31–40 of 140 posts
No way anyone else at FB could have built this app and given it away for free for years for that price.
No way. Totally worth it. 19bn $.
Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.
Earlier quoted context omitted.
As long as Facebook gets to read all those billions of "personal" communications - messages, videos, audio, images - they are fine with anything.
Are you... are you saying they are trying to copy... Google ?!? I am speechless by such a statement.
Earlier quoted context omitted.
Just out of curiosity, where would you store the unique AES key, that wouldn't break the UX in many ways? For instance, not losing messages when you upgrade your phone.
Storing the key is easy, you put it in your app's private data folder. Which is where the database should have just been stored in the first place, and not on the public SD card. You could also have a user-supplied passphrase with email recovery. Or any of a dozen other best practices that exist. This isn't exactly a new problem, there are plenty of solutions that are far superior to rot13 (which is basically all thi…
I accept there is a good solution, but I don't think you are thinking about the problem broadly.
Earlier quoted context omitted.
Just out of curiosity, where would you store the unique AES key, that wouldn't break the UX in many ways? For instance, not losing messages when you upgrade your phone.
Store it in private and keep a copy on WhatsApp's server if the internal storage is lost during an upgrade (I'm assuming Android apps can't sniff each other's packets, can they?). It's not secret-from-whatsapp, they can read your messages regardless. Then the data in external storage would be comparatively safe from other apps on your phone.
Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage.... ) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.
It only gets copied there when you use the build in backup feature (Settings -> Chat Settings). Else, it sits "safely" under /data/data/com.whatsapp/databases like every other Android sqlite database.
But nonetheless, WhatsApp was and is not really known for its safety...
19bn $. No way anyone else at FB could have built this app and given it away for free for years for that price. No way. Totally worth it. 19bn $. Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.
They took a lot of shortcuts, which turned out really well for them. Simplification made for a very fast client and a low-latency, low-bandwidth protocol.
Earlier quoted context omitted.
Storing the key is easy, you put it in your app's private data folder. Which is where the database should have just been stored in the first place, and not on the public SD card. You could also have a user-supplied passphrase with email recovery. Or any of a dozen other best practices that exist. This isn't exactly a new problem, there are plenty of solutions that are far superior to rot13 (which is basically all thi…
I don't think you are evaluating the tradeoff at all here. WhatsApp won by making a friction free experience. You are adding email and pass phrases, or any one of the dozen things that make it harder to use. I accept there is a good solution, but I don't think you are thinking about the problem broadly.
The people using your software are more important than your fucking term sheets, man.
Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?
What's troubling is, that their security track record has been abysmal from the start. In that regard, the acquisition sends entirely the wrong message.
Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage.... ) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.
But I kind of disagree with your wonderings. The problem here, isn't "base competence"--it's that it's harder to suck people into your funnel when you have frictional stuff like passphrases or verification. I cannot see an eventuality where this isn't the result of malice, where this isn't user-hateful by design. That bothers me profoundly.
Earlier quoted context omitted.
What's troubling is, that their security track record has been abysmal from the start. In that regard, the acquisition sends entirely the wrong message.
What message does it send, other than valuation not being based on the reputation of technical superiority?
This is not a test of "technical superiority". This is working against your users' best interests. One mistake is understandable, and sometimes forgivable, but you don't bilge it twice so cavalierly if you rank on the give-a-damn scale. (I say "cavalierly" because, as I noted elsewhere in this thread, I can't shake the feeling that this is the result of a design decision, not a technical failure.)