331–340 of 437 posts
Earlier quoted context omitted.
There's "no way in principle"? How is this whole story not evidence to the contrary? The person who found this didn't use WhatsApp source code. Why do you feel that there's no way to verify closed-source software?
> Why do you feel that there's no way to verify closed-source software? Isn't that the very definition of security through obscurity?
There seems to be a pretty clear war going on between engineers and journalists lately. - Chris Latter [1] vs Business Insider [2] - Elon Musk vs (Bunch of outlets) - Moxie vs The Guardian I feel like journalists want to write a compelling story and engineers are on the other side like "No, those aren't facts!" I don't follow a lot of media outlets but it seems like journalists either lack the skills or don't care ab…
I don't know what happened here, but ... Let's avoid our own bias of automatically believing the engineers are in the right; they are fallible people, no more or less honest or prone to error than journalists. Every news story that breaks, involving any person or industry, gets the same response: It's false, they didn't ask us, etc. etc. Therefore, that response is not an indication that something is wrong (or right)…
As people perhaps, but there's a big difference in how prone to error someone is when speaking within their area of expertise than when speaking outside of that area.
The problem with most journalists is that they're required to write on many different subjects, write for an audience whose only exposure to the subject will be a few thousand word article, and write all of this on a deadline that is sometimes just a few hours or days. You can't really understand a subject under those constraints, and it's inevitable that misconceptions will creep in.
That such security agencies have the power to force WhatsApp (or anyone) to comply with their demands is without doubt. A really secure system for activists would be one that makes it impossible even for the provider to read your messages, under any circumstances. WhatsApp is not just not that, it is also ridiculously easy for them to read your messages, if they so choose and you use it at your own risk.
Earlier quoted context omitted.
> The notification that you see in WhatsApp, Signal, SSH, PGP, or whatever is the defense. That defense, which happens to be the only defense, is turned off by default in WhatsApp. You seem to argue they do so because it's bad UX to present such notification by default. That's - in my humble opinion - like suggesting browsers should turn off TLS chain errors by default because it's bad UX and just proceed with the co…
> That defense, which happens to be the only defense, is turned off by default in WhatsApp. > You seem to argue they do so because it's bad UX to present such notification by default. That's - in my humble opinion - like suggesting browsers should turn off TLS chain errors by default because it's bad UX and just proceed with the connection as if nothing happened... One thing we've learned over the years is that secur…
Warning fatigue, "most" users not knowing how to do it or doing it wrong etc, are indeed hard problems to solve. There are indeed no easy answers to this, or else somebody would have come up with something already. But just because it's not easy does not mean you're entitled to just lie about the security properties of your system to your users.
>WhatsApp's end-to-end encryption ensures only you and the person you're communicating with can read what is sent, and nobody in between, not even WhatsApp. [...] All of this happens automatically: no need to turn on settings or set up special secret chats to secure your messages.
https://www.whatsapp.com/faq/en/general/28030015
Given that the only defense against a WhatApp MITM is turned off by default, the "not even WhatApp"/"automatically: no need to turn on settings" part is just not true.
Earlier quoted context omitted.
This seems to be the same angle played every time the analysis of crypto tools comes up on HN. (Almost always) when someone mentions the 'impossibility of analysis' of closed-source programs they are actually referring to the difficulty in doing so -- not actually stating that it's impossible. It is easier to look through source code. Now, if we're progressing through this conversation according to script, it will be…
I'm sorry, but if you look upthread, the comment I responded to not only didn't say that verifying open source was easier , but actually made the extreme claim that there was in principle no way to verify closed source software at all. Meanwhile, addressing your (different) argument directly: sure, reading C code is easier than reading assembly code, and reading Python is easier than reading C. The easier it is to re…
No, you are oversimplifying the problem a lot.
In an Open Source project it is possible to create transparency in the development process by every commit public and allowing 3rd parties to mirror the sources repositories as well as perform reproducible builds, sign the artifacts and so on.
Once a project has been reviewed, it becomes pretty difficult to sneak in a backdoor later or deliver a backdoored build only to some specific targets.
In case of closed source smartphone applications it's very Hard to reverse engineer every single release simply because it takes a staggering amount of work.
It's also Hard to verify that some unsuspecting users are receiving a "custom" apk and block the update automatically.
'Given the size and scope of WhatsApp's user base, we feel that their choice to display a non-blocking notification is appropriate. It provides transparent and cryptographically guaranteed confidence in the privacy of a user's communication, along with a simple user experience. The choice to make these notifications "blocking" would in some ways make things worse. That would leak information to the server about who h…
You quoted the answer to that already. If these change notices are "blocking", then the sending device won't re-send the message until the user has verified it. If the user hasn't enabled the notification, then the sending device will re-send immediately. This makes it trivial for the server to figure out who's actually enabled the notifications and who hasn't, which means the server can be confident about when it's…
I think all this is by-the-by. The gist of The Guardian's article was that WhatsApp has full control of when, if and how your messages are encrypted, and if you're a dissident working against an oppressive regime and you use WhatsApp to collaborate with your allies, your ass is grass, because there isn't anything physically preventing security agencies from getting hold of your communications. That such security agen…
They are a US company and they control what version of the app is in the play/apple store. They could be force to push a version of a flaw and no one could verify it. The source looks good but the app that has been distributed is not.
I think all this is by-the-by. The gist of The Guardian's article was that WhatsApp has full control of when, if and how your messages are encrypted, and if you're a dissident working against an oppressive regime and you use WhatsApp to collaborate with your allies, your ass is grass, because there isn't anything physically preventing security agencies from getting hold of your communications. That such security agen…
Isn't Signal in the same boat? They are a US company and they control what version of the app is in the play/apple store. They could be force to push a version of a flaw and no one could verify it. The source looks good but the app that has been distributed is not.
Are play services required for signal? If so, can I even install signal on a cyanogenmod phone? Can you do so by rebuilding it yourself? Does the build match the shipped binary on the play store?
To me, Signal does look exactly in the same boat as whatsapp. The fact that WhisperSystems didn't cooperate harder to ship Signal in F-Droid is also a major let-down.
Is any other app sharing the same protocol?
Earlier quoted context omitted.
Isn't Signal in the same boat? They are a US company and they control what version of the app is in the play/apple store. They could be force to push a version of a flaw and no one could verify it. The source looks good but the app that has been distributed is not.
I was actually perplexed, after reading about signal, that I couldn't just download an APK. Are play services required for signal? If so, can I even install signal on a cyanogenmod phone? Can you do so by rebuilding it yourself? Does the build match the shipped binary on the play store? To me, Signal does look exactly in the same boat as whatsapp. The fact that WhisperSystems didn't cooperate harder to ship Signal in…