Can't we just call it TLS? Every time I read "end-to-end encryption" I'm afraid they just invented some weird security mechanism. Plus it's 3 chars.
It's not TLS.
Ugh. Should we be scared then?
Viber adds end-to-end encryption
71–80 of 114 posts
Re: Viber adds end-to-end encryption
#72Earlier quoted context omitted.
I think you are misunderstanding jeena. If ejabberd were AGPL, then a fork/a instance of it like Whatsapp would be legally obliged to open up their code as well. No idea whether the assumption is true that Whatsapp is just a branded deployment.
I still don't understand how opening up the codebase would prevent them from being successful. As the countless messaging apps out there demonstrate, the value of communication apps lies in the network they build. If they provide a decent UX, and successfully bootstrap a network large enough, it wont matter if their code is open.
I don't think that was an argument against that. At least I agree. The situation is only possible because the AGPL is not used for the free component, but Whatsapp should have no problem opening up their code.
Re: Viber adds end-to-end encryption
#73Earlier quoted context omitted.
The comparison to Amazon is about the remotely deleting part, not the why part. I have a problem with anything on my device being deleted without my consent.
I think this is a valuable feature for users of the product. Some users like this feature. If you don't, just use another product. Not everything needs to be a philosophical debate.
I don't think the feature is well known. What percent of Viber users could tell you that messages can be deleted without their consent?
Re: Viber adds end-to-end encryption
#74So basically now Telegram is the only app not doing it by default?
Add skype and hangouts to your list...
Re: Viber adds end-to-end encryption
#75Earlier quoted context omitted.
WhatsApp's "E2E" code is from Signal, which is open source. This zealous belief that all secure cryptography must be open source is something I hear a lot from open source advocates, but not so much from cryptography engineers.
Is the encryption/decryption code in WhatsApp open-source? I haven't been able to find it. My assumption was that they conform to the Signal encryption protocol, which is openly specified, but that the code they use to do so is not open-source.
Yes, it is. It's linked directly from the paper (https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...) that documents their use of the protocol.
It's the exact same code we use in Signal: https://github.com/whispersystems/libsignal-protocol-java
Re: Viber adds end-to-end encryption
#76End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.
> which declined to allow their E2E code to be audited.
Could you cite this? The Signal Protocol implementations they're using are both open source and well audited.
Re: Viber adds end-to-end encryption
#77End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.
> Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed. Ricochet ( https://ricochet.im/ ) solves that problem using Tor hidden services. Desktop only at the moment AFAIK, though.
One great benefit to ricochet is that you can choose to exclude those with whom you are communicating from your COMSEC threat model, due to the lack of (mostly connection) metadata availability.
Re: Viber adds end-to-end encryption
#78End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.
WhatsApp's "E2E" code is from Signal, which is open source. This zealous belief that all secure cryptography must be open source is something I hear a lot from open source advocates, but not so much from cryptography engineers.
The value is not just the public display of the source code for auditing, but the validation that what you are running was indeed compiled from that code.
Re: Viber adds end-to-end encryption
#79Earlier quoted context omitted.
> Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed. Ricochet ( https://ricochet.im/ ) solves that problem using Tor hidden services. Desktop only at the moment AFAIK, though.
One great benefit to ricochet is that you can choose to exclude those with whom you are communicating from your COMSEC threat model, due to the lack of (mostly connection) metadata availability.
Sounds interesting.
Appears to have a lot of docs/code, are you able to link to the related code & docs?
Re: Viber adds end-to-end encryption
#80>The enhanced delete feature, meanwhile, has been in the app for a while, but is part of the company’s is a way for users to wipe a conversation not just on their end, but on that of the recipient’s phone. You can think of this as Viber’s answer to ephemeral messaging, but with a more manual approach. Does anyone else think this is a violation of users' rights? If I've been sent a message, it shouldn't be possible fo…
> Does anyone else think this is a violation of users' rights?
Not at all, and it's kind of strange to me that you do. It's just... how the app works. Slack lets you do it, for example, and I've used it occasionally. Heck, reddit (and I think HN?) let you delete comments, even if they were previously, uh, transmitted to a reader's browser.
The Gmail example is irrelevant because that's not how email works. If a new company / protocol came about which wanted to try their hand at a different way of sending online letters, that let you delete them later then I'd have no problem with that. I might not use the service, but there's no foul play or anything.