I am not sure what you are trying to say. Let me try an example.
Say you have a device that projects the screen on a skyscraper in Manhattan, visible by tens of thousands of people in real time. You can do all the cryptography you want, I would argue that you fundamentally cannot achieve "privacy" on that device, because "thousands of random people seeing it" means it is not private, by definition. Sure, you can run Signal on that device, and it does actually run sound E2EE maths. But it is not an "end-to-end encrypted deployment", it is a public deployment that happens to be running E2EE cryptography.
What I say is that running E2EE in a browser has that kind of nuance (as far as the comparison goes, obviously). In that the browser is indeed running E2EE cryptography, but it is not an "end-to-end encrypted deployment", because the user has to trust the server.
> This is not a coherent segmentation for whether E2EE is possible and engaged.
I would argue that it is. Just like E2EE is not "possible and engaged" on the skyscraped in Manhattan, I argue that it cannot be in a browser. The browser is running sound cryptographic code, but what the user gets is not an end-to-end encrypted experience.
> I am not sure what you are trying to say.
That "trusting the code that runs in your browser when you load the website of a messaging webapp to actually facilitate E2EE" is out of scope for the question "is E2EE in a browser possible".
> I would argue that it is.
This is what I very directly disagree with. In both your Manhattan example, your browser example, or in my very own shoulder surfing example, it's not that E2EE isn't in place, it's that it is rendered useless by the circumstances. That is a distinct matter. The same applies to your heavily audited, reproducibly built, hash and signature checked, native, installed application. Worth jack if your phone itself, or the virtual keyboard you're typing on, etc, is compromised.
If this is how you segment things, E2EE cannot exist, hence why this is an incoherent segmentation; it selects for nothing that can actually exist, the label never truly applies. It's a category mistake.
> hence why this is an incoherent segmentation
Agree to disagree, I guess.
But I feel like you are just nitpicking on the wording. When I say "you cannot have E2EE in the browser", I mean "you don't get what you expect if you expect that you don't have to trust the server". And the reason I say it is that many products advertise themselves as "E2EE", and many users believe that what they get from it is that they don't have to trust the server.
So I feel like the message I am trying to convey is "be careful people, you get less security than you think".
Similarly, I feel like the message you are trying to convey is "your wording is subpar". Sure, I'm not good with words, and I'm usually not taken seriously because of that. I am sorry about it. Story of my life, I'm used to it :-). I just wish eloquent people used their skill to help me convey my point (if they agree with me, obviously) rather than to make it sound like my point is worthless.
In a sense I am. We kind of both are, I'd say, for reasons we each think are important.
For example:
- you may wish to protect the trust in / reputation of E2EE, and so you might gonna have an axe to grind with in-browser implementations, and thus you may feel compelled to segment this subject accordingly
- I kind of have an axe to grind with E2EE exactly because of how little it can actually guarantee to begin with, so rather than protecting the trust and reputation of E2EE, I feel drawn to correct the popular record, and spread the word about the very serious limitations of this thing, making me segment accordingly (although I do think that even beyond this, I am right to bikeshed this)
I'm speculating on your part obviously, though not on mine. I think of E2EE as a bare minimum, not something to be particularly proud of and market, and the more I learn about how we secure our devices over the years and decades, the more distraught I feel about these technological measures. It's a lot more smoke than fire.
At the same time, I could also apologize for the bikeshedding, but then I'd hope it's clear that it's not like I did it to annoy you or anything, I just have a different perspective, and find different things salient. What's a perfectly acceptable and even a justified high level categorization to you, is a bending-of-reality category error for me, and vice versa. Happens when people from arbitrarily different walks of lives from arbitrarily different points in their life cross paths. No way around it as far I'm aware, and it's not like I don't see your point either. Like yes, loading up a random website is obviously way more of a gamble than pulling up an app you may very well even manually update biweekly, no doubt about it. It's just a difference in the overarching narrative suggested that I'm hung up on.
E2EE can technically exist on a web app, but it would be stupid to rely on it, so, yeah, I'd just be careful when using the term for web apps, since you get something way less secure than what the term evokes.