"Web crypto is always snake oil" — and the cryptographers show up to disagree with each other

One definition, aimed at the thing you trust most

Hugo Landau's essay turns on a single line: "A cryptosystem is incoherent if its implementation is distributed by the same entity which it purports to secure against." Web-based end-to-end encryption always fails this test, he argues, because the website that could read your messages is the same website serving the client-side code that's meant to prevent it. A malicious server can quietly swap the JavaScript — even target one IP address — and you can never verify what actually ran in your browser.

He doesn't stop at web apps. Signal, WhatsApp and iMessage control their own distribution and block third-party clients, so he reads them as variations on the same problem, and reads Apple-vs-FBI as proof Apple could build compromised firmware — "we don't want to," not "we can't." His sharpest claim is that E2E marketing is largely legal theater: a way to dodge wiretap warrants, not a way to keep you safe.

The room splits — and both sides carry keys

The thread is unusual because the rebuttals come from people who do this for a living. The first move is to deny the premise applies to real apps at all:

"I can build Signal from source from GitHub, and use Signal-the-service with the client (which did not come from Signal, but GitHub/my compiler). Many cryptosystems are like this." — Jeffrey Paul, a security researcher who publishes his PGP key

A developer knocked out the "no exceptions" absolutism with three counterexamples:

"Incorrect, and trivially falsifiable. Examples: … Self hosting, where you control both client and server. … Loading a web app from file:/// … Loading a web app from localhost." — a developer with published open-source projects

Where the skeptic and the essay quietly agree

Here's the twist: the same researcher who dismissed the web argument then handed the essay its best real-world example — not the web, but Apple's own flagship:

"iMessage claims to be e2ee, but the on-by-default iCloud Backup on iOS backs up material that is sufficient to defeat this … in practice, iMessage is not e2ee. Before you say "But what about Advanced Data Protection…" - virtually nobody has this on" — the same researcher, on iMessage's default backup

The narrower reading — the one that survives the thread — isn't "all web crypto is snake oil." It's that distribution is the weak joint: when the entity that could betray you also controls the software update channel, the math is fine and the trust model is the hole. That's true of a web page, and, on a default iPhone, true of the app people cite as the gold standard.