There is no guarantee that once audit is completed the actual running system is e2ee. You just have to trust WA. Given who runs it and the track record, there is no way I could have trust in them.
WhatsApp end-to-end encrypted backups security assessment
101–110 of 121 posts
Re: WhatsApp end-to-end encrypted backups security assessment
#102Re: WhatsApp end-to-end encrypted backups security assessment
#103Earlier quoted context omitted.
Are you saying it’s not getting enough credit or that it shouldn’t? The Signal code was closed source for longer than a year (from April 2020) when no commits were done in the public repo because . Some months ago the public repo got a barrage of commits after that long gap. It wasn’t that the Signal platform and client had no updates during this time. There were many, but the code wasn’t released. Signal may be open…
Signal is not entitled to the value associated with being open source. Signal is merely pretending to be open, when in reality they are more community and user hostile than plenty of closed source or proprietary projects. Calling Signal open, is an insult to anyone actually building or supporting open source projects or protocols.
This is a false claim. All of Signal's software is released under open source licenses. The fact that you disagree with how they run their project and service is irrelevant to the fact that both the client and server are free software.
Re: WhatsApp end-to-end encrypted backups security assessment
#104Earlier quoted context omitted.
The standard fix to this is to give each message a GUID, and then when you delete a message, instead of deleting it, your store a tombstone with the GUID, and that prevents a network re-send from causing the message to reappear.
Sorry, what’s a tombstone? Like add a field that says “deleted”?
Yes, it's a concept used e.g. in hash tables that use open addressing [0], where you can't delete value X because the final address of value Y may depend on whether X was present when it was being inserted. So instead of deleting X and leaving behind an empty address we change X to a tombstone that stays there forever and says "something was here and if you're looking for Y, Z or anything else, keep on looking".
[0] https://en.wikipedia.org/wiki/Hash_table#Open_addressing
Re: WhatsApp end-to-end encrypted backups security assessment
#105Earlier quoted context omitted.
> The Signal code was closed source for longer than a year (from April 2020) This absolutely untrue. Signals source has NEVER been closed source. The Signal server source code(which isn't special and doesn't change that often) just had no public commits. The Signal client source code(what matters and makes Signal secure) was frequently updated. > Signal may be open source at times, Again, Signal has always been open…
> The Signal server source code(which isn't special and doesn't change that often) just had no public commits. So it was opensource... you just couldn't see the source running on the servers? Yeah, makes sense. Right.
Well seeing as you don't have access to the ME, no amount of application code being published will mean you can see the source running on the servers. This is a red herring.
The client source code is the only thing that's really relevant in an e2e encryption model, anyway. Regardless, 100% of the production versions of the Signal server software have been published under free software licenses, so I'm not sure what you're arguing.
Re: WhatsApp end-to-end encrypted backups security assessment
#106What would it take for people to stop trusting facebook? Universal outrage doesn't seem to be it.
It would take some or all of their contacts not being accessible via the platform.
This is why I don't have an fb, wa, or ig account. If you want to talk to me, you can't do it on there.
Re: WhatsApp end-to-end encrypted backups security assessment
#107Earlier quoted context omitted.
How is this a violation of privacy… that’s not how e2e encryption works.
e2e encryption does nothing about ensuring deletion. Whatsapp can simply re-deliver the same encrypted blob.
That’s called a replay attack and is absolutely something e2e encryption protects against
Re: WhatsApp end-to-end encrypted backups security assessment
#108For the work I do, I also conducted a mini-experiment where I checked the WhatsApp security in regards to the media transmitted. In the cited documentation below ([0]), it claims that media will not be saved for either method 1 or 2 ("To stop media from all your individual chats and groups from being saved" and "To stop media from a particular individual chat or group from being saved"). I found out that the media is…
Regarding storing files: They either are using https://developer.android.com/training/data-storage/app-spec... and other apps would not be able to access those files at all, or they should be using it instead of just using "external storage".
I agree, I see it currently uses the "unprivileged storage" (the user-space storage called "Internal Storage").
"My Files" ("com.sec.android.app.myfiles" on Samsung Android) is an app and certainly has access to those files.
If that app has access to that directory, certainly many other apps do have access, such as Samsung Gallery ("com.sec.android.gallery3d" on Samsung Android). Of course, in the case of the Gallery app it's just used as an image viewer, but that is not an inhibition for another app to exfiltrate these directories into a server.
What if some malicious app synced WhatsApp directories into a 3rd party server? I don't see it too hard.
Re: WhatsApp end-to-end encrypted backups security assessment
#109Earlier quoted context omitted.
e2e encryption does nothing about ensuring deletion. Whatsapp can simply re-deliver the same encrypted blob.
That’s called a replay attack and is absolutely something e2e encryption protects against
e2e encryption means the party in the middle does not have the key to the data. It is somewhat of a misnomer since it is a feature of key-agreement more than a feature of encryption.
Any other features are dependent on the protocol that uses the secret key. You will generally see an encryption method that is protected against cipher-text manipulation, but e2e does not guarantee that. Similarly, a protocol that uses e2e encryption can add replay protections, but it is not at all a feature inherent in e2e.
I could well imagine that whatsapp has some replay protection build in. I could similarly imagine they have a way to override that in case they need to. Heck, perhaps the replay protection is implemented with WhatsApp as the ultimate arbiter of what counts as a replay. As long as WhatsApp does not know the key used to encrypt my messages, the encryption is e2e in my book.
Re: WhatsApp end-to-end encrypted backups security assessment
#110I don't know why anyone would trust anything Facebook-related when it comes to privacy...
That’s exactly why maybe they would do this? They’re self aware of their reputation, try to go above and beyond to counter it, and then chose to publish a damning report against themselves in that effort. Note, I hate Facebook, but there’s nothing worse than when someone/something tries to get better in good faith, and we shit on their efforts simply because their starting position is weak (aka fat shaming the new pe…
I would generally agree with you, but my faith toward Facebook has greatly diminished over the years and it would take a lot to restore it. (aka the fat person is eating a pound of bacon every five steps on the treadmill)