Should We Chat, Too? Security Analysis of WeChat's Mmtls Encryption Protocol

Show me the outcome and I'll show you the incentive.

Hint: backdoors

I wouldn't trust any federally approved encryption. From any country.

I wouldn't trust them, but I WOULD use them, given no other choice to reach the users I'm after. But always assume zero trust. With any computer thing, zero trust. Computer systems and those who orchestrate them are sneaky little devils.

> I wouldn't trust them, but I WOULD use them, given no other choice to reach the users I'm after.

Which is no different from trusting them. The reality is that you have to trust something at some point.

Not true, you can use something in an untrusting manner. Like assuming everything you send on the platform to be known to the government. Anyone in the USA who uses SMS should be operating like that, for example.

Hmm... if you assume that your government can read your messages but still use the service, then you trust your government to not hurt you based on that. So there is trust.

If, however, you don't send messages you would like to send because you don't trust the service, then it is true that you are not trusting the service, but you are not using it (for those sensitive messages) either.

As soon as you actually use something that matters, you have to trust it. Sending sensitive messages over a system that you don't trust while admitting you don't trust it is... weird.

Is sending everything encrypted trusting, or not trusting, the communication channel.