support.google.com/messages/answer/10262381?hl=en

Google Messages said that a secret key is generated for each message

What does this mean?

Do they actually create a new encryption key for each message?

What's the use of that though?

So if one key is compromised, the other messages arn't

@forest it's not much a security feature, but a safety feature... to not flood the bus lines with traffic all at once and have crosstalking messing up the bus

@JourneymanGeek But if a key is compromised, it would mean the attacker has access to the endpoints right? If they do, does it matter how many keys we generate?

Also, is this a common practice in the field; to have a new key every time we send data?

it's common in wifi

it's common other places too yes

@AndhavarapuBalu It's pretty common in end to end encryption. IIRC, Signal does that too

I'm really curious, how many warnings displayed by browsers about certificate errors are due to a genuine attack attempt and how many are because the website owner misconfigured their website (eg forgot to renew the certificate)?

I don't know, but I have a feeling that probably there are far more cases of misconfigured websites than genuine attacks.

I understand that browsers warn us and/or outright refuse to connect without allowing exceptions to protect us, but I'm worried that there may be far more false positives here than genuine problems.

Forgetting to renew certificates seems to be an especially common problem :(

@gaazkam The number of genuine problems is low because of the protections. If you remove the protections, the number MITMs will increase significantly.