Update 6/10: Based on a short conversation with an engineering lead at X, some of the devices used at X are claimed to be using HSMs. See more further below. Matthew Garrett has a nice post about T…
I’m saying that a company can just arbitrarily decide (like you did) that the server is the “end” recipient (which I disagree with).
They cannot. Thats not how E2EE works. If they can arbitrarily decide that, then it isn’t E2EE.
That can be done for chat messages too.
It cannot, if you’re using E2EE.
You send the message “E2EE” to the server, to be stored there (like a file, unencrypted), so that the recipient(s) can - sometime in the future - fetch the message, which would be encrypted again, only during transport.
That’s not how E2EE works. What you are describing is encryption that is not end-to-end. E2EE was designed the solve the issue you’re describing.
This fully fits your definition for the cloud storage example.
It does not. Cloud storage is a product you’d use to store your data for your own use at your own discretion.
I would argue that the cloud provider is not the recipient of files uploaded there
It is if you uploaded files to it, like on purpose.
They cannot. Thats not how E2EE works. If they can arbitrarily decide that, then it isn’t E2EE.
It cannot, if you’re using E2EE.
That’s not how E2EE works. What you are describing is encryption that is not end-to-end. E2EE was designed the solve the issue you’re describing.
It does not. Cloud storage is a product you’d use to store your data for your own use at your own discretion.
It is if you uploaded files to it, like on purpose.
You’re confusing E2EE and non E2EE encryption.