I was forced to uninstall Viber on account of the SPAM I was getting. I have been trying to figure out how the spammers got my viber contact information.
Viber adds end-to-end encryption
41–50 of 114 posts
Re: Viber adds end-to-end encryption
#42End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.
> Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.
Ricochet (https://ricochet.im/) solves that problem using Tor hidden services. Desktop only at the moment AFAIK, though.
Re: Viber adds end-to-end encryption
#43End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.
Would open sourcing the Whatsapp client hurt Whatsapp in any significant way? I mean, sure, there could be "Whatsapp clones" (aren't there already?!), but wouldn't Whatsapp still benefit from the phone number user base it has, thus maintaining a certain lock-in on its users from which it already benefits?
Here's the Telegram iOS code by the way: https://github.com/peter-iakovlev/Telegram
Re: Viber adds end-to-end encryption
#44What really impresses me about Viber is the way they went all out and splurged with an honest to god penultimate "e" before the final "r". Most dot-com companies would have settled for "Vibr", but they went the distance and bought an authentic luxurious vowel, precisely where it was called for, without going overboard and throwing in a sometimes-vowel "y" in place of the "i". Very bold and straightforward spelling, I…
Or ... people name their products/companies based on their ability to secure a proper domain name, rather than being some hipster startup founder trying to appear edgy. Does Viber seem like a name that would be taken?! Listd.com vs listed.com was one I had to deal with some time ago.
Re: Viber adds end-to-end encryption
#45Earlier quoted context omitted.
> I mean, sure, there could be "Whatsapp clones" (aren't there already?!) Sounds funny if you consider that Whatsapp itself is just a branded deployment of FOSS XMPP server Ejabberd, with feature of federation taken away. Plus a client app implementation, of course.
That is only possible because Ejabberd doesn't use the AGPL license.
Come on, it would definitely still be possible with AGPL code. What brought people to whatsapp is its ubiquity and the fact that it just works, and what keeps them from going elsewhere is the inevitable network effect.
Nothing in the AGPL prevents either from occurring.
Re: Viber adds end-to-end encryption
#46Earlier quoted context omitted.
Ideally it would be possible to use third party clients to connect, and so anyone could use a fully open source solution if they wanted.
That's fair! But you need far more than just the crypto code to create a client, I think open source protocol specs would already achieve this. And my main complaint was with the claim that open sourcing their crypto code would somehow make a meaningful difference to the security of these applications to the extent where you could consider all applications that haven't done so "insecure".
I don't think I get your complaint
Without open-sourcing the crypto, they could be just doing rot16($message) for all we know. Open-source is a requirement for being considered secure. It doesn't mean they aren't secure if they aren't open-source, but that you shouldn't consider it so, because you don't know if it is or not.
Re: Viber adds end-to-end encryption
#47Earlier quoted context omitted.
Telegram had e2e private chats for over a year before WhatsApp added e2e
Does bad crypto counts? I don't think so.
I keep seeing this accusation get flung around whenever someone mentions telegram but never proof. I remember telegram had a vulnerability once and then it was patched just like any other security software.
You shouldn't throw around accusations without proof.
Re: Viber adds end-to-end encryption
#48Earlier quoted context omitted.
It's the same thing people complain about wrt unfree software, e.g. Kindle deleting purchased books remotely if they were uploaded by someone without the rights to the book. The difference with snapshot is that their whole gimmick was the deleting thing. You had no expectation of permanency. But I'm sure many use Viber with the expectation that they'll be able to access old communications; after all, it's on their ow…
If a service offers a feature, it's within customers' rights to use that feature. If Viber is unilaterally deleting messages, that's an issue (as ephemeral messaging doesn't seem to be their primary intent). But if Alice is able to delete her messages to Bob on Bob's device, and both know this (or should know this, they chose the messaging platform), Bob has not had his rights violated. He's complying with Alice's re…
The comparison to Amazon is about the remotely deleting part, not the why part. I have a problem with anything on my device being deleted without my consent.
Re: Viber adds end-to-end encryption
#49Earlier quoted context omitted.
That is only possible because Ejabberd doesn't use the AGPL license.
Come on, it would definitely still be possible with AGPL code. What brought people to whatsapp is its ubiquity and the fact that it just works, and what keeps them from going elsewhere is the inevitable network effect. Nothing in the AGPL prevents either from occurring.
I think you are misunderstanding jeena. If ejabberd were AGPL, then a fork/a instance of it like Whatsapp would be legally obliged to open up their code as well.
No idea whether the assumption is true that Whatsapp is just a branded deployment.
Re: Viber adds end-to-end encryption
#50Earlier quoted context omitted.
Even if I were to accept your logic, what's ridiculous about that?
Open sourcing the crypto code wouldn't be ridiculous, but pointless. What I find ridiculous though was >venders that don't agree to an audit should be considered insecure The same thing applies to every single part of the application, but not equally. No attacker is going to start out by trying to break the crypto, unless it's obviously broken. "Normal" bugs are far more common and often more dangerous (Thing RCE, or…
> No attacker is going to start out by trying to break the crypto, unless it's obviously broken.
Emphasis mine. I agree with ryanlol here. Why bother with active attacks when you can just steal their private key from a code execution?
Similar to this, but with the priority flipped:
https://www.bishopfox.com/blog/2016/04/if-you-cant-break-cry...