If it's possible for a user to send an unencrypted message across the wire on your "end-to-end encrypted" app, then it's not actually E2EE.
-
This means that email can't be E2EE (because a user could easily hit reply without encrypting, accidentally sending the full conversation thread in plaintext).
-
It refers to RCS texting, where, at least on Android, it will often drop down into unencrypted SMS when the RCS protocol is having trouble.
-
It's the case for Matrix even, where E2EE is a setting that can switch on or off.
In no world would we accept an application as being encrypted between client and server if it was possible for packages to get sent in plaintext occasionally. We wouldn't put up with HTPPS occasionally sending HTML forms over HTTP on accident. Why do many people feel comfortable with the same issue when applied between two users, instead of a user and a server?
If it's possible to send a plaintext message in an E2EE platform, then the platform isn't really E2EE.
#encryption #security #privacy #email #pgp