Abbie Barbir wrote:
> True end-to-end encryption should be used by the primary
> parties for data for which intermediaries are not trusted; some
> intermediaries may impose this themselves.
here we need to be very carefull, how do you know which services are
trusted and which ones are not?? How do you signal that, and how do you
verify ??
I think my wording might have caused an issue to be raised earlier
in the trust model than I intended.
In the case in which intermediaries are not trusted, there is no
signalling. The endpoints use end-to-end encryption, period. The last
part of the sentence, after the semicolon, indicates that even if the
data is not considered confidential by the primary parties, the
intermediaries might still use negotiate intermediary path encryption
on their own.
Later parts of the original message in this thread discuss the fact
that the primary parties may trust the intermediaries to handle
data that must be kept confidential.
Hilarie