Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Why doesn't TLS provide end-to-end encryption?
This question is somewhat related to this, this and this. If you want to talk to someone, say, through facebook, the TLS connection ends in the facebook server and they may be able to read it, before re-encrypting and sending it to the intended recipient. This seems a little off to me. Assuming the only thing facebook needs to forward the message is the metada which is not encrypted anyway, why TLS enables them to decrypt the message?
TLS encrypts a channel, and that channel is between your browser or app and the Facebook server. E2EE usually refers to the ability to send an encrypted message between two users such that the server relaying the message can't read it. But you do not have a TLS connection to the friend you are sending a message to, you have a TLS connection to the relay server. There are messaging protocols that do support end-to-end encryption, but Facebook's is not one of them and TLS doesn't really come into it.
The question is not correct. Two people can establish direct connection between their laptops in the same network and use TLS (assuming they have share public key in advance). In such case TLS does provide E2EE. But such cases are rare in reality.
Briefly: TLS provides security between 2 points only, i.e. on a single leg. Where as E2E connection between 2 people consists often of multiple independent legs.
Assuming the only thing facebook needs to forward the message is the metada which is not encrypted anyway, why TLS enables them to decrypt the message?
Because:
Note that TLS doesn't prevent the application from doing #3. It's just that TLS by itself does nothing to that end. End-to-end encrypted messengers like WhatsApp use two layers of encryption:
TLS is only doing #2; the applications have to add their own protocols to do #1.
