this post was submitted on 09 Jul 2026
1 points (52.9% liked)

Showerthoughts

42893 readers
315 users here now

A "Showerthought" is a simple term used to describe the thoughts that pop into your head while you're doing everyday things like taking a shower, driving, or just daydreaming. The most popular seem to be lighthearted clever little truths, hidden in daily life.

Here are some examples to inspire your own showerthoughts:

Rules

  1. All posts must be showerthoughts
  2. The entire showerthought must be in the title
  3. No politics
    • If your topic is in a grey area, please phrase it to emphasize the fascinating aspects, not the dramatic aspects. You can do this by avoiding overly politicized terms such as "capitalism" and "communism". If you must make comparisons, you can say something is different without saying something is better/worse.
    • A good place for politics is c/politicaldiscussion
  4. Posts must be original/unique
  5. Adhere to Lemmy's Code of Conduct and the TOS

If you made it this far, showerthoughts is accepting new mods. This community is generally tame so its not a lot of work, but having a few more mods would help reports get addressed a little sooner.

Whats it like to be a mod? Reports just show up as messages in your Lemmy inbox, and if a different mod has already addressed the report, the message goes away and you never worry about it.

founded 3 years ago
MODERATORS
vatlark@lemmy.world
forkball@lemmy.world
SuperEars@lemmy.world
1
thoughts about end-to-end encryption (feddit.org)
submitted 1 week ago* (last edited 1 week ago) by gandalf_der_12te@feddit.org to c/showerthoughts@lemmy.world
13 comments fedilink hide all child comments
 

you know matrix chat? it's supposed to be end-to-end encrypted. the same goes for whatsapp and other chat applications.

(technical note: if alice wants to send a message to bob with end-to-end encryption, then alice signs the message with her private key and bob's public key. then bob can read the message with alice's public key and his private key. so bob knows that the message actually comes from alice, and nobody can read it but bob.)

here's the problem: the public keys are all stored on someone else's (3rd party) server. for whatsapp, they're stored on whatsapp's server. so if bob gets a message from alice, he has to read that message with alice's public key, but he gets the key from whatsapp's server. so whatsapp can do a man-in-the-middle attack quite easily by giving out a fake alice's public key.

actual effective end-to-end communication is only possible if alice and bob exchange public keys in real life. this circumvents a 3rd party server. and this is what needs to be implemented in chat applications such as matrix chat. (you can pass the public key with a QR code or sth like that)

you are viewing a single comment's thread
view the rest of the comments
[–] slazer2au@lemmy.world 14 points 1 week ago (1 children)

here's the problem: the public keys are all stored on someone else's (3rd party) server. for whatsapp, they're stored on whatsapp's server. so if bob gets a message from alice, he has to read that message with alice's public key, but he gets the key from whatsapp's server. so whatsapp can do a man-in-the-middle attack quite easily by giving out a fake alice's public key.

Quite the misunderstanding here. The public and private keys don't secure the message itself, they are a way of both parties arriving at the same secret for the message to use without sending the actual secret.

[–] gandalf_der_12te@feddit.org 1 points 1 week ago (1 children)

yeah but man-in-the-middle attacks are still possible regardless

[–] LurkingLuddite@piefed.social 4 points 6 days ago* (last edited 6 days ago)

Not if the sender is signing it with the correct private key.

Of course, that requires the app to do the correct thing, and if it's coming from someone shady...

Though if the app wanted to MITM their users' private keys, they'd be FAR better off just writing the app to upload the private key to their servers, too. Much simpler and potentially more devastating if it scrapes up other keys, too.

Then nobody shows up with a different key than what was set up, even if they had set it up manually.