[Open Source Software] General-purpose, censorship-resistant, end-to-end encryption protocol

End-to-end encryption; the last vestige of an internet uncaptured by big tech

Since mid-2024 I've led the TACo project, an ambitious attempt to build a general-purpose end-to-end encryption protocol without a single point of failure. The protocol answers the question; 'How can private data be shared within/across the applications we use every day, without trusting centralized servers (typically run by a commercial entity) to decrypt/re-encrypt/route messages and payloads?'.

The problem is three-fold:

(1) Virtually all mainstream applications are designed to decrypt your data on their servers. Healthcare portals, social platforms, shared spreadsheets, booking aggregators, connected vehicles, chatbot providers – they're all trusted with your sensitive information, a trust they habitually betray by extracting and monetizing whatever value they can. Normally, it's predicting your moods and inclinations to sell you fast fashion at the right moment. Other times, it's serving you individually inflated flight prices because your purchased personal emails tell them you have a funeral coming up and duty plus grief means your price sensitivity is lower.

(2) True end-to-end encryption – i.e. where the raw data is un-decryptable by the intermediary or provider – is limited to a few messaging applications. This means that all the other quotidian platforms and tools– Google Sheets, OnStar, Kayak, Gmail, ChatGPT, MyChart, the list goes on – are being trusted with the plaintext (readable) version of your private data.

(3) Although there's no evidence (yet) that the contents of WhatsApp messages are decryptable on their servers, there have been instances of effective breaches via the surreptitious group expansion – i.e. the end-to-end encryption remained intact, but WhatsApp groups had numbers added without the admin's knowledge. More importantly, we know that Meta harvests the metadata for all kinds of nefarious purposes.