211–220 of 386 posts
Earlier quoted context omitted.
By default, Telegram stores a plaintext copy of every message you've ever sent or received on their servers. WhatsApp does end to end encryption using the Signal Protocol by default, and doesn't store anything server side.
Does this mean Whatsapp do peer-to-peer message transfer or messages still pass through whatsapp servers?
Earlier quoted context omitted.
Don't forget that Telegram uses custom in house encryption and they say "trust us", it's good. Telegram encryption can't be verified.
As long as the clients are open-source and the encryption is end to end, can't it really be verified? Whatever the server, if the client encryption is reliable, data can't be read on the server side.
Earlier quoted context omitted.
Matrix uses the Signal protocol for encryption as well, if you want a fully free implementation of the same tech. https://matrix.org/git/olm/
thanks! could i use it to connect to WhatsApp?
Earlier quoted context omitted.
I was asking because I have a notification today in one of my chats saying that e2ee was enabled. I didn't see the same notification in any group chats. Outside of that notification, it's not clear to me when things are encrypted. Maybe the next step is a more obvious indicator.
I just checked this with a group chat I'm in, and it said that it was not yet enabled because one person has not yet updated.
Excellent! 3 questions: - What if the government forces WhatsApp to write and push a targeted software update in order to compromise the end-to-end encryption (I'm of course thinking of the FBI vs Apple case)? Is there a way for the user to be notified? - Does WhatsApp Auto Backup encrypt messages before sending them to Google Drive or iCloud? - Would it be possible for WhatsApp Web to rely on backend servers storing…
So you make a backup and loose the phone. What about the key? Is that gone too? Without it, encrypted backup is useless. How do you backup the key? You and me maybe will manage to do this, but what about grandma and all those people without anybody close who knows about this?
Earlier quoted context omitted.
Because words coming from Nahuatl are cool! (coyotl, mesquitl, tomatl, ahuacatl, etc.) See more from https://en.wikipedia.org/wiki/List_of_English_words_from_ind... They’re distinctively spelled, don’t collide with existing search terms, often have available domains, etc. Most importantly, they anticipated the web 2.0 trend of ending words with two consonants in a row. ;) Finally, just look at this guy: https://uploa…
Linguistic tangent: the common suffix on those words is interesting. Is it required for Nahuatl nouns, like the Latin -t suffix? I notice that not all the other example words on the linked page-section have it, but a large majority do.
Edit: yes, it's a suffix (for Classical Nahuatl): "Non-possessed nouns take a suffix called the absolutive. This suffix takes the form -tl after vowels (ā-tl, "water") and -tli after consonants [...]" ([2]).
0: https://en.wikipedia.org/wiki/Nahuatl#Phonology
1:https://en.wikipedia.org/wiki/Voiceless_alveolar_lateral_aff...
Earlier quoted context omitted.
I think this is a reasonable analysis. I would refine it this way (examples are only for illustrative purposes): Tier 1 secure messengers: all possible tradeoffs in favor of security made; use for worst-case adversaries: - Signal/TextSecure - Pond - PGP† - OTR Tier 2 secure messengers: serious secure messaging protocols that make some tradeoffs in favor of adoption and usability; use for normal messages of low sensit…
I would place Signal in the same tier as WhatsApp here (Tier 2). They both upload your contacts to an intermediate server that gives you their public key, which you can optionally verify afterwards. This means a malicious server could both store away your contacts and try to MITM you, risking detection if you do verify your fingerprint with the other party. A messenger that really did "all possible tradeoffs in favor…
Earlier quoted context omitted.
What's the incentive of not using TLS?
It's easy to shoot yourself in the foot with TLS (see: OpenSSL). Also, TLS has roots in a time where we knew much less in terms of crypto; as time went on and flaws were discovered, SSL/TLS was patched all around, meaning it has become much harder to implement correctly. Noise starts from a clean state with modern knowledge of cryptography and modern cryptography. Much easier to understand and replicate, much harder…
Earlier quoted context omitted.
Please read the articles. It already says that those are encrypted, as well as voice calls. Apparently once everyone is upgraded, nothing will be unencrypted. Their white paper also describes the protocols used in quite a lot of detail.
no proof without open source
Don't know what kind of funding they've been having, but for an open-source app, it's pretty polished.
Signal's stuff is all GPL'd (AFAIK). Does this mean that WhatsApp's clients (and whatever else would apply) are also released under the GPL?
I doubt it. The protocol is well defined, and a single developer could probably copy in in a reasonable amount of time. I guess that is what whatsapp did.