Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook, WhatsApp Will Have to Share Messages With U.K.?

bloomberg.com

Post reply on HN
Print view View original

111–120 of 591 posts

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#111

Post by throwaway826732 »

brenden2 wrote: post #43

If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Platforms that rely on trust (in this case, trusting that FB isn't doing bad things) provide very weak guarantees about privacy/security. They could easily include a keylogger in WhatsApp and bypass the e2e encryption, fo…

> They could easily include a keylogger in WhatsApp and bypass the e2e encryption, for example, and us regular folk have no way of knowing.

This would be quickly detected by anyone looking at the data the WhatsApp app was sending back to the server (this isn't hard to do on a jailbroken device).

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#112

Post by shawnz »

brenden2 wrote: post #104
deogeo wrote: post #92

Earlier quoted context omitted.

> If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Careful - you're right that WhatsApp is untrustworthy, but laws that force them to add backdoors could well be applied to open-source code as well. Or make possession of non-backdoored software, open or not, illegal. Or…

If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everyt…

No, you would also have to audit the entire codebase.

You could also decompile the Whatsapp APK and do the same thing (it's Java after all).

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#113

Post by pjkundert »

brenden2 wrote: post #104
deogeo wrote: post #92

Earlier quoted context omitted.

> If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Careful - you're right that WhatsApp is untrustworthy, but laws that force them to add backdoors could well be applied to open-source code as well. Or make possession of non-backdoored software, open or not, illegal. Or…

If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everyt…

Reflections On Trusting Trust:

https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#114

Post by colejohnson66 »

i_am_proteus wrote: post #10
Nextgrid wrote: post #5

Curious what this means for other end-to-end encrypted services such as iMessage.

I'm equally curious what this means for Signal and any other open-source encrypted services. In the US, ITAR could hypothetically be used to make open-sourcing of cryptographic algorithms illegal. This technique is used for robotics software that could be dual-purposed for weapons guidance.

> In the US, ITAR could hypothetically be used to make open-sourcing of cryptographic algorithms illegal.

Wikipedia has some good info re: export of cryptography[0].

In addition, two circuits (Ninth[1] and Sixth[2]) have ruled that source code is protected by the First Amendment.

[0]: https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

[1]: https://en.wikipedia.org/wiki/Bernstein_v._United_States

[2]: https://en.wikipedia.org/wiki/Junger_v._Daley

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#115

Post by ajconway »

shawnz wrote: post #112
brenden2 wrote: post #104

Earlier quoted context omitted.

If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everyt…

No, you would also have to audit the entire codebase. You could also decompile the Whatsapp APK and do the same thing (it's Java after all).

WhatsApp contains significant amount of native code, making it much more difficult to analyze.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#116

Post by colejohnson66 »

shawnz wrote: post #112
brenden2 wrote: post #104

Earlier quoted context omitted.

If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everyt…

No, you would also have to audit the entire codebase. You could also decompile the Whatsapp APK and do the same thing (it's Java after all).

> No, you would also have to audit the entire codebase

Look no further than the OpenSSL Heartbleed vulnerability

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#117

Post by NeedMoreTea »

noir_lord wrote: post #82
cosmodisk wrote: post #36

There's a funny,rag level newspaper in the UK, called DailyMail. I suggest reading comments under the article about this, gives a good idea of how naive people can be. https://www.dailymail.co.uk/news/article-7514787/Facebook-fo...

Nothing funny about the Daily Mail, it's the mouth piece of the reactionary idiots on the right (there are just as many on the left before I get tagged as a liberal) and has been for a century give or take. This is the newspaper that had an editorial starting with "Hurrah the Blackshirts". https://www.globaljustice.org.uk/blog/2017/oct/31/horrible-h... Other than using it as a way of keeping an eye on what some peopl…

The rest aren't much better.

The Express and Telegraph were right facing, honest but partisan newspapers forty or fifty years ago. Now the Express is a racist comic, and since the famously and comically reclusive Barclay brothers bought it, the Telegraph is working on getting down to the Mail's level. The Mail are currently working on buying the i.

There really isn't much left on the right that you can rely on. Which is depressing considering most of our press is right leaning.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#118

Post by dessant »

brenden2 wrote: post #104
deogeo wrote: post #92

Earlier quoted context omitted.

> If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Careful - you're right that WhatsApp is untrustworthy, but laws that force them to add backdoors could well be applied to open-source code as well. Or make possession of non-backdoored software, open or not, illegal. Or…

If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everyt…

> If I can compile the code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors

Where does that leave the rest of society? Having open source software and hardware is not enough, we also need laws that prohibit mass surveillance and support our efforts to uphold human rights.

Post reply on HN