Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Coder Who Encrypted Your Texts

wsj.com

Post reply on HN
Print view View original

101–110 of 191 posts

Re: The Coder Who Encrypted Your Texts

#101

Post by moxie »

ianopolous wrote: post #98

I was a great fan of TextSecure until a few days ago. I had encouraged a bunch of friends to install it. One of them couldn't get rid of a notification from TextSecure about an unread message despite there being none, and eventually they uninstalled it. Then, for the next 4 months TextSecure blackholed every message I sent this friend without warning either them or me. They never received a single message from me. Af…

You'll find that this is true for every messenger on Android, since there is no way to detect someone uninstalling without unregistering.

TextSecure has delivery receipts so you can see when your messages aren't being delivered, and there's a web-based unregistration flow on the Open Whisper Systems website so that users can unregister their numbers if they've uninstalled.

Re: The Coder Who Encrypted Your Texts

#102

Post by ianopolous »

moxie wrote: post #101
ianopolous wrote: post #98

I was a great fan of TextSecure until a few days ago. I had encouraged a bunch of friends to install it. One of them couldn't get rid of a notification from TextSecure about an unread message despite there being none, and eventually they uninstalled it. Then, for the next 4 months TextSecure blackholed every message I sent this friend without warning either them or me. They never received a single message from me. Af…

You'll find that this is true for every messenger on Android, since there is no way to detect someone uninstalling without unregistering. TextSecure has delivery receipts so you can see when your messages aren't being delivered, and there's a web-based unregistration flow on the Open Whisper Systems website so that users can unregister their numbers if they've uninstalled.

Thanks for the reply, Moxie. I realise I sound negative, but I do love your work. The app gave me no indication that delivery was failing. Couldn't you detect the failure when you try and forward on the message from your servers (if it is a push architecture)? Happy to give you my details if you want to look into it.

Re: The Coder Who Encrypted Your Texts

#103

Post by ulam2 »

moxie wrote: post #5

I get a lot of credit for the stuff that Open Whisper Systems does, but it's not all me by a long shot. Trevor Perrin, Frederic Jacobs, Christine Corbett, Tyler Reinhard, Lilia Kai, Jake McGinty, and Rhodey Orbits are the crew that really made all this work happen.

I tried TextSecure through bluestacks and captured the stream to find out that it is using TLSv1. I am a noob in computer security, but isn't TLSv1.2 more secure?

Re: The Coder Who Encrypted Your Texts

#104

Post by blfr »

aw3c2 wrote: post #94
nitrogen wrote: post #86

Earlier quoted context omitted.

According to Wikipedia[0], reverse engineering is generally legal in the US: In the United States even if an artifact or process is protected by trade secrets, reverse-engineering the artifact or process is often lawful as long as it has been legitimately obtained. [0] https://en.wikipedia.org/wiki/Reverse_engineering#United_Sta...

And that is one country out of ~200.

Yes but it has 350M people living in it, half the HN, Silicon Valley, and Moxie with his team. It's not honest to say the US is just another country among 200.

Re: The Coder Who Encrypted Your Texts

#105

Post by ulam2 »

muppetman wrote: post #34
btczeus wrote: post #18

There is not any evidence of encryption on WhatsApp, source code is closed so you can never be safe.

People have sniffed the wire for the WhatApp client (on Android, towards another Android) and seen that it is encrypted. But your point stands - there's no UI to indicate if it was secure or not and the code isn't open so you can't know for sure.

I tried TextSecure through bluestacks and captured the stream to find out that it is using TLSv1. I am a noob in computer security, but isn't TLSv1.2 more secure?

Re: The Coder Who Encrypted Your Texts

#106

Post by JupiterMoon »

nitrogen wrote: post #86
JupiterMoon wrote: post #82

Earlier quoted context omitted.

Many countries have laws against reverse engineering programs. Whilst I think these laws are stupid I would prefer to just use the open source program than mess around with the closed source alternative.

According to Wikipedia[0], reverse engineering is generally legal in the US: In the United States even if an artifact or process is protected by trade secrets, reverse-engineering the artifact or process is often lawful as long as it has been legitimately obtained. [0] https://en.wikipedia.org/wiki/Reverse_engineering#United_Sta...

Assuming that nothing in the thing being reverse engineered is not encrypted or protected in some fashion right?

Re: The Coder Who Encrypted Your Texts

#108

Post by jacquesm »

drcross wrote: post #81
jsprogrammer wrote: post #73

Earlier quoted context omitted.

> there's absolutely no way for an end-user to determine if their messages are being encrypted (with whatsapp) Watch the network traffic with Wireshark?

You cant see into the encrypted traffic to see if it's implemented or not.

But in the worst case you'll be able to see that it is plaintext.

Re: The Coder Who Encrypted Your Texts

#109

Post by lorenzhs »

btczeus wrote: post #78
theGimp wrote: post #27

Earlier quoted context omitted.

For those interested in the rationale: https://github.com/WhisperSystems/TextSecure/issues/127#issu...

From https://github.com/WhisperSystems/TextSecure/issues/53 Moxie: "I'd like to avoid distributing APKs outside of the Play Store" Why give a single entity the power to push a malicious update anytime?

that's not how the Play store (or Android) works. Moxie signs the APK, phones will only install updates that are signed with the same certificate as the version they already have. Google cannot modify apps.

Edit: In contrast, the F-Droid builds were built and signed by F-Droid, so they could at any time include any code they wanted. Whom do you trust more, the developer or some alternate app store?

Re: The Coder Who Encrypted Your Texts

#110

Post by lukeh »

Strilanc wrote: post #85

Moxie and Frederic and Christine and the rest definitely deserve a lot of credit. Half of me is really happy every time I see Signal getting more popular. The other half is more like OH GOD THE STAKES ARE HIGHER NOW WHAT IF I MADE AN EXPLOITABLE MISTAKE BETTER RE-READ SOME CODE. But seriously, you should read the code. It's there, open for anyone to audit after all. Maybe start somewhere random in the guts [1][2][3]…

+[Cryptography generateRandomBytes] should possibly return NSData rather than NSMutableData.
Post reply on HN