin with.

[Hnrobert42 → anoncake]

There are other threat actors than the vendor looking to compromise the confidentiality of your message.

[anoncake → Hnrobert42]

Those actors don't have the vendor's encryption keys.