I've seen many times here where people dump the idea of implementing some kind of secure chat and cloud storage apps, and solicit advice on using (and often-time designing) algorithms and protocols; let's call them "the app developers" for the purpose of this post.

I think they should be aware of at least 2 things:

1st. there exist many commercial chat and cloud storage service providers. I heuristically categorize them in to the following:

  1. Those facing individual users,
  2. Those facing organization users,
  3. Those hosting private instances for premium users,

The app developers certainly won't be able to compete with 1. and 2. because those users are more likely to trust well-known public service providers.

As for 3. if the user is really willing to pay for the premium, then they'd probably question the reliability of solutions from start-up developers. There may be some space for them to thrive if they're developing the app for in-house usage.

2nd, existing commercial solutions already face regulatory compliance problems. It's not unheard when people use encrypted chat and cloud storage platforms to carry out illegal activities, so if the product from some of the app developers face regulatory law enforcement, would they be willing to change the functionalities of the application? Or worse, how would they answer to mandates to shutdown?

It's not to say that there aren't any good reason to develop such app. For example, graduate students demonstrate their capability through developing a medium-sized full-stack application so that their resume can look good, or as an exercise to explore and advance their understanding of Information Technology (I have a personal project for this kind of exercise).

My intention for this post is that, it will be a default disclaimer for readers of E2EE chat and cloud storage applications to heed.

So what would you provide as advice for these app developers?

  • $\begingroup$ Do you mean in general, or on Cryptography? For the cryptography site the application is less important than the question about cryptography itself, if you ask me. For this site, I don't even care if the application itself would be of any use at all. $\endgroup$
    – Maarten Bodewes Mod
    Nov 19 '21 at 10:09
  • $\begingroup$ By the way, you may be missing the most common application: a chat included with another application, e.g. a banking application that provides chat functionality with their helpdesk. $\endgroup$
    – Maarten Bodewes Mod
    Nov 19 '21 at 10:11
  • $\begingroup$ @MaartenBodewes in general perhaps. I just strongly feel that people reading those E2EE chat and cloud storage questions should get a disclaimer. $\endgroup$
    – DannyNiu
    Nov 19 '21 at 11:15
  • $\begingroup$ Yes, anybody feel free to suggest one here, and to place one in the comments of the question (or, if applicable, the answer). In extreme cases I even preceded answer comments with a Warning: in front of comments on the answer on Stack Overflow, because highly upvoted answers were just "working", i.e. entirely insecure. $\endgroup$
    – Maarten Bodewes Mod
    Nov 19 '21 at 12:47
  • $\begingroup$ I don't think a disclaimer that some government might get mad is necessary. If anything, it might scare people away from protecting their users. $\endgroup$
    – forest
    Nov 19 '21 at 23:40

You must log in to answer this question.

Browse other questions tagged .