Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp whitepaper removed sentence about never having access to private keys

twitter.com

Post reply on HN
Print view View original

31–40 of 111 posts

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#31

Post by djeiasbsbo »

therockhead wrote: post #24
philliphaydon wrote: post #13

After Facebook bought what’s app, I’ve never for a moment believed it was secure. I’ve mentioned on here before about a conversation i had on what’s app and was presented with ads for the topic in Facebook right after. I’ve heard people have had similar stories. What’s app isn’t secure.

> I’ve mentioned on here before about a conversation i had on what’s app and was presented with ads for the topic in Facebook right after I have heard something similar to this but just assumed it was a coincidence. Has this every been proven with verified results ?

I always see claims like this but never with actual evidence or research done.

On Android, I can spoof the microphone access permission so that Whatsapp thinks it has access. I can then log whenever this permission is being used while giving it spoofed data. I have it done this for many apps and unsurprisingly, most try to access the microphone in the background over and over again. I have not done this experiment with Whatsapp yet, though.

What I use for this is XPrivacyLua by M66B, which also has suppory for scriptable hooks in Lua.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#32

Post by philliphaydon »

therockhead wrote: post #24
philliphaydon wrote: post #13

After Facebook bought what’s app, I’ve never for a moment believed it was secure. I’ve mentioned on here before about a conversation i had on what’s app and was presented with ads for the topic in Facebook right after. I’ve heard people have had similar stories. What’s app isn’t secure.

> I’ve mentioned on here before about a conversation i had on what’s app and was presented with ads for the topic in Facebook right after I have heard something similar to this but just assumed it was a coincidence. Has this every been proven with verified results ?

For me I don’t think it was a coincidence.

My story is: 2 years ago I was looking for an apartment. My friend who is an agent took me to an apartment. After viewing I messaged him on what’s app saying I liked the place but I want the landlord to put latches on the windows so it’s child safe.

After messaging him I went to Facebook. Scrolling the timeline. A minute later I have adverts for window latches and window grills for child safety.

I didn’t search Google or anything. I was shocked.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#33

Post by tuyguntn »

I have a question to people who said Telegram is worse than WhatsApp in every possible way for privacy. Do you still hold this belief? At least Telegram is holding its promise, if you start secret chat only you and your peer knows encryption keys

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#34

Post by arendtio »

drcongo wrote: post #25

Don't they _need_ the private keys to mine all your messages for data on which to base the in-chat ads? This shouldn't be a surprise after recent announcements.

Not necessarily. In the past, there were also reports which showed, that if the Facebook App is installed on the same device, it would have access to the decrypted messages (not sure for which platform though).

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#35

Post by eurasiantiger »

tuyguntn wrote: post #33

I have a question to people who said Telegram is worse than WhatsApp in every possible way for privacy. Do you still hold this belief? At least Telegram is holding its promise, if you start secret chat only you and your peer knows encryption keys

Didn’t Telegram roll their own crypto?

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#36

Post by philliphaydon »

simias wrote: post #27
philliphaydon wrote: post #13

After Facebook bought what’s app, I’ve never for a moment believed it was secure. I’ve mentioned on here before about a conversation i had on what’s app and was presented with ads for the topic in Facebook right after. I’ve heard people have had similar stories. What’s app isn’t secure.

I'm very skeptical of WhatsApp's security but I'm also very skeptical of these ad claims. We've seen a tone of those over the years, these companies would have a lot to lose if they did that. Chances are that you're either more predictable than you expected, or it's just random chance and correlation bias. Billions of people use these services, there have to be some freaky coincidences happening all the time. We need…

My story here.

https://news.ycombinator.com/item?id=25686128

If it’s a coincidence it’s scary cos I have no idea how I posted something in chat to getting an advert for that within a minute.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#37

Post by tuyguntn »

eurasiantiger wrote: post #35
tuyguntn wrote: post #33

I have a question to people who said Telegram is worse than WhatsApp in every possible way for privacy. Do you still hold this belief? At least Telegram is holding its promise, if you start secret chat only you and your peer knows encryption keys

Didn’t Telegram roll their own crypto?

Sure, they rolled their own encryption. But, lets look at this problem from different point of view. Every encryption protocol is invented by some group of people, Signal and Telegram is no exception, only difference is other encryption algorithms are tested, audited and verified by time for security. Keep in mind, every algorithm is rolled out by someone, you can't say there will be no better encryption algorithm in the future than all available today. So someone will roll their own crypto anyway in the future, which might be more secure than everything we have today.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#38

Post by dbrgn »

eurasiantiger wrote: post #35
tuyguntn wrote: post #33

I have a question to people who said Telegram is worse than WhatsApp in every possible way for privacy. Do you still hold this belief? At least Telegram is holding its promise, if you start secret chat only you and your peer knows encryption keys

Didn’t Telegram roll their own crypto?

Please stop bringing up this "never roll your own crypto" argument. It's a guideline, not a hard rule. Signal actually rolled their own crypto and aren't constantly criticized for that, on the contrary. Signal is praised for rolling it's own crypto.

Don't get me wrong, the Telegram crypto can (and should) definitely be criticized. But please criticize that they use "bad crypto" or "strange crypto" or "unreviewed crypto", not that it's their own. (And of course, substantiate such claims with references that can be discussed.)

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#39

Post by Aachen »

eurasiantiger wrote: post #35
tuyguntn wrote: post #33

I have a question to people who said Telegram is worse than WhatsApp in every possible way for privacy. Do you still hold this belief? At least Telegram is holding its promise, if you start secret chat only you and your peer knows encryption keys

Didn’t Telegram roll their own crypto?

As did Signal (called Axolotl back then)?

All protocols are invented at some point. Telegram did a terrible job marketing this one but it has been a long time now and the only issue I ever heard of was fixed some years ago. It's still not exactly pretty, but then look at TLS and I'm actually quite okay with mtproto.

The real issue is that mtproto is never used. It isn't implemented in most clients for no apparent reason ("can't keep state for encryption keys!" is the usual excuse - dude you keep my login token what's the big deal here) and if you try to use it, it doesn't sync between devices. One of the core selling points is a solid desktop experience.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#40

Post by [deleted] »

eurasiantiger wrote: post #35
tuyguntn wrote: post #33

I have a question to people who said Telegram is worse than WhatsApp in every possible way for privacy. Do you still hold this belief? At least Telegram is holding its promise, if you start secret chat only you and your peer knows encryption keys

Didn’t Telegram roll their own crypto?

[deleted]
Post reply on HN