231–240 of 386 posts
Earlier quoted context omitted.
As long as the clients are open-source and the encryption is end to end, can't it really be verified? Whatever the server, if the client encryption is reliable, data can't be read on the server side.
if the client encryption is reliable It's not[1]. [1]: https://eprint.iacr.org/2015/1177.pdf
Does this include file transfers, if so, how? Curious because when sending a .webm video from an Android device to a iOS device, the video file was transcoded on WhatsApp servers and then delivered to the iOS device as H264/mp4 (since iOS can not play .webm files) This should no longer be working.
Are you sure encryption was active, both devices on the latest version? Is there a chance that the conversion was done on either of the devices?
Otherwise, yeah, something isn't right.
Earlier quoted context omitted.
And the language of the clients might not be the same. I might write in English to a German friend, but my whatsapp is localized to Danish and his to Germany. How would whatsapp know what language to present the words in?
It could have a language picker. It's not like you're stuck with just one language; the underlying fingerprint could be converted into any language that has an appropriate dictionary constructed for it, so all you would have to do is ensure both parties have picked the same language and you can then compare the fingerprint easily.
"Ok, your pattern is Bread Cloud Tiller..." "Scheiße! We're being MITMed! My pattern is Brot Wolke Pinne..."
Earlier quoted context omitted.
What's the incentive of not using TLS?
It's easy to shoot yourself in the foot with TLS (see: OpenSSL). Also, TLS has roots in a time where we knew much less in terms of crypto; as time went on and flaws were discovered, SSL/TLS was patched all around, meaning it has become much harder to implement correctly. Noise starts from a clean state with modern knowledge of cryptography and modern cryptography. Much easier to understand and replicate, much harder…
I would argue it's easier to shoot yourself in the face trying to re-implement/re-design something like TLS.
Earlier quoted context omitted.
Closed source software isn't impenetrable. The idea that you need source code to evaluate security claims is mostly a meme from the 1990s.
how's that boot taste?
Earlier quoted context omitted.
> deliberately picked to be possible to pronounce That only works in English, again.
It seems like there could be a lowest-common-denominator set of phonemes that such a system could be built on, with translations into symbol groups for different languages. As long as those symbol groups are relatable by two people who speak the same language, that might be sufficient?
Of course that's not helpful when two people who don't speak a common language are trying to establish communication, but it probably isn't their biggest problem.
Does this include file transfers, if so, how? Curious because when sending a .webm video from an Android device to a iOS device, the video file was transcoded on WhatsApp servers and then delivered to the iOS device as H264/mp4 (since iOS can not play .webm files) This should no longer be working.
Okay, first off: This is great. The most popular messaging app finally gets the security it needed. And we've just rolled out E2E to 1b 'monthly active users'. However, I have always wondered one thing about WhatsApp: How does it generate any kind of meaningful revenue? Apparently they've ditched the old $1 subscription model [0], and even that was so loosely enforced that I have never paid a single cent for WhatsApp…
This is kind of worrying. I'm sure it's not malicious but I have literally no idea if things are encrypted right now.