Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Tell Us a Secret

nytimes.com

Post reply on HN
Print view View original

101–110 of 120 posts

Re: How to Tell Us a Secret

#101

Post by zeckalpha »

briandear wrote: post #94
CiPHPerCoder wrote: post #49

Earlier quoted context omitted.

> This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. WhatsApp messages are encrypted end-to-end between each person using it. The whole point of end-to-end encryption is not having to trust the server-side storage . Furthermore, WhatsApp uses the Signal Protocol-- the state-of-the-art for secure messaging protocols. The worst that WhatsApp ca…

So why not just use Signal? Why even remotely trust Facebook?

Or Keybase? Signal has similar weaknesses as WhatsApp

Re: How to Tell Us a Secret

#102

Post by sfifs »

CiPHPerCoder wrote: post #49
myth_buster wrote: post #9

WhatsApp, with more than 1.2 billion active users, is one of the easiest ways to send secure information. “With WhatsApp, it’s as simple as sending a text message — but it’s encrypted,” Mr. Dance explained. I'm not a security expert but I think this is not exactly the best practice. This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. Also the…

> This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. WhatsApp messages are encrypted end-to-end between each person using it. The whole point of end-to-end encryption is not having to trust the server-side storage . Furthermore, WhatsApp uses the Signal Protocol-- the state-of-the-art for secure messaging protocols. The worst that WhatsApp ca…

> The worst that WhatsApp can see is "who's talking to who

Not really, given keys are centrally managed, it is fairly straightforward for WhatsApp to setup MITM intercept.

In fact they don't even need to push a malicious client etc, they just need to push a different public key than the sender/receiver's actual ones when contacts mutually add each other and this will quite simply allow MITM interception unless the people do key verification in person. If what the whistle blower is trying to do is stay anonymous - would they physically meet the reporter immediately?

They could even push new keys to existing mutual contacts and get away with it since most people don't display or again verify key change messages.

Lastly, most people turn on message backup in Google drive which is not encrypted - so a warrant or an account hack would suffice.

WhatsApp implementation can protect basically from malicious non state actors. That's a great thing in today's world in itself but be aware of the underlying tech.

Re: How to Tell Us a Secret

#103

Post by forapurpose »

plgonzalezrx8 wrote: post #2

Does anyone else think that Anonymous tips can sometimes be a two-edged blade if claims are not properly backed up with facts? Sometimes we see a lot of news articles and news regarding X, Y, Z topic from anonymous sources, being passed as legit news and reliable, but when you examine the news in more details, nothing that backs up such claims can be found. How can this be addressed in a way that doesn't expose those…

From the NY Times instructions on their tips page:

https://www.nytimes.com/tips

What Makes a Good Tip?

A strong news tip will have several components. Documentation or evidence is essential. Speculating or having a hunch does not rise to the level of a tip.

Re: How to Tell Us a Secret

#104

Post by shshhdhs »

Operyl wrote: post #92
TheSpiceIsLife wrote: post #89

Earlier quoted context omitted.

> given that they don't push a malicious client at some point How do we know this hasn't happened already? How do we know it won't happen tomorrow?

Because there are a number of people constantly reverse engineering these clients to be sure that it doesn’t.

This doesn’t really help as much as you seem to hope for. As a counterpoint, I would like to introduce you to the Underhanded competitions:

http://www.underhanded-c.org

https://underhandedcrypto.com

Re: How to Tell Us a Secret

#105

Post by forapurpose »

YinglingLight wrote: post #36
rock_hard wrote: post #11

Earlier quoted context omitted.

I have not found this to be true. There is tons of NYT articles that are factually wrong and have never been updated.

Absolutely. What happened to investigative journalism? Shoutouts to https://www.realclearinvestigations.com/ Cut through layers of agenda pushers and give me facts.

Why doesn't the source you cite also have agendas? IME, those who attack everyone else as having an agenda and present themselves as the antidote - that act is propaganda in itself and they the most prone to it.

Re: How to Tell Us a Secret

#106

Post by forapurpose »

jhayward wrote: post #71
tertius wrote: post #16

Earlier quoted context omitted.

So you're saying that no journalist would accept a tip from someone who will not identify themselves?

A tip is just an investigative lead. "Hooker Chemical is dumping massive amounts of toxic waste at Love Canal" would be a tip. It would then be up to an investigative reporter to investigate, and report what the investigation uncovers. You may be thinking of "unnamed sources" or "anonymous sources". Those people may be quoted on a factual basis, but the reporter has an obligation to obtain the same kind of confirmati…

> A tip is just an investigative lead. "Hooker Chemical is dumping massive amounts of toxic waste at Love Canal" would be a tip.

Actually, that's not a tip by the NY Times definition:

A strong news tip will have several components. Documentation or evidence is essential. Speculating or having a hunch does not rise to the level of a tip.

https://www.nytimes.com/tips

Re: How to Tell Us a Secret

#107

Post by forapurpose »

qubax wrote: post #95
EduardoBautista wrote: post #83

Earlier quoted context omitted.

Seeing how "fake news" spread through social media, I have the complete opposite belief as you.

Sure, social media isn't perfect. But lots of real news spread through social media too. Real news like the weinstein story that the nytimes squashed. That's the difference between social media and the nytimes. You can't silence truth on social media. You could spread lies, but you can't silence truth. Whereas news companies can silence truth and spread lies. Also, news companies aren't immune to "fake news". The new…

> But lots of real news spread through social media too. Real news like the weinstein story that the nytimes squashed.

The Weinstein story was researched heavily by reporters for (years?) and published by the New Yorker and the New York Times, for which they jointly won the Pulitzer Prize.

Re: How to Tell Us a Secret

#108

Post by boomboomsubban »

qubax wrote: post #95
EduardoBautista wrote: post #83

Earlier quoted context omitted.

Seeing how "fake news" spread through social media, I have the complete opposite belief as you.

Sure, social media isn't perfect. But lots of real news spread through social media too. Real news like the weinstein story that the nytimes squashed. That's the difference between social media and the nytimes. You can't silence truth on social media. You could spread lies, but you can't silence truth. Whereas news companies can silence truth and spread lies. Also, news companies aren't immune to "fake news". The new…

>You can't silence truth on social media. You could spread lies, but you can't silence truth. Whereas news companies can silence truth and spread lies.

News outlets never had the ability to silence truth, just limit how easily it could spread. You could still self publish your truth or tell everyone you know, the same thing social media allows.

>If you really cared about fake news, then you should be more worried about the news companies than social media. It's odd you are not

Media companies are perfectly capable of using social media to spread their propaganda. It's likely easier, as it allows them to craft separate versions that appeal to different people.

Re: How to Tell Us a Secret

#109

Post by reitanqild »

TheSpiceIsLife wrote: post #89
reitanqild wrote: post #72

Earlier quoted context omitted.

I avoid WhatsApp but this is correct AFAIK (given that they don't push a malicious client at some point.) The main problems with WhatsApp are as I can see: - they scoop up metadata - they upload the data more or less plaintext to Google for backup. (I personally dislike but trust Google but not everyone trusts them.) - they paid way to much for it to not try to monetize it in all kinds of crazy ways

> given that they don't push a malicious client at some point How do we know this hasn't happened already? How do we know it won't happen tomorrow?

> How do we know this hasn't happened already?

As has been pointed out here in the chat already: Scott (and others) have reverse engineered it.

> How do we know it won't happen tomorrow?

Consequences.

Even Facebook seems to realize that is the nuclear option.

That said there is a number of places this can still go wrong, but they are equally true for any mainstream client (edit:) and non mainstream clients have their own issues.

Personally neither like nor trust Facebook at all so I try to minimize contact.

Re: How to Tell Us a Secret

#110

Post by [deleted] »

myth_buster wrote: post #9

WhatsApp, with more than 1.2 billion active users, is one of the easiest ways to send secure information. “With WhatsApp, it’s as simple as sending a text message — but it’s encrypted,” Mr. Dance explained. I'm not a security expert but I think this is not exactly the best practice. This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. Also the…

[deleted]
Post reply on HN