How to Tell Us a Secret • Hacker News Board

Re: How to Tell Us a Secret

#51

Post by CiPHPerCoder » Thu, Sep 20, 2018, 6:57 PM UTC

ac4tw wrote: post #43

myth_buster wrote: post #9

WhatsApp, with more than 1.2 billion active users, is one of the easiest ways to send secure information. “With WhatsApp, it’s as simple as sending a text message — but it’s encrypted,” Mr. Dance explained. I'm not a security expert but I think this is not exactly the best practice. This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. Also the…

myth_buster, lisper, & newscracker make interesting points. In researching WhatsApp a while ago, I came across this in a Quora post "But one more point I want to stress here is that, though whatsapp is allowing end to end communication , it does not necessarily mean they can not analyse the encrypted data. in cryptography we call it Searchable Encryption." ( https://www.quora.com/Now-that-WhatsApp-can-no-longer-read-…

You can reverse engineer any Android app in very little time. Professionals use frameworks like Lobotomy, but you can get by with dex2jar and JD-GUI for most of it.

It not being open source is a political argument, not a technical one.

EDIT: I ended up doing just that. It took roughly 5 minutes (most of that was making sure I had my PATH for Java set up correctly on this machine) to get decompiled Java code ready to inspect.

https://pbs.twimg.com/media/DnkFaKxU8AE4mFn.jpg

Re: How to Tell Us a Secret

#52

Post by mdex » Thu, Sep 20, 2018, 7:00 PM UTC

KZeillmann wrote: post #37

qubex wrote: post #5

Earlier quoted context omitted.

Somebody illustrious and learned once said something to the effect that “if somebody tells you it's raining outside, and somebody else tells you the sun is shining, your job as a journalist isn't to report that some people say one thing whereas others say something else, your job as a journalist is to go look out the window and report what the weather is actually doing ”. What we have now is (mostly) talk-shows rough…

If you look at 24 hour cable news, I'm sure that's what you see. It's entertainment passed on as journalism. There's still good journalism going on if you know where to look. The New York Times, the Washington Post, for example, are incredibly informative and useful sources for news.

Neither the NYT or Washington Post questioned the Bush admin and intelligence communities claims about why the USA was going to war with Iraq even though it was public knowledge that the 9/11 attackers were all Saudis and it had nothing to do with 9/11. But the media helped them spin the Iraq war as part of the war on terrorism, even though Iraq was not exporting terrorism to the West, not until after they destabilized the region by taking out Saddam.

Instead, the NYT wrote an article about how dangerous Saddam's WMDs were and how he was supporting terrorism, even though it had nothing to do with 9/11. Nowadays they defend themselves by saying "everyone agreed at the time". It's not true.

Mainstream media is a rubber stamp for corporate and state interests, just propaganda. They rubber stamped Bush's war's just like they rubber stamped Obamas, they will probably rubber stamp Trump's too. Yes, they also contain true information, but they are still just corporate/state propaganda.

If they aren't willing to fact-check the govt for an issue as serious as going to war, especially with all the red-flags that were out there, like the fact that Colin Powell, a year prior to holding up anthrax in congress as "proof" that Iraq had WMDs, was giving speeches a year earlier claiming there was no evidence Saddam was making WMDs. Like the fact the Bush admin certainty about WMD was far greater than the actual intel communities claims. No one fact-checked them.

Re: How to Tell Us a Secret

#53

Post by nostoc » Thu, Sep 20, 2018, 7:00 PM UTC

CiPHPerCoder wrote: post #49

myth_buster wrote: post #9

WhatsApp, with more than 1.2 billion active users, is one of the easiest ways to send secure information. “With WhatsApp, it’s as simple as sending a text message — but it’s encrypted,” Mr. Dance explained. I'm not a security expert but I think this is not exactly the best practice. This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. Also the…

> This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. WhatsApp messages are encrypted end-to-end between each person using it. The whole point of end-to-end encryption is not having to trust the server-side storage . Furthermore, WhatsApp uses the Signal Protocol-- the state-of-the-art for secure messaging protocols. The worst that WhatsApp ca…

> who's talking to who?

That can be a problem when you're a whistle blower contacting a journalist.

Re: How to Tell Us a Secret

#54

Post by CiPHPerCoder » Thu, Sep 20, 2018, 7:03 PM UTC

nostoc wrote: post #53

CiPHPerCoder wrote: post #49

Earlier quoted context omitted.

> This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. WhatsApp messages are encrypted end-to-end between each person using it. The whole point of end-to-end encryption is not having to trust the server-side storage . Furthermore, WhatsApp uses the Signal Protocol-- the state-of-the-art for secure messaging protocols. The worst that WhatsApp ca…

> who's talking to who? That can be a problem when you're a whistle blower contacting a journalist.

Sure, that can be a problem. However, it's completely irrelevant to the problem of server-side storage, as the comment I replied to was citing.

(Server-side storage is a non-issue, due to the encryption protocols in use. It doesn't matter if you distrust Facebook, they aren't going to be able to read your messages. End of.)

Re: How to Tell Us a Secret

#55

Post by sbradford26 » Thu, Sep 20, 2018, 7:05 PM UTC

urda wrote: post #45

grep "gpg" - no results grep "pgp" - no results What in the what. Oh come on, how can you go through all this effort writing how share secrets with them, and there's zero mention of an actual public key?

All of the more detailed information is on a tips page that they link to.

https://www.nytimes.com/tips

Re: How to Tell Us a Secret

#56

Post by countryqt30 » Thu, Sep 20, 2018, 7:07 PM UTC

An IMPROVEMENT SUGGESTION TO NYT: Don't let the mail letterhead say "tips." This either means it's a confidential hint (which shouldn't even be exposed to other people, that makes everyone extremely curious and can easily be catched by FBI, etc.) or it means "tips" as in "money", which is a similarly bad idea to put on a letter.

I'd suggest you just name it something entirely unsuspicious, like "Mailbox 9824" (or whatever your regular format is)

Re: How to Tell Us a Secret

#57

Post by krn » Thu, Sep 20, 2018, 7:08 PM UTC

myth_buster wrote: post #9

WhatsApp, with more than 1.2 billion active users, is one of the easiest ways to send secure information. “With WhatsApp, it’s as simple as sending a text message — but it’s encrypted,” Mr. Dance explained. I'm not a security expert but I think this is not exactly the best practice. This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. Also the…

As far as I'm aware of, Facebook collects and stores all the meta-data WhatsApp generates. Which means, that it can provide a list of phone numbers, IP addresses, or even GPS coordinates(?) of the people who contacted the journalist at any specific time. So, even if the messages are encrypted, a person can still be tracked down.

Re: How to Tell Us a Secret

#58

Post by myth_buster » Thu, Sep 20, 2018, 7:13 PM UTC

CiPHPerCoder wrote: post #49

myth_buster wrote: post #9

WhatsApp, with more than 1.2 billion active users, is one of the easiest ways to send secure information. “With WhatsApp, it’s as simple as sending a text message — but it’s encrypted,” Mr. Dance explained. I'm not a security expert but I think this is not exactly the best practice. This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. Also the…

> This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. WhatsApp messages are encrypted end-to-end between each person using it. The whole point of end-to-end encryption is not having to trust the server-side storage . Furthermore, WhatsApp uses the Signal Protocol-- the state-of-the-art for secure messaging protocols. The worst that WhatsApp ca…

Thanks for clarifying. Even with E2E wouldn't you still want the code to be open source or an independent audit done? As I said, not an expert.

Re: How to Tell Us a Secret

#59

Post by CiPHPerCoder » Thu, Sep 20, 2018, 7:22 PM UTC

myth_buster wrote: post #58

CiPHPerCoder wrote: post #49

Earlier quoted context omitted.

> This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. WhatsApp messages are encrypted end-to-end between each person using it. The whole point of end-to-end encryption is not having to trust the server-side storage . Furthermore, WhatsApp uses the Signal Protocol-- the state-of-the-art for secure messaging protocols. The worst that WhatsApp ca…

Thanks for clarifying. Even with E2E wouldn't you still want the code to be open source or an independent audit done? As I said, not an expert.

I'd want it, sure.

But I could also just dex2jar + JD-GUI the Android app and study the decompiled Java code to see what they're doing.

Edited to add: https://twitter.com/CiPHPerCoder/status/1042870740880637952

Re: How to Tell Us a Secret

#60

Post by urda » Thu, Sep 20, 2018, 7:26 PM UTC

Symbiote wrote: post #50

urda wrote: post #45

grep "gpg" - no results grep "pgp" - no results What in the what. Oh come on, how can you go through all this effort writing how share secrets with them, and there's zero mention of an actual public key?

You need a -i, they have PGP in upper case, with a public key.

Where, It's literally no where on the linked page: https://www.nytimes.com/2018/09/19/reader-center/confidentia...

It's not there.

Edit: I do see the sub-linked page now, easily missed with it just being a hyper link on the phrase "tips page". But as my original comment mentioned, it's not on the article page (directly) at all.

To the user downvoting me: yeah sorry the original comment still stands and is 100% accurate. If you have something meaningful to add to the conversation actually add it.