Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook, WhatsApp Will Have to Share Messages With U.K.?

bloomberg.com

Post reply on HN
Print view View original

201–210 of 591 posts

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#201

Post by albertgoeswoof »

fsloth wrote: post #176
A4ET8a8uTh0 wrote: post #164

I am weirdly.. giddy about this development. The more goverments try so hard to publicly force companies to, effectively, mandate backdoors, the more public will be aware of it. Added benefit is that FB will lose some market share. The sucky part is.. my mom loves Whatsapp. She was able to use it wo any issues. There are few alternatives that she was able to use so easily. All that said, I wonder. What is the breakin…

Unless your mom is planning to involve herself in illegal activities I don't see a problem. Most electronic communication channels are compromised anyway. If you don't want eavesdroppers, don't use electronics.

I guess the government will only ever use their powers for good, and those powers will never fall into the wrong hands?

I suppose the definition of illegal activity is also fixed and social norms will not change over time?

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#202

Post by e12e »

jchw wrote: post #198

Does anyone have any advice for what platform might be best to migrate to? I'm not overly concerned with group E2E, but it is a nice-to-have. Telegram and Discord seem like two of the most practical options, Keybase and Matrix seem like two of the most ideal from a security standpoint. I wonder what offers the best cross-section of features and user experience.

Matrix or Signal?

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#203

Post by TheRealPomax »

antpls wrote: post #65
brenden2 wrote: post #43

If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Platforms that rely on trust (in this case, trusting that FB isn't doing bad things) provide very weak guarantees about privacy/security. They could easily include a keylogger in WhatsApp and bypass the e2e encryption, fo…

Wouldn't someone from inside the Facebook/Whatsapp team denounce it if that was the case? Like a whistle blower

That's just passing the buck: instead of relying on the goodwill of government employees, you're now relying on the goodwill of Facebook employees. That's still "relying on goodwill" levels of security.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#204

Post by adrianmonk »

zzzcpan wrote: post #53
nextos wrote: post #26

Earlier quoted context omitted.

I wonder what happens with Signal as it's US-based.

Signal may or may not be ok at the moment, but not in a couple of years (it has all the power to silently push an update with a backdoor). Among all the popular messaging apps only Telegram is in a position to not cooperate with five eyes.

I'm not sure if I completely agree with the silently part. Doesn't Signal have reproducible builds? In theory, any binary they release can be checked to see if it corresponds to source code.

Whether anyone is actually doing that is another question. And there is no technical reason app stores couldn't send a special backdoor-ed build to select list of users under surveillance if government forced them to. (They can target sets of users for staged roll-outs, beta programs, etc.) Which defeats the notion that one person watching can detect it for everybody.

On the other hand, it's possible to do stuff with smart phones at the platform level. Whether through vulnerabilities or some platform capability (updates, etc.), it may be possible to have a backdoor-ed binary that looks to the user like it is the regular binary. That's not a capability that Signal has, but it is a capability that might very well exist.

Regardless of all that, for users who have auto-updates enabled (most users), even if Signal can't silently push a backdoor-ed update, they can unilaterally push one. You could wake up tomorrow with a different version that has a backdoor, so even if you can identify backdoor-ed binaries, you have to turn off updates or verify the binary every time you open the app.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#205

Post by feanaro »

OrgNet wrote: post #184
nairboon wrote: post #172

So to which messenger should we finally switch to? Telegram, Signal, Threema, Wire or some other newcomer?

matrix seems pretty good, but it is still young and buggy (at least with the the client that I use, riot.im)

For some contrast, I find Riot (web and desktop) quite nice and usable these days. There are still a few rough edges, but it's good enough as a "daily driver" for me.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#206

Post by UncleMeat »

brenden2 wrote: post #43

If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Platforms that rely on trust (in this case, trusting that FB isn't doing bad things) provide very weak guarantees about privacy/security. They could easily include a keylogger in WhatsApp and bypass the e2e encryption, fo…

Bull. You still get an apk, which is easy to decompile and investigate. People absolutely can (and have) audited the WhatsApp code.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#207

Post by feanaro »

brenden2 wrote: post #43

If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Platforms that rely on trust (in this case, trusting that FB isn't doing bad things) provide very weak guarantees about privacy/security. They could easily include a keylogger in WhatsApp and bypass the e2e encryption, fo…

> If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise.

It's still nice to see this spelled out since I've seen many people claim that WhatsApp being closed source is not that problematic. This is definitive confirmation that it cannot be trusted anymore and it's time to start working on the problem (both from a legislative point and by seeking out and moving to technological alternatives).

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#208

Post by likpok »

ComputerGuru wrote: post #51
Barrin92 wrote: post #41

from whatsapps official homepage, respectively ( https://faq.whatsapp.com/en/android/28030015 , https://faq.whatsapp.com/en/general/26000050 ) >WhatsApp has no ability to see the content of messages or listen to calls on WhatsApp. That’s because the encryption and decryption of messages sent on WhatsApp occurs entirely on your device. Before a message ever leaves your device, it's secured with a cryptographic lock, a…

I’m much more interested in the wording of “in the ordinary course,” which I don’t think is just a quirk of the language and I believe it is an indication that certain differing measures can take place after being compelled to provide information.

The case law references records kept “in the ordinary course of business”. Such records are admissible, other records are not (being hearsay).

https://en.m.wikipedia.org/wiki/Business_records_exception

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#209

Post by UncleMeat »

brenden2 wrote: post #171
twoelfer wrote: post #155

Earlier quoted context omitted.

No ordinary person is capable of building anything from source.

I used to use Gentoo, and I built my entire OS from source. I'm not extraordinary in any way, I'm just an ordinary person who has a deep interest in software and computers.

I'd wager that fewer than 1/100,000 humans on the planet could feasibly build Gentoo from source.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#210

Post by [deleted] »

brenden2 wrote: post #43

If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Platforms that rely on trust (in this case, trusting that FB isn't doing bad things) provide very weak guarantees about privacy/security. They could easily include a keylogger in WhatsApp and bypass the e2e encryption, fo…

[deleted]
Post reply on HN