Editing End-to-end encryption (section)

=== Endpoint security ===
The end-to-end encryption paradigm does not directly address risks at the communications endpoints themselves. Each user's computer can still be hacked to steal their cryptographic key (to create a MITM attack) or simply read the recipients’ decrypted messages both in real time and from log files. Even the most perfectly encrypted communication pipe is only as secure as the mailbox on the other end.<ref name="Wired Lexicon" /> Major attempts to increase endpoint security have been to isolate key generation, storage and cryptographic operations to a smart card such as Google's Project Vault.<ref>Julie Bort, Matt Weinberger [http://www.businessinsider.com/googles-project-vault-for-secret-messages-2015-5?r=US&IR=T&IR=T "Google's Project Vault is a tiny computer for sending secret messages"] {{webarchive|url=https://web.archive.org/web/20170808195058/http://www.businessinsider.com/googles-project-vault-for-secret-messages-2015-5?r=US&IR=T&IR=T |date=2017-08-08 }}, ''[[Business Insider]]'', NYC May 29, 2015</ref> However, since plaintext input and output are still visible to the host system, malware can monitor conversations in real time. A more robust approach is to isolate all sensitive data to a fully [[Air gap (networking)|air gapped]] computer.<ref>Whonix Wiki [https://www.whonix.org/wiki/Air_Gapped_OpenPGP_Key "Air Gapped OpenPGP Key"] {{webarchive|url=https://web.archive.org/web/20170808194727/https://www.whonix.org/wiki/Air_Gapped_OpenPGP_Key |date=2017-08-08 }}</ref> [[Pretty Good Privacy|PGP]] has been recommended by experts for this purpose.<ref>{{cite web|quote=If I really had to trust my life to a piece of software, I would probably use something much less flashy — GnuPG, maybe, running on an isolated computer locked in a basement. |author=[[Matthew D. Green]] |url=https://blog.cryptographyengineering.com/2013/03/09/here-come-encryption-apps/ |title=A Few Thoughts on Cryptographic Engineering |date=9 Mar 2013}}</ref> However, as [[Bruce Schneier]] points out, [[Stuxnet]] developed by US and Israel successfully jumped air gap and reached Natanz nuclear plant's network in Iran.<ref>Bruce Schneier [https://www.schneier.com/blog/archives/2013/10/air_gaps.html "Air Gaps"] {{webarchive|url=https://web.archive.org/web/20170609082507/https://www.schneier.com/blog/archives/2013/10/air_gaps.html |date=2017-06-09 }}, ''[[Schneier on Security]]'', October 11, 2013</ref> To deal with key exfiltration with malware, one approach is to split the [[Trusted Computing Base]] behind two [[Unidirectional network|unidirectionally connected]] computers that prevent either insertion of malware, or exfiltration of sensitive data with inserted malware.<ref>{{cite web|url=https://github.com/maqp/tfc|title=maqp/tfc|website=GitHub|access-date=26 April 2018|url-status=live|archive-url=https://web.archive.org/web/20170331092533/https://github.com/maqp/tfc/|archive-date=31 March 2017}}</ref>