What is the incentive for Facebook to add encryption here to WhatsApp? Don't they want to mine every piece of data about every person that they can? I can't imagine there is that much customer demand?
WhatsApp's Signal Protocol integration is now complete
301–310 of 386 posts
Re: WhatsApp's Signal Protocol integration is now complete
#302Great news. I'm just wondering why Facebook/Zuck is doing this. Is he fearing the competition–all the other E2E messengers out there? I'm asking because I could imagine that Whatsapp might get banned in some countries soon (as recently happened in Brazil) and thus, lose market share.
I also wonder how Facebook will monetize WhatsApp with e2e now.
Re: WhatsApp's Signal Protocol integration is now complete
#303I'm looking at libaxolotl-c. I'm a little bit disturbed about perfect forward/future secrecy. Perfect forward secrecy ensure that a session key cannot be compromised if a long-term key is compromised in future. With something like OTR even if a session key is compromised at n, session key at n-1 or n+1 will not be compromised. Here, we got perfect forward/future secrecy. If i take a look at axolotl, in scenario Alice…
"Perfect forward secrecy" requires synchronous key exchange. The compromise that signal protocol makes is for forward secrecy to "eventually repair" itself while in the meanwhile a limited number of messages are potentially vulnerable. That is one of the novel feature of the protocol and it is what allows for async communication without some central server doing all the key mgmt (central key mgmt doesn't have this pr…
"Eventual forward secrecy"?
Re: WhatsApp's Signal Protocol integration is now complete
#304Is there any reasonable way to verify that end-to-end encryption is actually being used, and used correctly? From a user's point of view the app looks and works exactly the same as before, except for the addition of a QR code which could be doing anything.
Define 'reasonable'. Essentially, no. You have to trust that the app is really doing what it claims to be doing. If it were open source, would it be different? Maybe. Signal Messenger is open source and the Android build is reproducible. However, the way you reproduce it is to run a Docker image, so that isn't really meaningful unless you audit the code that's used to build it. And then audit the code of the app itse…
But can we still be sure of our privacy if we combine two or more such semi-secure systems? TOR does such a thing with the Onion Routing protocol by using intermediaries.
Re: WhatsApp's Signal Protocol integration is now complete
#305So exactly how do group chats work in Signal Protocol?
Re: WhatsApp's Signal Protocol integration is now complete
#306absolutely no proof it is e2e encrypted without the source.
I'm sorry, but that's not how computer software works. Anyone who knows what a basic block is can straightforwardly verify the claims WhatsApp is making.
How would we go about verifying Whatsapp's claims? It seems to me that they can easily be lying and we have no way to check. Also, they can just make a client that simply copies the unencrypted text displayed on-screen and leaks it to wherever they want.
Re: WhatsApp's Signal Protocol integration is now complete
#307Earlier quoted context omitted.
> Is it required for Nahuatl nouns, like the Latin -t suffix? I don't understand what you're thinking of here? Here are some Latin nouns, all in nominative case: nauta (first declension) puer (second) gladius (second) malum (second) lex (third) limen (third) tempus (third) virtus (third) civitas (third) cornu (fourth) manus (fourth) res (fifth) I gave the nominative case, but in fact none of those nouns has any form…
Ah, sorry, yes, I meant the verbs. Originally I was going to make a comparison to nouns—nouns in Lojban, which have a -j suffix.
I'm confused and am not sure if you're thinking of something else or if I'm quite misinformed about Lojban. I don't think lojban has suffixes at all (prefixes, on the other hand). For -j specifically, the only words in lojban which are permitted to end in j are names, but there it's not obligatory. Names are required to end in a consonant, but there are at least a few that are more common than j, I think.
Re: WhatsApp's Signal Protocol integration is now complete
#308What the article fails to mention: 1) I would assume Facebook still gets unencrypted access to my address book for use with their shadow profiles 2) We have zero control over what key the client encrypts the messages for. Is it only the other peer's phone? Or is it for the peer's phone plus Facebook for analysis of the messages? Especially 2) is of some concern to me (against 1 I can't protect myself anyways because…
> whatever you're sending over WhatsApp is likely going to be used by FB The article links to the technical white paper[0] which explains why your points are invalid. > I'm still inclined to trust apple's iMessage a bit more Do you have any proof why iMessage is more secure or is that statement also baseless? [0]: https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...
A white paper is not an implementation. Whatsapp is owned by Facebook and required to increase their bottom line. They are not a charity.
Re: WhatsApp's Signal Protocol integration is now complete
#309This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…
> 12 words seems so much more friendly, at least to English speakers I have a feeling that English speakers are the minority of WhatsApp users. > if you don't speak a common language with your chat partner then the app is useless anyway They do speak a common language, it's usually just not English.
>> if you don't speak a common language with your chat partner then the app is useless anyway
> They do speak a common language, it's usually just not English.
I think you misunderstood the original poster was getting at. Here's the full parenthetical: "(perhaps with icons instead of specific words? if you don't speak a common language with your chat partner then the app is useless anyway)". So replace the words that you're supposed to read with little pictures. Then it doesn't matter what language the people speak as long as they're speaking the same language, since they'll be "reading" the images. You'll see a little house icon, and read "house" or "casa" or "jia" or whatever.
Re: WhatsApp's Signal Protocol integration is now complete
#310Earlier quoted context omitted.
When you say Telegram servers store plaintext "by default", does that imply this is not also true of their "Secret Chat" feature? That mode appears to behave as if it's exchanging keys and doing end-to-end encryption... (I am aware of the Telegram flaws you and others have pointed out).
"Secret Chat" uses Telegram's (flawed) E2E protocol, so the server would only see ciphertext. A "normal" chat is stored in plaintext. This is also why normal chats work in multi-device environments, but secret chats don't. Unlike iMessage (and I assume Signal - haven't looked at the actual protocol), they don't do anything fancy like making the sender encrypt messages with multiple public keys (one for each device th…
If you know something that telegram doesn`t know, maybe you should contact them, and ask your bitcoins worth of 200,000$ https://telegram.org/crypto_contest. Easier to "talk".