Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp's Signal Protocol integration is now complete

whispersystems.org

Post reply on HN
Print view View original

271–280 of 386 posts

Re: WhatsApp's Signal Protocol integration is now complete

#271

Post by espadrine »

msh wrote: post #123
StavrosK wrote: post #65

Earlier quoted context omitted.

> 12 words seems so much more friendly, at least to English speakers I have a feeling that English speakers are the minority of WhatsApp users. > if you don't speak a common language with your chat partner then the app is useless anyway They do speak a common language, it's usually just not English.

And the language of the clients might not be the same. I might write in English to a German friend, but my whatsapp is localized to Danish and his to Germany. How would whatsapp know what language to present the words in?

I might be misunderstanding the situation, but isn't emoji universal? Would it be ill-fitted here?

Re: WhatsApp's Signal Protocol integration is now complete

#272

Post by eridius »

jandrese wrote: post #234
eridius wrote: post #192

Earlier quoted context omitted.

It could have a language picker. It's not like you're stuck with just one language; the underlying fingerprint could be converted into any language that has an appropriate dictionary constructed for it, so all you would have to do is ensure both parties have picked the same language and you can then compare the fingerprint easily.

That could get confusing. "Ok, your pattern is Bread Cloud Tiller..." "Scheiße! We're being MITMed! My pattern is Brot Wolke Pinne..."

If I were to design this system, I'd make the language picker very prominent and have a very clear explanation saying to make sure both parties have the same language selected before comparing the words.

Alternatively, the party whose code is being confirmed would just select the language, and the other party's UI could automatically update to show the code in the chosen language. The first party would still have to pick a language both people understand but (as long as both parties have a working internet connection) there wouldn't be a sync issue.

Re: WhatsApp's Signal Protocol integration is now complete

#274

Post by derefr »

thaumasiotes wrote: post #257
derefr wrote: post #196

Earlier quoted context omitted.

Linguistic tangent: the common suffix on those words is interesting. Is it required for Nahuatl nouns, like the Latin -t suffix? I notice that not all the other example words on the linked page-section have it, but a large majority do.

> Is it required for Nahuatl nouns, like the Latin -t suffix? I don't understand what you're thinking of here? Here are some Latin nouns, all in nominative case: nauta (first declension) puer (second) gladius (second) malum (second) lex (third) limen (third) tempus (third) virtus (third) civitas (third) cornu (fourth) manus (fourth) res (fifth) I gave the nominative case, but in fact none of those nouns has any form…

Ah, sorry, yes, I meant the verbs. Originally I was going to make a comparison to nouns—nouns in Lojban, which have a -j suffix.

Re: WhatsApp's Signal Protocol integration is now complete

#275

Post by zmanian »

pfg wrote: post #69
mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

I keep wondering if package managers (be it Google Play, apt or dnf) are in need of a solution like Certificate Transparency. Like Certificate Transparency, it would not necessarily prevent a backdoor(/certificate) from being pushed to selected users, but it would guarantee detectability, at least after the fact. If the package as a whole is included in the log, it would also allow BinDiff-style reverse engineering o…

Yes binary transparency for package managers is extremely needed esp because we've been widely publicizing this vulnerability a lot now with no real fix.

Re: WhatsApp's Signal Protocol integration is now complete

#276

Post by lazard »

ThrustVectoring wrote: post #175

That's great news - secure-by-default is a huge thing, since it makes encrypted communication more normal. If most of your real-time communication is encrypted, then when and to whom you used encrypted communication isn't leaking valuable information. The next step is some kind of noise injection into the metadata. There are almost certainly ways to look at who is chatting with who when. It'd be fantastic to automati…

We're using noise to hide metadata in the Vuvuzela messaging system [1]. Using noise to hide metadata is efficient and gives good privacy (better than Tor-based approaches). We've formalized the privacy guarantee using differential privacy and are now working to make the system more user-friendly and easier to deploy.

[1] https://github.com/davidlazar/vuvuzela

Re: WhatsApp's Signal Protocol integration is now complete

#278

Post by muppetman »

kybernetikos wrote: post #217
tveita wrote: post #164

Earlier quoted context omitted.

I would place Signal in the same tier as WhatsApp here (Tier 2). They both upload your contacts to an intermediate server that gives you their public key, which you can optionally verify afterwards. This means a malicious server could both store away your contacts and try to MITM you, risking detection if you do verify your fingerprint with the other party. A messenger that really did "all possible tradeoffs in favor…

Does signal still rely on Google's marketplace and services being installed?

Yes

Re: WhatsApp's Signal Protocol integration is now complete

#279

Post by drdaeman »

jsmthrowaway wrote: post #258
drdaeman wrote: post #252

Earlier quoted context omitted.

A wild idea: a string of distinctive emojis (distinctive: I mean, not allowing emojis that are too close, like too similar face expressions where only smaller details differ) They're unified, they're mostly language-agnostic, and there is shitload of them so the representation would be much more compact than hexadecimal or base64-encoded string.

Cryptography software built with emojis would probably the final straw to me burning down my career, destroying every computing device I own, buying a shrimp boat, and living out my days at sea with a Lieutenant Dan stand-in by my side, wistfully remembering the good times when the computing world made sense as Bud Light finds its way down my jaded, cynical throat. Put it on a .io domain for bonus points.

Hey, hey, if that nonsense would appear in my XMPP client I'd really feel the urge do to the same. But aren't we're talking about modern popular messaging apps here?

If those only'd be international, I'd seriously propose key fingerprints based on animated meme-filled "gifs". Because that's what the common audience understands (or at least my impression is so). Not some weird-looking strings of meaningless digits and letters.

Re: WhatsApp's Signal Protocol integration is now complete

#280

Post by nickik »

nxzero wrote: post #269
nickik wrote: post #211

Earlier quoted context omitted.

Their is no mobile message app that does peer-to-peer as far as I know. Whatsapp, Telegram, Signal, Actor, Threema all go over a server.

Why?

Because its very hard to make reliable peer-to-peer apps. Phones are not always reachable easly on the same ip address. They move around, they are sometimes offline, sometimes they have high latency, the network drops most packages, they have limited space and computational power.

To deliver a message they both need to be online at the same time. For group messages you need to be very clever to get it working when only part of the people are online. The key destribution is also extreamly difficulte.

So lots of problem for very little gain.

What would be smart is to have a federated architecture so people can host their own servers and that would solve PART of the same problems, pure peer-to-peer would solve. Actor is devloping in this direction, and they want to get it working with Signal protocol, Signal itself would probebly do it as well if they had the manpower.

Post reply on HN