Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Viber adds end-to-end encryption

techcrunch.com

Post reply on HN
Print view View original

11–20 of 114 posts

Re: Viber adds end-to-end encryption

#11

Post by tremon »

ryanlol wrote: post #9
nxzero wrote: post #7

End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.

That's just an utterly ridiculous proposition. By that logic the entire application would need to be open source, because nobody would start out by targeting the crypto if they wanted to spy on someone.

Even if I were to accept your logic, what's ridiculous about that?

Re: Viber adds end-to-end encryption

#12

Post by ikeboy »

>The enhanced delete feature, meanwhile, has been in the app for a while, but is part of the company’s is a way for users to wipe a conversation not just on their end, but on that of the recipient’s phone. You can think of this as Viber’s answer to ephemeral messaging, but with a more manual approach.

Does anyone else think this is a violation of users' rights? If I've been sent a message, it shouldn't be possible for the server to delete it. I could screenshot everything, or run a tweak that saves everything.

Imagine if Gmail started allowing senders to remove email they've already sent and has been delivered.

Re: Viber adds end-to-end encryption

#13

Post by ikeboy »

dkopi wrote: post #6
pttrsmrt wrote: post #4

More great news from the world of communication, but yet again I'm wondering how we can trust the encryption to really be end-to-end without access to the code. Are the messages still traveling through Vibers servers? Is there any way to know?

"I'm wondering how we can trust the encryption" You can't. Not unless the company employees security experts, has a significant bug bounty program (with significant rewards), is open to a degree about their securit architecture, and is popular enough for white hats to actively seek out bugs. This isn't about trusting that the company isn't try to dupe you. It's about trusting that the company can implement security p…

How much do you think a WhatsApp passive decryption bug would be worth? They don't seem to have a bug bounty, I wonder how much something would go for on the black market.

Re: Viber adds end-to-end encryption

#14

Post by imaginenore »

ryanlol wrote: post #9
nxzero wrote: post #7

End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.

That's just an utterly ridiculous proposition. By that logic the entire application would need to be open source, because nobody would start out by targeting the crypto if they wanted to spy on someone.

ryanlol is correct though. If you open source just the end-to-end crypto part, it doesn't mean that the there's no backdoor elsewhere - it could easily leak the keys or whole conversations.

The second problem is - you don't know if that source is what ended up in the binary.

So yeah, unless you can compile the whole thing yourself, it should not be considered secure.

Re: Viber adds end-to-end encryption

#15

Post by robbiemitchell »

ikeboy wrote: post #12

>The enhanced delete feature, meanwhile, has been in the app for a while, but is part of the company’s is a way for users to wipe a conversation not just on their end, but on that of the recipient’s phone. You can think of this as Viber’s answer to ephemeral messaging, but with a more manual approach. Does anyone else think this is a violation of users' rights? If I've been sent a message, it shouldn't be possible fo…

What do you mean by "user's rights" and by "sent"? Why shouldn't it be possible? If the TOS and app allow and enable it, it can be done.

This sounds no different from, say, Snapchat, except that the deletion is triggered by the sender instead of by a timer.

Re: Viber adds end-to-end encryption

#16

Post by ghshephard »

ikeboy wrote: post #12

>The enhanced delete feature, meanwhile, has been in the app for a while, but is part of the company’s is a way for users to wipe a conversation not just on their end, but on that of the recipient’s phone. You can think of this as Viber’s answer to ephemeral messaging, but with a more manual approach. Does anyone else think this is a violation of users' rights? If I've been sent a message, it shouldn't be possible fo…

I think it's reasonable to allow senders to revoke a sent message, particularly if it was sent just a short period of time ago. The only assurance you would have that this works is if both sender/receiver are on the same system. The question is a little trickier if the receiver has read the message. And, I agree, that after some period of time, particularly after the receiver has read the message, the message should be inviolate on the receivers side.

Re: Viber adds end-to-end encryption

#17

Post by mtgx »

nxzero wrote: post #7

End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.

Would open sourcing the Whatsapp client hurt Whatsapp in any significant way?

I mean, sure, there could be "Whatsapp clones" (aren't there already?!), but wouldn't Whatsapp still benefit from the phone number user base it has, thus maintaining a certain lock-in on its users from which it already benefits?

Re: Viber adds end-to-end encryption

#18

Post by ikeboy »

robbiemitchell wrote: post #15
ikeboy wrote: post #12

>The enhanced delete feature, meanwhile, has been in the app for a while, but is part of the company’s is a way for users to wipe a conversation not just on their end, but on that of the recipient’s phone. You can think of this as Viber’s answer to ephemeral messaging, but with a more manual approach. Does anyone else think this is a violation of users' rights? If I've been sent a message, it shouldn't be possible fo…

What do you mean by "user's rights" and by "sent"? Why shouldn't it be possible? If the TOS and app allow and enable it, it can be done. This sounds no different from, say, Snapchat, except that the deletion is triggered by the sender instead of by a timer.

It's the same thing people complain about wrt unfree software, e.g. Kindle deleting purchased books remotely if they were uploaded by someone without the rights to the book.

The difference with snapshot is that their whole gimmick was the deleting thing. You had no expectation of permanency. But I'm sure many use Viber with the expectation that they'll be able to access old communications; after all, it's on their own device.

Sure, they have the right to do it, in the same way that Gmail could implement the same anti feature, in the same way Amazon had the right to delete books. But that just causes me not to use them, just like I'd stop using Gmail if they did that. (I still use a Kindle, but I've only ever purchased one book, and read it right away. I'm not dependent on them not deleting my books.)

Re: Viber adds end-to-end encryption

#19

Post by andrey_utkin »

mtgx wrote: post #17
nxzero wrote: post #7

End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.

Would open sourcing the Whatsapp client hurt Whatsapp in any significant way? I mean, sure, there could be "Whatsapp clones" (aren't there already?!), but wouldn't Whatsapp still benefit from the phone number user base it has, thus maintaining a certain lock-in on its users from which it already benefits?

> I mean, sure, there could be "Whatsapp clones" (aren't there already?!)

Sounds funny if you consider that Whatsapp itself is just a branded deployment of FOSS XMPP server Ejabberd, with feature of federation taken away. Plus a client app implementation, of course.

Re: Viber adds end-to-end encryption

#20

Post by ikeboy »

ghshephard wrote: post #16
ikeboy wrote: post #12

>The enhanced delete feature, meanwhile, has been in the app for a while, but is part of the company’s is a way for users to wipe a conversation not just on their end, but on that of the recipient’s phone. You can think of this as Viber’s answer to ephemeral messaging, but with a more manual approach. Does anyone else think this is a violation of users' rights? If I've been sent a message, it shouldn't be possible fo…

I think it's reasonable to allow senders to revoke a sent message, particularly if it was sent just a short period of time ago. The only assurance you would have that this works is if both sender/receiver are on the same system. The question is a little trickier if the receiver has read the message. And, I agree, that after some period of time, particularly after the receiver has read the message, the message should…

If it hasn't been delivered to the user's device, fine. Once it's been delivered, it shouldn't be modified.

I suppose I might be OK with individual exceptions to this rule, if some sensitive message was sent, after going through customer service. It certainly shouldn't be a one click to delete.

Post reply on HN