I've seen many times here where people dump the idea of implementing some kind of secure chat and cloud storage apps, and solicit advice on using (and often-time designing) algorithms and protocols; let's call them "the app developers" for the purpose of this post.
I think they should be aware of at least 2 things:
1st. there exist many commercial chat and cloud storage service providers. I heuristically categorize them in to the following:
- Those facing individual users,
- Those facing organization users,
- Those hosting private instances for premium users,
The app developers certainly won't be able to compete with 1. and 2. because those users are more likely to trust well-known public service providers.
As for 3. if the user is really willing to pay for the premium, then they'd probably question the reliability of solutions from start-up developers. There may be some space for them to thrive if they're developing the app for in-house usage.
2nd, existing commercial solutions already face regulatory compliance problems. It's not unheard when people use encrypted chat and cloud storage platforms to carry out illegal activities, so if the product from some of the app developers face regulatory law enforcement, would they be willing to change the functionalities of the application? Or worse, how would they answer to mandates to shutdown?
It's not to say that there aren't any good reason to develop such app. For example, graduate students demonstrate their capability through developing a medium-sized full-stack application so that their resume can look good, or as an exercise to explore and advance their understanding of Information Technology (I have a personal project for this kind of exercise).
My intention for this post is that, it will be a default disclaimer for readers of E2EE chat and cloud storage applications to heed.
So what would you provide as advice for these app developers?
