[jiiam]

Something being true only by definition is unfortunately a very weak claim.

For example the company servers could be hosted on an island with armed guards instructed to burn everything if anyone approaches and the decryption happens only on those servers: sure they have access by definition, but they really don't.

[barsonme]

On the contrary, it’s a very strong claim.

The guards could decide they’re not getting paid enough and steal the data. Or the government could arrest them. Or the government could MITM the data center. Or any hundreds of different scenarios.

At the end of the day, the only thing preventing somebody from accessing the data is that they just… don’t.

This is very weak security and it is why cryptographers and security professionals call it “effectively plaintext.”

[jiiam]

I am saying that in practice the security might be structured in such a way that it requires several different parties to connive, rendering it essentially fine.

I mean, having to modify server code in order to access data that is "effectively plaintext" is not so different from installing a backdoor inside the client: it's not like the user has any choice of client, so even for apps like whatsapp and signal that run E2EE one is still making a leap of faith.

If we add the fact that everything runs inside an os built by companies who may or may not be constantly spying on their users we could say that by definition there's a lot of stuff in our lives that lives in "effective plaintext".

[usea]

If the only thing stopping them from decrypting your messages is instructions to their own employees to not allow it to be done, that is not a defense against providing access to law enforcement. They can just change those instructions at any time without anybody knowing. Just like they can just change the server software to allow it.

[jiiam]

I mean at this point they could also change the code running on the user devices, probably someone would notice but that's another story.

The point is: even if they could, should they do so when compelled by authority?