Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Looking Back at the Snowden Revelations

blog.cryptographyengineering.com

Post reply on HN
Print view View original

61–70 of 244 posts

Re: Looking Back at the Snowden Revelations

#61

Post by epmaybe »

inanutshellus wrote: post #60

Naive question: This cryptography blog seems to, but... is WhatsApp really trusted as secure end-to-end encryption chat client? Colloquially, for one thing it's now owned by one of the biggest personal-data collection companies in the world, which would have little interest in owning a chat client it couldn't benefit from data-wise. For another, I read an article mentioning it was "known" that WhatsApp decrypted your…

While I don't know much about how secure the messages are in WhatsApp, it's easy to imagine other ways Facebook could harvest data from users. They could track what you tap on in the screen, or how much you scroll, or what buttons you click on. They could still use that information to serve ads effectively in the future.

Like, how many people click on forwarded messages or pictures.

Re: Looking Back at the Snowden Revelations

#62

Post by freddie_mercury »

fit2rule wrote: post #52
freddie_mercury wrote: post #10

Earlier quoted context omitted.

No, it isn't plainly treason. This is the definition of treason: Treason against the United States, shall consist only in levying War against them, or in adhering to their Enemies, giving them Aid and Comfort. No Person shall be convicted of Treason unless on the Testimony of two Witnesses to the same overt Act, or on Confession in open Court. Did the NSA levy war against the US? Did the NSA give aid & comfort to the…

>Did the NSA give aid & comfort to the enemies of the US? The US suffered a cyberattack that was only possible due to NSA's subversion of Juniper Systems. This could well and truly be considered 'giving aid / comfort to enemies of the USA' ..

That could not "well and truly" be considered that. There is a very clear legal definition of what "enemies of the US" means: countries that the Congress of the United States has declared war on.

I don't know why people are so hung up on trying to come up with bizarre explanations for why "treason" must be the right word here. It isn't and the explanations aren't even especially arcane. Just pick a different word already.

Re: Looking Back at the Snowden Revelations

#64

Post by soraminazuki »

cremp wrote: post #49
jasonvorhe wrote: post #42

Earlier quoted context omitted.

Let's Encrypt brought TLS to the masses, browsers are bringing focus to sites still not using transport encryption, https is a signal for Google ranking. Don't be so defeatist.

That's non-targeted attacks. Nothing stops the targeted attacks. Sure, they might not be able to listen in on those https connections, but if they wanted to attack/listen to this Joe Smith over here, they are more than capable, and still do it.

The problem with mass surveillance is that it's indiscriminate, not that it's targeted.

Re: Looking Back at the Snowden Revelations

#65

Post by anilgulecha »

inanutshellus wrote: post #60

Naive question: This cryptography blog seems to, but... is WhatsApp really trusted as secure end-to-end encryption chat client? Colloquially, for one thing it's now owned by one of the biggest personal-data collection companies in the world, which would have little interest in owning a chat client it couldn't benefit from data-wise. For another, I read an article mentioning it was "known" that WhatsApp decrypted your…

Given that it was built by a highly trusted cryptography team, plus the fact that the protocol can be reverse engineered to confirm encryption and decryption on device, and that over-the-wire traffic has no plaintext, the trust in this is indeed very high.

WA has a lot to lose, and big enough target on it for a backdoor to have been found, if E2E is false.

Re: Looking Back at the Snowden Revelations

#66

Post by gamegod »

BlueTemplar wrote: post #41

Oh yeah : - Before Snowden, if you spoke about these issues, you were dismissed as paranoid. - After Snowden, if you dismiss these issues, you are dismissed as hopelessly naive... Oh, also - considering all this - you can bet that Intel's Management Engine has likely been backdoored by the NSA, so using Intel's processors is not recommended, especially if you're a non-US company... (industrial espionage !) https://bl…

Yeah, we'll just go ahead and use x86 processors from AMD, another US company, which are surely not backdoored...

Re: Looking Back at the Snowden Revelations

#67

Post by lucozade »

inanutshellus wrote: post #60

Naive question: This cryptography blog seems to, but... is WhatsApp really trusted as secure end-to-end encryption chat client? Colloquially, for one thing it's now owned by one of the biggest personal-data collection companies in the world, which would have little interest in owning a chat client it couldn't benefit from data-wise. For another, I read an article mentioning it was "known" that WhatsApp decrypted your…

It is highly unlikely that Facebook can read WhatsApp messages. The reason I say that is that Zuckerberg said the couldn't, repeatedly and explicitly, to Congress. If there was any chance that they could, he would have either not said anything (the context would have allowed for that) or he would have dissembled. As he did numerous other times on other subjects.

As to benefiting from WhatsApp, I'm sure they benefited just fine. They bought it for the contact info from millions of non-Facebook customers that they could use to cross sell. Their growth in, for example, LatAm seems to imply that it worked ok.

Re: Looking Back at the Snowden Revelations

#68

Post by _visgean »

9dl wrote: post #37
codeulike wrote: post #20

This is a good article. Everyone has forgotten how much has changed since Snowden.

Actually, nothing changed Some Laws was created. Some revelations was made. But even manipulations with elections did not kill any company

did you actually read the article?

Re: Looking Back at the Snowden Revelations

#69

Post by ncmncm »

lucozade wrote: post #67
inanutshellus wrote: post #60

Naive question: This cryptography blog seems to, but... is WhatsApp really trusted as secure end-to-end encryption chat client? Colloquially, for one thing it's now owned by one of the biggest personal-data collection companies in the world, which would have little interest in owning a chat client it couldn't benefit from data-wise. For another, I read an article mentioning it was "known" that WhatsApp decrypted your…

It is highly unlikely that Facebook can read WhatsApp messages. The reason I say that is that Zuckerberg said the couldn't, repeatedly and explicitly, to Congress. If there was any chance that they could, he would have either not said anything (the context would have allowed for that) or he would have dissembled. As he did numerous other times on other subjects. As to benefiting from WhatsApp, I'm sure they benefited…

Does not suggest, in any way, that nobody else can read all WhatsApp traffic, only that explicitly-Facebook employees can't.

It would be pre-2013 naive to imagine that, now that WhatsApp traffic is no longer end-to-end encrypted, no use is being made of the change.

Re: Looking Back at the Snowden Revelations

#70

Post by pingyong »

BlueTemplar wrote: post #41

Oh yeah : - Before Snowden, if you spoke about these issues, you were dismissed as paranoid. - After Snowden, if you dismiss these issues, you are dismissed as hopelessly naive... Oh, also - considering all this - you can bet that Intel's Management Engine has likely been backdoored by the NSA, so using Intel's processors is not recommended, especially if you're a non-US company... (industrial espionage !) https://bl…

>https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf

The author dismisses CPU-level backdoors in favor of Intel ME backdoors mainly on the basis that, since CPUs can't save state, they can't protect themselves against replay-"attacks", and hence Intel would lose any sort of plausible deniability once an "activation sequence" was ever found in the wild.

But I don't really see how ME is protected against replay-"attacks" either. Sure, you might not be able to replay the sequence to the same CPU, but you can definitely replay it to a different CPU - unless every single CPU out there has a different activation sequence, which is possible, but would be vastly less efficient (if you want to hack someone you now have to know / guess some sort of unique production ID of the CPUs he's using?).

I'm really not seeing the big argument in favor of an ME backdoor here. A backdoor directly in the CPU would work just as well.

Arguably better in fact, since the CPU can just look for the activation sequence in the data it reads (if you send an e-mail or website it's very likely the plaintext string gets copied, and therefore read, by the CPU at some point), whereas the ME processor would only be able to watch specific offsets in memory.

Post reply on HN