Facebook, WhatsApp Will Have to Share Messages With U.K.? • Hacker News Board

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#191

Post by cameronbrown » Sat, Sep 28, 2019, 4:54 PM UTC

dessant wrote: post #118

brenden2 wrote: post #104

Earlier quoted context omitted.

If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everyt…

> If I can compile the code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors Where does that leave the rest of society? Having open source software and hardware is not enough, we also need laws that prohibit mass surveillance and support our efforts to uphold human rights.

Sadly it means the rest of society being under surveillance and actual criminals with day-to-day privacy.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#192

Post by grawprog » Sat, Sep 28, 2019, 4:55 PM UTC

brenden2 wrote: post #104

deogeo wrote: post #92

Earlier quoted context omitted.

> If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Careful - you're right that WhatsApp is untrustworthy, but laws that force them to add backdoors could well be applied to open-source code as well. Or make possession of non-backdoored software, open or not, illegal. Or…

If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everyt…

>If I can compile the code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software).

Not necessarily. Have you ever heard of Ken Thompson's backdoored C compiler?

https://softwareengineering.stackexchange.com/questions/1848...

>Re-write compiler code to contain 2 flaws:

>When compiling its own binary, the compiler must compile these flaws

>When compiling some other preselected code (login function) it must compile some arbitrary backdoor

>Thus, the compiler works normally - when it compiles a login script or similar, it can create a security backdoor, and when it compiles newer versions of itself in the future, it retains the previous flaws - and the flaws will only exist in the compiler binary so are extremely difficult to detect.

It's not necessarily a viable attack method today, but it's the lesson behind it that's important. Anything can be compromised.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#193

Post by anigbrowl » Sat, Sep 28, 2019, 4:55 PM UTC

hannasanarion wrote: post #181

classified wrote: post #144

Earlier quoted context omitted.

If people in a position of power can break those laws with impunity then new laws aren't going to change that. The problem is holding the lawbreakers accountable.

Not if the lawbreaking is enabled by a loophole, as in this case. Closing the loophole may not be enough, but it should be the first priority.

It's important but you need to consider the situation where the government is corrupt. The Us is about to impeach the President; and the two factions in government are each accusing the other of corruption, albeit using wildly different criteria.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#194

Post by jedberg » Sat, Sep 28, 2019, 4:56 PM UTC

brenden2 wrote: post #43

If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Platforms that rely on trust (in this case, trusting that FB isn't doing bad things) provide very weak guarantees about privacy/security. They could easily include a keylogger in WhatsApp and bypass the e2e encryption, fo…

>What lawmakers do or don't say is just noise.

Back in the day, it was illegal to export "good" encryption. There was nothing stopping it from happening technically, just like there is nothing stopping you from stealing from a convince store, except for the threat of enforcement.

But the threat of enforcement can have a strong chilling effect.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#195

Post by Filligree » Sat, Sep 28, 2019, 4:57 PM UTC

brenden2 wrote: post #171

twoelfer wrote: post #155

Earlier quoted context omitted.

No ordinary person is capable of building anything from source.

I used to use Gentoo, and I built my entire OS from source. I'm not extraordinary in any way, I'm just an ordinary person who has a deep interest in software and computers.

Which is, in itself, extraordinary. It can't be the solution for most of humanity.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#196

Post by IshKebab » Sat, Sep 28, 2019, 4:57 PM UTC

squarefoot wrote: post #68

smudgymcscmudge wrote: post #44

Earlier quoted context omitted.

Did you notice the article doesn't say anything about decrypting the messages? It just says they have to turn over encrypted messages.

The question should be why on Earth would they ask access to encrypted messages if they couldn't already decrypt them, or be able to do that soon.

They're after the metadata. Who contacted who, and how often.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#197

Post by jedberg » Sat, Sep 28, 2019, 4:58 PM UTC

fsloth wrote: post #176

A4ET8a8uTh0 wrote: post #164

I am weirdly.. giddy about this development. The more goverments try so hard to publicly force companies to, effectively, mandate backdoors, the more public will be aware of it. Added benefit is that FB will lose some market share. The sucky part is.. my mom loves Whatsapp. She was able to use it wo any issues. There are few alternatives that she was able to use so easily. All that said, I wonder. What is the breakin…

Unless your mom is planning to involve herself in illegal activities I don't see a problem. Most electronic communication channels are compromised anyway. If you don't want eavesdroppers, don't use electronics.

> Unless your mom is planning to involve herself in illegal activities I don't see a problem.

I assume you'd be happy to post all your credit card receipts and emails for all of us to see then. You're not doing anything illegal, right? That would be the only reason you don't want those things to be visible.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#198

Post by jchw » Sat, Sep 28, 2019, 5:01 PM UTC

Does anyone have any advice for what platform might be best to migrate to? I'm not overly concerned with group E2E, but it is a nice-to-have. Telegram and Discord seem like two of the most practical options, Keybase and Matrix seem like two of the most ideal from a security standpoint. I wonder what offers the best cross-section of features and user experience.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#199

Post by jedberg » Sat, Sep 28, 2019, 5:03 PM UTC

ISL wrote: post #173

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.

I believe the courts have ruled previously that your speech is not limited just because the government has access to it. Otherwise wiretaps would be illegal already. This is just an extension of wiretap law.

In both cases they need to be fought from another angle than freedom of speech, because we've already lost that battle.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#200

Post by TheRealPomax » Sat, Sep 28, 2019, 5:05 PM UTC

jedberg wrote: post #194

brenden2 wrote: post #43

If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Platforms that rely on trust (in this case, trusting that FB isn't doing bad things) provide very weak guarantees about privacy/security. They could easily include a keylogger in WhatsApp and bypass the e2e encryption, fo…

>What lawmakers do or don't say is just noise. Back in the day, it was illegal to export "good" encryption. There was nothing stopping it from happening technically, just like there is nothing stopping you from stealing from a convince store, except for the threat of enforcement. But the threat of enforcement can have a strong chilling effect.

Bad analogy - exporting "good" encryption was illegal and while for individuals that was basically irrelevant, _companies_ would absolute follow that law. The analogy is not between "you stealing from a convenience store", it's "you running a company that has a known practice of robbing convenience stores". It's so incredibly illegal, you're not going to. There is no realistic hypothetical in which that decision would even remotely make sense.