Embed Notice

@soatok

I have an even simpler reason for why E2EE should simply be mandatory table stakes:

Security is habits. If you consistently do things securely - you don't need to worry as much about mistakes causing an issue.

I've historically done audit work in AWS. When someone says "do we encrypt EBS?" - the answer is yes. Always. "But what if we don't need it?" - irrelevant. If you always encrypt, it turns a week of audit questions about why you didn't encrypt into "yes it's all encrypted".

If you use secure communications mechanisms with audited implementations and full end-to-end encryption - certain failure modes are greatly reduced or disappear entirely. Certain questions never need to be answered again. The impact of human mistakes on the part of the user are significantly reduced.

If doing the right thing is a habit, it makes it harder to do the wrong one.

I can't drive without a seatbelt. Feels weird. So "I forgot to put my seatbelt on" isn't a failure mode I need to think about. Habits. It's good to feel weird when you do the wrong thing.