Are there any Implementations of Secure Indexes?

How can any "secure email" or "secure messaging" be safe with potential backdoors through OSs via screenshots?

• Every time I see a secure email or secure messaging app I think "How can it truly be safe if various agencies or others are backdooring an OS or simply somehow taking screenshots on your computer or phone?" Are we just assuming an OS is secure (probably Apple computer moreso than others) and that this adds a layer of security? It seems even less likely to be secure on Android. I am not understanding how this could be truly secure if there is a way to simply backdoor a computer OS or phone OS and take screenshots. Am I missing something about IT security?

• Answer:

  When email and IM services describe themselves as "secure," they're making that claim for what's in scope for the service. The ability to take screenshots of your email is not something an email service can do anything about, and demanding this kind of protection would be about as strange as demanding that the lock on your car door protects the windows of your home against someone breaking in and stealing your car keys. So an email or IM service can call itself "secure" if the service itself won't give away your secrets. Protection against screenshots and keyloggers is way out of scope for an email or IM service; that responsibility is on you. For the same reason, hard drive encryption systems can call themselves "secure" in spite of their inability to bolster their users psychologically against being tortured for the password (i.e. the ol' "rubber hose" attack vector). Ultimately, it's naive to expect a single service to protect you from all attacks.