Facebook, WhatsApp Will Have to Share Messages With U.K.? • Hacker News Board

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#221

Post by anigbrowl » Sat, Sep 28, 2019, 5:21 PM UTC

damnyou wrote: post #188

einpoklum wrote: post #180

In other news: US, UK subjects agree to stop using WhatsApp in favor of Telegram and Signal: https://telegram.org/ https://www.signal.org/ These are free software, not controlled by a giant corporation (although both are limited liability companies; Telegram in London/Dubai, Signal in San Francisco IIANM); with the developer/company not having unencyrpyed access to your data.

Telegram group chats are not e2e encrypted, while Signal is notorious for being unreliable at actually delivering messages. Also, if you change your phone number the official Signal recommendation is to manually tell all your friends about the new number. WhatsApp just lets you do it. I use both apps regularly but neither of them is perfect.

Yeah timely message delivery is a big problem for Signal. It doesn't happen often but when it does the delay can range from minutes to hours. A few years ago my wife and I failed to meet up as arranged and had a big yelling match until we looked at our phones half way through. The delay of some messages and not others led to almost exactly opposite beliefs about the electronic conversation we thought we had been having.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#222

Post by DarkmSparks » Sat, Sep 28, 2019, 5:22 PM UTC

cameronbrown wrote: post #191

dessant wrote: post #118

Earlier quoted context omitted.

> If I can compile the code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors Where does that leave the rest of society? Having open source software and hardware is not enough, we also need laws that prohibit mass surveillance and support our efforts to uphold human rights.

Sadly it means the rest of society being under surveillance and actual criminals with day-to-day privacy.

And been that way since the days slavery was politically correct rather than having to jump through all the debt slave hoops it has to now.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#223

Post by A4ET8a8uTh0 » Sat, Sep 28, 2019, 5:23 PM UTC

Smithalicious wrote: post #174

A4ET8a8uTh0 wrote: post #164

I am weirdly.. giddy about this development. The more goverments try so hard to publicly force companies to, effectively, mandate backdoors, the more public will be aware of it. Added benefit is that FB will lose some market share. The sucky part is.. my mom loves Whatsapp. She was able to use it wo any issues. There are few alternatives that she was able to use so easily. All that said, I wonder. What is the breakin…

You are assuming that the public isn't aware of it and would care if they were. I think the public is aware of it, they just don't care.

I wish I could say you are wrong. I definitely saw people on both ends, but I can't say with certainty which is more common.

People is US had a joke about wiretaps and a variation of the joke returned.

People change based on stimuli.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#224

Post by dane-pgp » Sat, Sep 28, 2019, 5:23 PM UTC

adrianmonk wrote: post #204

zzzcpan wrote: post #53

Earlier quoted context omitted.

Signal may or may not be ok at the moment, but not in a couple of years (it has all the power to silently push an update with a backdoor). Among all the popular messaging apps only Telegram is in a position to not cooperate with five eyes.

I'm not sure if I completely agree with the silently part. Doesn't Signal have reproducible builds? In theory, any binary they release can be checked to see if it corresponds to source code. Whether anyone is actually doing that is another question. And there is no technical reason app stores couldn't send a special backdoor-ed build to select list of users under surveillance if government forced them to. (They can t…

Assuming for a moment that we can trust our smart phones at the platform level not to lie to us, the problem of targeted backdoored builds could be mitigated somewhat if the platform implemented Binary Transparency in a clever way:

https://wiki.mozilla.org/Security/Binary_Transparency

When you install an app (whether through an app store, or side-loading) the app should state the location online of an append-only log that lists all the releases (with timestamps) for that app. The phone OS could periodically check to see if an upgrade is available, and security researchers could check that the log doesn't contain references to versions which aren't available to the public.

Ideally there should perhaps also be a way for users to anonymously report which version of any app they are using, so that people with particular security concerns could configure their OS to only update an app after, for example, 50% of users have already installed the update.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#225

Post by anigbrowl » Sat, Sep 28, 2019, 5:24 PM UTC

cosmodisk wrote: post #48

rvz wrote: post #27

This is essentially a worrying prospect if these developments are actually implemented or advance further. The users trust in the social media service is breached if a backdoor where to be placed in their products (It also defeats the purpose of the end-to-end encryption argument). If you reside in the UK and especially in London, things have just become 500% more Orwellian. >Priti Patel, the U.K.’s home secretary, h…

I live in London.It has already gone way beyond of what Orwell could have ever imagined. However,despite of all the surveillance, London is the crime capital of the world.This is probably the best place for criminals,as unless you pull a machine gun on a crowd,not much will be investigated.

There's some evidence to suggest that more policing leads to more crime (drops in policing are correlated with a lower # of major crimes). If you're going to be hassled by police anyway, why not go large? Hence the old proverb 'might as well be hung for a sheep as a lamb.'

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#226

Post by lolc » Sat, Sep 28, 2019, 5:24 PM UTC

tempsolution wrote: post #128

brenden2 wrote: post #104

Earlier quoted context omitted.

If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everyt…

Yes of course. The old argument that Linux is free of backdoors because it is open source. It's such a ridiculous claim. Software systems on that scale are so complex, there is NO way whatsoever to make sure there isn't a backdoor in there. I would go as far as saying that OpenSource software by definition is more vulnerable to backdoors than closed source software, exactly because the source code is available and an…

The thing with closed-source is that the binaries can be backdoored by the vendor on behalf of the NSA. This is not a new practice. With open-source code this venue is less likely to work and needs an additional layer of deception. Sure the NSA may manage to plant vulnerabilities, but flaws will not be persistent in the same way as when they're planted in cooperation with a vendor.

There's currently a push for reproducible builds which further hardens distros against such attacks.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#227

Post by hnthrow0693 » Sat, Sep 28, 2019, 5:27 PM UTC

jedberg wrote: post #197

fsloth wrote: post #176

Earlier quoted context omitted.

Unless your mom is planning to involve herself in illegal activities I don't see a problem. Most electronic communication channels are compromised anyway. If you don't want eavesdroppers, don't use electronics.

> Unless your mom is planning to involve herself in illegal activities I don't see a problem. I assume you'd be happy to post all your credit card receipts and emails for all of us to see then. You're not doing anything illegal, right? That would be the only reason you don't want those things to be visible.

What exactly leads you to believe that posting your credit card number on hacker news is somehow equivalent to not being outraged by the U.S. sharing _encrypted_ messages of suspected terrorists with the UK? Let’s not pretend the world is so black and white.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#228

Post by pjkundert » Sat, Sep 28, 2019, 5:28 PM UTC

twoelfer wrote: post #155

brenden2 wrote: post #121

Earlier quoted context omitted.

Yep, it's a super difficult problem. Having the source code available, and being able to validate the builds yourself makes everything a lot easier. It's one of the reasons the Debian project has worked so hard at reproducible builds: https://wiki.debian.org/ReproducibleBuilds/About Bugs can certainly occur (like Heartbleed etc) but the alternative (closed source opaque binary blobs) is much worse.

No ordinary person is capable of building anything from source.

Check out Nix. Deterministic source derivations of pretty much anything you might want to build, trivially re-buildable from source by anyone. It takes seconds to install the "Nix Shell" on pretty much any of the modern OSes.

Now, to avoid the "Reflections On Trusting Trust" exploit, building the C compiler toolchain from known-good "root" compiler/linker toolchains, and then comparing the output vs. self-compilation is quite a bit harder.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#229

Post by smcleod » Sat, Sep 28, 2019, 5:29 PM UTC

damnyou wrote: post #188

einpoklum wrote: post #180

In other news: US, UK subjects agree to stop using WhatsApp in favor of Telegram and Signal: https://telegram.org/ https://www.signal.org/ These are free software, not controlled by a giant corporation (although both are limited liability companies; Telegram in London/Dubai, Signal in San Francisco IIANM); with the developer/company not having unencyrpyed access to your data.

Telegram group chats are not e2e encrypted, while Signal is notorious for being unreliable at actually delivering messages. Also, if you change your phone number the official Signal recommendation is to manually tell all your friends about the new number. WhatsApp just lets you do it. I use both apps regularly but neither of them is perfect.

Out of interest what is your citation for Signal being nutritious or having messages going missing?

Anecdotally speaking, neither I or my friends that have been using Signal for years have every had any messages go missing, so I’m just interested as to why you might be experiencing this.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#230

Post by shrimp_emoji » Sat, Sep 28, 2019, 5:29 PM UTC

GordonS wrote: post #220

The idea that moves like this will "keep us safe" is utterly preposterous; there are a multitude of other ways in which terrorists (or the boogeyman de jour ) could communicate - are the UK and US governments going to insist on backdooring IRC, Slack and face-to-face conversations? Are they going to outlaw encryption libraries? I truely fear for the future that western governments, in particular the 5 eyes members, a…

>moves like this are to keep us safe

From the government's perspective, they are to keep "us" safe. It's easier to do that if no one's safe from us. :)

Granted, that's a little over-ominous because the government's mission statement is to keep its people safe, and it's also elected by its people. Either of these two facts changing is the way bigger danger; backdooring centralized services is stuff that happens in the meantime either way.