71–80 of 140 posts
wait a second...my SD card folder contains a folder called DCIM which includes all my camera photos... are you suggesting that all my images are available to any app that includes SD card permissions?
Whatsapp's security is "legendary": http://tinyurl.com/nenaht8
Whatsapp's security is "legendary": http://tinyurl.com/nenaht8
One of the great advantages of android is that it permits developers to do things like this. Let's not get upset about it when mistakes happen. Users can always choose a different app if they dislike the behavior.
19bn $. No way anyone else at FB could have built this app and given it away for free for years for that price. No way. Totally worth it. 19bn $. Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.
It's also a highly-simplified backend. No multisession (synchronization is hard), no back-end message history searching (search and graphs are hard). They took a lot of shortcuts, which turned out really well for them. Simplification made for a very fast client and a low-latency, low-bandwidth protocol.
Earlier quoted context omitted.
That's why you use TextSecure instead of insecure proprietary "popular" apps. Whatsapp could also use TextSecure's ratcheting protocol, too. Why aren't they? Beats me. Maybe they prefer weaker security for their users.
No it isn't 'prefer'. It's that users don't care about this kind of security in practice, they only care about the kind of security from other people in their personal lives, which is more about privacy controls than actual security. Because of this, they get no reward from the market if they actually focus on security. Instead they focus on things the market DOES reward them for, which is being fast, never being dow…
Um, am I the only one that thinks 35 engineers is a pretty good size team to get a good amount of work done?
Earlier quoted context omitted.
Storing the key is easy, you put it in your app's private data folder. Which is where the database should have just been stored in the first place, and not on the public SD card. You could also have a user-supplied passphrase with email recovery. Or any of a dozen other best practices that exist. This isn't exactly a new problem, there are plenty of solutions that are far superior to rot13 (which is basically all thi…
>app's private data folder That may be the problem. WhatsApp has focused since the beginning on making their app available on as many devices as possible (They even have symbian compatibiity). My WhatsApp database is almost 500MB, this is more than many low end Android phone's internal memory. Therefore, they decided to store the database on the SD card. I don't think that this should be a problem had they decided to…
Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?
One might think Facebook did their due diligence and said, "DANG, you got all these users with this big of a hole just laying right out there? Here, have some money."
> ZUCK: yea so if you ever need info about anyone at harvard
> ZUCK: just ask
> ZUCK: i have over 4000 emails, pictures, addresses, sns
> FRIEND: what!? how’d you manage that one?
> ZUCK: people just submitted it
> ZUCK: i don’t know why
> ZUCK: they “trust me”
> ZUCK: dumb fucksEarlier quoted context omitted.
It's also a highly-simplified backend. No multisession (synchronization is hard), no back-end message history searching (search and graphs are hard). They took a lot of shortcuts, which turned out really well for them. Simplification made for a very fast client and a low-latency, low-bandwidth protocol.
So they have no ability to sniff through my messages on the server? That's not a bug that's a feature for me!