Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We Chat, They Watch

citizenlab.ca

Post reply on HN
Print view View original

11–20 of 555 posts

Re: We Chat, They Watch

#11

Post by madeofpalk »

Moodles wrote: post #5
bgorman wrote: post #3

Did anyone actually think WeChat communications are secure? Do we have reason to believe iMessage and Whatsapp are more secure?

WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does.

We one downfall of iMessage is that because they facilitate key exchange, Apple can add their own key to your profile and read all your messages.

Though, my limited understanding of iMessage is that if you were to sniff the network traffic you could detect this.

Re: We Chat, They Watch

#12

Post by Moodles »

otachack wrote: post #9
Moodles wrote: post #5

Earlier quoted context omitted.

WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does.

You also have to trust the source code, or trust a recent audit, then also make sure the build you have kept it's integrity and matches the audit build.

The question was: do we have any reason to believe it's more secure than weChat? I say yes but those are all valid points.

Re: We Chat, They Watch

#13

Post by maximente »

xvector wrote: post #4
bgorman wrote: post #3

Did anyone actually think WeChat communications are secure? Do we have reason to believe iMessage and Whatsapp are more secure?

wrt iMessage, yes, it’s E2EE and the keys are not stored in iCloud if you disable iMessage backup. Granted Apple still owns the keyset gets so, eh, depends on how paranoid you wanna get.

it is critical to note that you also need to disable backing up your iPhone in iCloud to defeat having your key stored in iCloud:

https://support.apple.com/en-us/HT207428

Re: We Chat, They Watch

#14

Post by gonehome »

Moodles wrote: post #5
bgorman wrote: post #3

Did anyone actually think WeChat communications are secure? Do we have reason to believe iMessage and Whatsapp are more secure?

WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does.

WhatsApp message content is secure, but metadata does get turned over in subpoenas.

Re: We Chat, They Watch

#15

Post by usaar333 »

Clever experimental set-up (tl;dr they detect whether novel content first sent between non-China accounts increases the probability of it being censored in realtime when being sent to China accounts -- and it does -- implying a censor (or perhaps a non-realtime automated system) looked at it).

I'm wondering though if this is intentional or just "incompetence/laziness". WeChat itself seems self-interested in not bothering with content transmitted outside China, but perhaps it is just such a small amount of their user-base, that they never bothered setting up a "firewall".

Re: We Chat, They Watch

#16

Post by jdm2212 »

otachack wrote: post #9
Moodles wrote: post #5

Earlier quoted context omitted.

WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does.

You also have to trust the source code, or trust a recent audit, then also make sure the build you have kept it's integrity and matches the audit build.

There are degrees of security between "I personally built it from source using a compiler I personally built from source" and "Xi Jinping is CC'ed a plaintext copy of every message". The allegation here is that WeChat is basically the latter. No one makes any remotely similar claim about iMessage or WhatsApp.

Re: We Chat, They Watch

#17

Post by Moodles »

gonehome wrote: post #14
Moodles wrote: post #5

Earlier quoted context omitted.

WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does.

WhatsApp message content is secure, but metadata does get turned over in subpoenas.

The question was: do we have any reason to believe it is more secure than weChat? I say yes.

Re: We Chat, They Watch

#18

Post by gonehome »

Moodles wrote: post #17
gonehome wrote: post #14

Earlier quoted context omitted.

WhatsApp message content is secure, but metadata does get turned over in subpoenas.

The question was: do we have any reason to believe it is more secure than weChat? I say yes.

Yeah I don't disagree, definitely the answer is yes - I was just adding some extra detail.

Re: We Chat, They Watch

#19

Post by the_pwner224 »

> Facebook spies on the content that all users send each other, including Chinese (and Canadians and Europeans and Indiana and Australians and Russians...)

Sure, the article discusses other sketchy stuff that wechat is doing, but FB and Twitter and Reddit et. al. are all doing similar stuff too.

Re: We Chat, They Watch

#20

Post by ggus »

gonehome wrote: post #14
Moodles wrote: post #5

Earlier quoted context omitted.

WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does.

WhatsApp message content is secure, but metadata does get turned over in subpoenas.

whatsapp backups on google are not encrypted. anyone wanting to read the messages just has to ask google.
Post reply on HN