Hacker News Reader

Bro, did we read the same comment? The encryption is handled client side; the cyphertext is the only thing the server sees.

View on HN

The encryption happens after the server recieves the plaintext email and passes it to the client...

No, this is done with public-key encryption which does not require the client.

Again, only between users with skiff emails, which is a negligible portion of all emails. This needs to be made clear as it is very misleading to the average user who probably thinks all emails are end to end encrypted.

No: Skiff does not have access to a single email stored on our platform, including ones received externally. All are public-key encrypted, including subjects and content.

This is encryption at rest, with the user holding the keys, and not end to end to end encryption, since the server recieves emails coming outaide of akiff in unencrypted form to begin with.

As a simple demonstration, even if client side code is perfectly secure, an adversary with server control can simply log all emails passing through the server and instantly have access to all new user emails that way. This means users have to trust the server, contradicting any notion of E2EE.

Reply on news.ycombinator.com