End-to-End Encryption Threat Model
3 points · Open discussiongoogle
end-to-end
JavaScript2014–2022
google / end-to-end · Archived
end-to-end
End-To-End is a crypto library to encrypt, decrypt, digital sign, and verify signed messages (implementing OpenPGP)
38Distinct people
44Mentions
0Explicit recommenders
4.1KGitHub stars
What to know before exploring
What it is
End-To-End is a crypto library to encrypt, decrypt, digital sign, and verify signed messages (implementing OpenPGP)
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- yahooarchive/end-to-end · linked in 3 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year44 dated mentions
Observed mentions: 2014-12-16 22:09:22 UTC to 2022-02-20 05:01:00 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 3 | 2 | 1 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 20 | 2 | 18 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 13 | 3 | 10 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 1 | 1 | 0 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
End-To-End
End-To-End is a crypto library to encrypt, decrypt, digital sign, and verify signed messages (implementing OpenPGP and OTR).
This is the source code for the End-To-End library. It's built upon a newly developed, JavaScript-based crypto library. End-To-End implements the OpenPGP standard, IETF RFC 4880, enabling key generation, encryption, decryption, digital signature, and signature verification.
We're releasing this library to enable community review.
For more background, please see our blog post.
Documentation for the project is stored in our Wiki. If you're planning to contribute to the project, check out our Contributor guide.
A few projects have been built on top of this library, to list a few:
E2EMail - A Gmail client that exchanges OpenPGP mail.
Freedom JS - A framework for building peer-to-peer (P2P) web apps.
uProxy - A browser extension that lets users share their internet connection.
Google End-to-End Extension - Google End-to-End Chrome Extension (not ready for general use).
Yahoo End-to-End Extension - A fork of Google's End-to-End for Yahoo mail.
Read the full README on GitHubWhat Hacker News says
44 sourcesThe attempts have been made, but for some reason it hasn't taken off.
https://github.com/google/end-to-end
https://github.com/YahooArchive/end-to-end
In Engineer admits hacking Yahoo accounts searching for imagesHere is some information that mey be of use on the secure channel encryption?
End-to-end encryption
https://en.wikipedia.org/wiki/End-to-end_encryption
End-To-End is a crypto library to encrypt, decrypt, digital sign, and verify signed messages (implementing OpenPGP and OTR)
https://github.com/google/end-to-end
(Auth) So you want to build a decentralized Twitter with end-to-end encryption, that works right in the browser? All with MIT licensed Open Source code?
https://github.com/amark/gun/wiki/auth
P2P Authenticated Encryption
https://github.com/tendermint/tendermint/wiki/P2P-Authentica...
GNUnet is an alternative network stack for building secure, decentralized and privacy-preserving distributed applications.
https://gnunet.org
A decentralized, peer-to-peer, encrypted chat in PHP.
https://github.com/TheFox/phpchat
Top 5 Most Rated Node.
Read the rest
js Frameworks for End-to-End Web Testing
https://medium.com/@adrian_lewis/top-5-most-rated-node-js-fr...
Not only that, but they have a guy who AFAIU spent his 20% time to build this feature (i.e. e2ee using GPG), it would take minimal resources to implement it as an add-on. I guess with all the usage data they have they know how much the general public cares about privacy. It's sad not even the Googlers who care can push some of these "higher good" features without being reassigned to some mundane shit.
https://github.com/google/end-to-end
In Gmail Launches Add-onsThe Gmail Add-ons are executed by Gmail and are within Gmail-controlled webpages. Nothing in the add-on is private from Gmail/Google. If you want end-to-end GPG-encryption where the plaintext and keys aren't accessible to Google, then you want to use a browser extension (such as Google's End-to-End extension or ones built off of it: https://github.com/google/end-to-end).
In Gmail Launches Add-onsFair point on tweet length. I hadn't considered that. Do Direct Messages have a character limit? I'm unsure.
For Gmail I think it could still make sense for those who have a Keybase account/key, but haven't yet downloaded the app (this was me for a while).
Just as an example, I have a work contact who I am often exchanging passwords with. We use Proton Mail for these, and Gmail for everything else. Saying "I sent you X on proton" is a lot more cumbersome than "here's an encrypted message", and being able to decode it inline.
We could use Keybase's webapp, but it still requires going to an external site to encrypt/decrypt messages. So it's not a big enough draw to change our workflow yet.
I understand the argument that Keybase Chat has more built in benefits, but sometimes you just prefer email to live chat. It's also an easier sell
Read the rest
to download a Chrome extension once, than download an app and run it 24/7.
Admittedly that's just my use-case. I like to think of Keybase as easily accessible PGP functionality, so that's where I'm most interested in seeing it grow.
I know Google's working on the problem I described with their end-to-end extension[1], but it's been years in development so who's to say when it'll be ready.
Regardless, I think the product is great. Looking forward to seeing what you guys put out in the future.
[1] https://github.com/google/end-to-end
I wonder if Google's End to End library will be available as a Gmail addon. It sounds like the perfect platform.
https://github.com/google/end-to-end
In Gmail Add-ons> If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it.
End-to-end [1] is using OpenPGP.
[1]: https://github.com/google/end-to-end/
In OpenPGP really worksGoogle's End-To-End also seems dead.
https://github.com/google/end-to-end
I would say ProtonMail or the miniLock-based Peerio.com are now the most interesting projects for encrypted email.
EDIT: https://minilock.io/
https://github.com/PeerioTechnologies/peerio-client
In I'm giving up on PGPI think it's different, because Protonmail can target you, individually, at any time. Like, for example, upon receipt of a NSL.
GPG is used asynchronously. In many cases, everyone would need to be compromised to go after one person. That raises the chance of discovery.
A browser extension is a fantastically better idea. Google previously prototyped most of the work for this:
https://github.com/google/end-to-end
In Why did ProtonMail vanish from Google search results for months?The same can be said about a "trusted" OS like say Qubes OS, with untrusted hardware, like Intel's. Actually, that's what the developers of Qubes OS and other "free" operating systems have said as well.
http://blog.invisiblethings.org/2015/10/27/x86_harmful.html
https://www.fsf.org/blogs/licensing/intel-me-and-why-we-shou...
If anything, I'm more frustrated with the Signal team that the app doesn't have as good call quality/performance as WhatsApp, nor does it have video call support, and that the Chrome desktop "app" doesn't seem to import my phone contacts for some reason - all of which is making me continue to mostly use less secure and less trusted alternatives.
My point is we should aim for getting things "more secure" constantly, and I think we have in the past few years. So rather than just say "what's the point?", we should say "l
Read the rest
et's put more pressure on X company to open source/prove their system is secure" and hope that in time enough pressure is built that those companies actually agree to do those things.
And since I was talking about putting pressure on companies, let me start:
Where the hell is Google's End-to-End tool? It hasn't had any commits in over half an year, and we already know NSA's bestie, Yahoo, has given up on it. Should we start drawing some conclusions about the Google/NSA relationship, too? Did Google abandon the project?
https://github.com/google/end-to-end
There - who's next?
Google's End-to-End: no commits since April
4 points · Open discussionTo be honest, like all very large organisations, I suspect there are many different points of view within Google. For example, Google is slowly working on End-to-End [1].
People tend to expect that businesses run to the lowest common denominator: if it is profitable, then they will do it. This is demonstrably false, though. Most companies avoid the most egregious crimes in our society, and others actually take moral stands on various issues (Lush comes to mind [2]). But of course, no matter what, it's always going to be a nuanced issue (see the comments in the second link to see some people's negative reactions).
Somewhat like Lush, Google has potential to improve the situation and position itself as "the least bad" option. The reality of the situation is that while privacy is very important, almost nobody wants to be completely priv
Read the rest
ate. They want to advertise things about themselves -- even to the whole world (see Facebook). Possibly they even want to lie about themselves, but this is still compatible with selling them things to help them sustain their fantasy.
From the perspective of targeting ads, it seems to me to be much more effective to target the "public persona" that people wish others to see rather than the true private person. Building better tools that allow someone to say, "This is how I wish the world to see me" is much, much better than trolling through their personal information and patching up a profile that nobody wishes to expose. And for the few people who wish to be an informational black hole? You weren't going to sell them anything anyway.
P.S. I understand that Google and others have a very long way to go to make this kind of thing a reality. It's just that I don't see it as being antithetical to their business goals.
[1] - https://github.com/google/end-to-end
[2] - https://uk.lush.com/article/lush-ethical-company
I've been eagerly awaiting the release of this e2e plugin. However, I'm not holding my breath. Go take a look at GitHub repo[0]. The last commit was a merged pull request on Feb 24th and the commit before that was Jan 27th.
[0] https://github.com/google/end-to-end/commits/master
In The Dream of Usable Email Encryption Is Still a Work in ProgressShowing the 15 most recent of 44 sources. Enable JavaScript to search and browse every indexed mention.