Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Viber adds end-to-end encryption

techcrunch.com

Post reply on HN
Print view View original

61–70 of 114 posts

Re: Viber adds end-to-end encryption

#61

Post by arbsn »

tptacek wrote: post #58
nxzero wrote: post #7

End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.

WhatsApp's "E2E" code is from Signal, which is open source. This zealous belief that all secure cryptography must be open source is something I hear a lot from open source advocates, but not so much from cryptography engineers.

Is the encryption/decryption code in WhatsApp open-source? I haven't been able to find it. My assumption was that they conform to the Signal encryption protocol, which is openly specified, but that the code they use to do so is not open-source.

Re: Viber adds end-to-end encryption

#63

Post by dchest »

ikeboy wrote: post #12

>The enhanced delete feature, meanwhile, has been in the app for a while, but is part of the company’s is a way for users to wipe a conversation not just on their end, but on that of the recipient’s phone. You can think of this as Viber’s answer to ephemeral messaging, but with a more manual approach. Does anyone else think this is a violation of users' rights? If I've been sent a message, it shouldn't be possible fo…

Imagine you're on the run from mafia and communicating with your parents via a messenger. You sent your current location and after a few hours mafia people approached your parents and took their phone. Now, if you sent an message that deletes itself, you're sure that unless your parents didn't preserve it intentionally by copying and pasting or taking screenshot, this location isn't revealed to mafia. If your messenger didn't have this feature, your parents would have manually delete the sensitive message — what if they forgot?

This feature is quite useful, even if not 100% proof.

Re: Viber adds end-to-end encryption

#64

Post by ikeboy »

robbiemitchell wrote: post #60
ikeboy wrote: post #48

Earlier quoted context omitted.

The comparison to Amazon is about the remotely deleting part, not the why part. I have a problem with anything on my device being deleted without my consent.

You used the word "sent" earlier and the phrase "on my device" now. But it seems the app isn't transferring the message to you, only presenting it -- like a website. (Does the message exist outside the app?) Not being pedantic for the sake of it, just pointing out the language you are using is from a position of ownership -- you receiving and owning a message sent to you, and it is then being deleted -- while the app…

Once it can be viewed offline, the sender shouldn't be able to delete it.

Re: Viber adds end-to-end encryption

#65

Post by ikeboy »

dchest wrote: post #63
ikeboy wrote: post #12

>The enhanced delete feature, meanwhile, has been in the app for a while, but is part of the company’s is a way for users to wipe a conversation not just on their end, but on that of the recipient’s phone. You can think of this as Viber’s answer to ephemeral messaging, but with a more manual approach. Does anyone else think this is a violation of users' rights? If I've been sent a message, it shouldn't be possible fo…

Imagine you're on the run from mafia and communicating with your parents via a messenger. You sent your current location and after a few hours mafia people approached your parents and took their phone. Now, if you sent an message that deletes itself, you're sure that unless your parents didn't preserve it intentionally by copying and pasting or taking screenshot, this location isn't revealed to mafia. If your messeng…

As I said below, if every request had to go through customer service, I might be okay with it.

And doesn't the same logic apply to Gmail? Do you think they should do the same?

Re: Viber adds end-to-end encryption

#66

Post by tptacek »

It sounds like there's not yet any published details on what the crypto Viber's using is. Can we withhold judgement until we get that? I'm fine with closed-source, but not with no technical documentation.

Most people who try to implement cryptographically secure messaging get it badly wrong.

Re: Viber adds end-to-end encryption

#68

Post by morgante »

tptacek wrote: post #66

It sounds like there's not yet any published details on what the crypto Viber's using is. Can we withhold judgement until we get that? I'm fine with closed-source, but not with no technical documentation. Most people who try to implement cryptographically secure messaging get it badly wrong.

We absolutely do need to get some documentation to judge whether Viber has good crypto.

That being said, we can still judge them positively for at least trying to secure their user's messages end-to-end.

Re: Viber adds end-to-end encryption

#69

Post by ikeboy »

CiPHPerCoder wrote: post #51
CaptSpify wrote: post #46

Earlier quoted context omitted.

I don't think I get your complaint Without open-sourcing the crypto, they could be just doing rot16($message) for all we know. Open-source is a requirement for being considered secure. It doesn't mean they aren't secure if they aren't open-source, but that you shouldn't consider it so, because you don't know if it is or not.

> I don't think I get your complaint > Without open-sourcing the crypto, they could be just doing rot16($message) for all we know. There are two things you can do: 1. Watch the outbound traffic and attempt known-plaintext attacks 2. Reverse engineer the app Neither is particularly difficult. Most Android apps are trivial to break apart using Lobotomy. A large swath of software security folks specialize in binary audi…

Has anyone done that and produced a fully open source app to connect to whatsapp?

Re: Viber adds end-to-end encryption

#70

Post by lotso »

ikeboy wrote: post #48
Jtsummers wrote: post #40

Earlier quoted context omitted.

If a service offers a feature, it's within customers' rights to use that feature. If Viber is unilaterally deleting messages, that's an issue (as ephemeral messaging doesn't seem to be their primary intent). But if Alice is able to delete her messages to Bob on Bob's device, and both know this (or should know this, they chose the messaging platform), Bob has not had his rights violated. He's complying with Alice's re…

The comparison to Amazon is about the remotely deleting part, not the why part. I have a problem with anything on my device being deleted without my consent.

I think this is a valuable feature for users of the product. Some users like this feature. If you don't, just use another product.

Not everything needs to be a philosophical debate.

Post reply on HN