Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp's Signal Protocol integration is now complete

whispersystems.org

Post reply on HN
Print view View original

51–60 of 386 posts

Re: WhatsApp's Signal Protocol integration is now complete

#52

Post by jszymborski »

envy2 wrote: post #15
mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

> 2) It's a shame to see key words be killed off by internationalisation concerns. 12 words seems so much more friendly, at least to English speakers, than a 50 digit number. In practice I doubt any non-trivial numbers of people will ever compare codes by reading out such a number. I hope further research here can develop better replacements for encoding short binary strings in i18n friendly ways (perhaps with icons…

I feel like there are a lot of security issues with QR code representations, namely that the information are even less transparent than hexadecimal fingerprints, and therefore are not really a fail-safe to MITM attacks.

Re: WhatsApp's Signal Protocol integration is now complete

#53

Post by stormbrew »

kuschku wrote: post #40
martindevans wrote: post #29

Earlier quoted context omitted.

> It's a shame to see key words be killed off by internationalisation concerns [....] I hope further research here can develop better replacements for encoding short binary strings in i18n friendly ways I rather like the urbit way of encoding numbers. I can't remember the exact details but it's something like: There are 256 unique three letter words (all nonsense, but deliberately picked to be possible to pronounce).…

> deliberately picked to be possible to pronounce That only works in English, again.

It seems like there could be a lowest-common-denominator set of phonemes that such a system could be built on, with translations into symbol groups for different languages. As long as those symbol groups are relatable by two people who speak the same language, that might be sufficient?

Re: WhatsApp's Signal Protocol integration is now complete

#54

Post by blackoil »

schlowmo wrote: post #33
LeoPanthera wrote: post #21

Earlier quoted context omitted.

"Normal" people will not have their choice of messenger swayed by any argument that uses the word "protocol".

Point taken. If I talk to "normal" people, I wouldn't use the word "protocol" neither (or at least not as conversation starter). Normal-people-rephrased it's more like "When whatsapp take the fundamental core from signal..."

can Signal be used to contact people on Whatsapp?

Re: WhatsApp's Signal Protocol integration is now complete

#56

Post by Ianvdl »

robert_foss wrote: post #28

moxie: Does this mean that both Facebook and Signal servers are unable to see the plaintext? (I would assume so, but I would like to have it confirmed. From someone who actually knows what he's talking about.)

This is the first thing that came to mind when I read this, having clarification from them would be reassuring.

Re: WhatsApp's Signal Protocol integration is now complete

#57

Post by jamesdwilson »

tptacek wrote: post #55
jamesdwilson wrote: post #51

absolutely no proof it is e2e encrypted without the source.

I'm sorry, but that's not how computer software works. Anyone who knows what a basic block is can straightforwardly verify the claims WhatsApp is making.

you don't know how e2e security works, do you? without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.

Re: WhatsApp's Signal Protocol integration is now complete

#58

Post by tptacek »

martindevans wrote: post #29
mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

> It's a shame to see key words be killed off by internationalisation concerns [....] I hope further research here can develop better replacements for encoding short binary strings in i18n friendly ways I rather like the urbit way of encoding numbers. I can't remember the exact details but it's something like: There are 256 unique three letter words (all nonsense, but deliberately picked to be possible to pronounce).…

This idea isn't unique to Urbit; it dates back to at least S/Key.

Re: WhatsApp's Signal Protocol integration is now complete

#59

Post by pilif »

What the article fails to mention:

1) I would assume Facebook still gets unencrypted access to my address book for use with their shadow profiles

2) We have zero control over what key the client encrypts the messages for. Is it only the other peer's phone? Or is it for the peer's phone plus Facebook for analysis of the messages?

Especially 2) is of some concern to me (against 1 I can't protect myself anyways because if people add me to their address books I'm screwed anyways). From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events.

The only safe solution right now is to compile your own signal client and use that, of course at the cost of reach because nobody else is on Signal.

WhatsApp might be a good compromise at least for only semi-important messages: The probability that any of your contacts has WhatsApp is much, much higher than the probability of them having Signal running. On the other hand, whatever you're sending over WhatsApp is likely going to be used by FB (and then possibly handed out to governments and/or stolen by attackers).

Re: WhatsApp's Signal Protocol integration is now complete

#60

Post by wyager »

tptacek wrote: post #37
nnnnnn wrote: post #36

Without whatsapp being open source, how do we know for sure that Facebook is not somehow storing or reading our messages? As good as this sounds on paper, I hesitate to trust Facebook to transmit my data without wanting to peek a bit. I currently use both Whatsapp and Signal and will probably continue to do the same unless there is a way for users to verify Facebook doesn't keep a copy.

Closed source software isn't impenetrable. The idea that you need source code to evaluate security claims is mostly a meme from the 1990s.

You don't need the source, but it makes it a hell of a lot easier.
Post reply on HN