Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rust at Scale: An Added Layer of Security for WhatsApp

engineering.fb.com

Post reply on HN
Print view View original

101–110 of 151 posts

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#101

Post by mfashby »

jraph wrote: post #71
londons_explore wrote: post #66

> over 3 billion people to message securely each and every day. Whatsapp is a chat application with 3 billion daily active users. For those of you in the US (where Whatsapp is seldom used), this is a fact worth remembering. If you want to build products for the rest of the world, you need to know how those users think and breathe - and for 3 billion of them, Whatsapp is how they talk.

What one should do about this? I mean, beside working on lowering that number. (Asking as a European who quite stubbornly refuses to install it - there are dozens of us. Dozens!) Edit: please don't participate in making WhatsApp even more inescapable as it is today.

Force interoperability one way or another. WhatsApp is a closed system, if I want to use an alternative I'm stuck with adversarial interoperability, so stuff like Beeper (which is great, but...) which might get my account banned. Or waiting for some legislation to force WhatsApp to open it's API and let me interact with my contacts there without being locked into their apps

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#102

Post by vlovich123 »

embedding-shape wrote: post #98
riffraff wrote: post #96

Earlier quoted context omitted.

WhatsApp happened at a time when, in Europe, you paid for SMS. WhatsApp allowed people to send SMS without paying, or rather, paying just once to buy the app, so it was instantly valuable if you just convinced your spouse or parents or a single friend to install it. To overcome it now, you need a lot more effort (or rely on enshittification, which I'm sure will happen).

No, before Whatsapp, people were mostly using Facebook messages, at least where I lived at the time. And no one was paying per SMS at the time we were using SMS for communication, almost everyone I know were on monthly plans that gave you N text messages and N minutes of calls for static sum each month. The first people I saw who started using whatsapp, was people who were communicating across the border, because eve…

WhatsApp launched in January of 2009 compared with Facebook Chat which launched in 2008. WhatsApp saw drastically wider adoption among the general populace and paying for “N text messages per month” is precisely what people refer to as paying per message - WhatsApp had unlimited messaging.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#104

Post by duskwuff »

rvnx wrote: post #87
harikb wrote: post #80

Earlier quoted context omitted.

As a developer, I tried building an app that needs to use Whatsapp for communication. Unfortunately my phone number got blocked by the second test message. No Spam. Not marketing, just a test message to my own number. Along with it, they blocked my entire business, my LLC, and anything tied to it. I have been trying to get hold of anyone or anything at Whatsapp. I've spent 6 months trying to navigate the bureaucracy.…

Telegram API is easier to handle as far as I know if that can somehow help (in case you want live ChatGPT or notifications for yourself in a mobile chat)

Telegram's bot API is a lot easier to get started with for sure. It's got some rough edges once you start trying to do anything more complex, though, and the underlying MTProto API is nothing short of bizarre.

I'd urge caution before using them as a component of your business, though. Their business strategy is pretty chaotic and has relied heavily on weird cryptocurrency-adjacent plays (e.g. TON / Fragment / gifts). They've made a couple of attempts to introduce business features, but I'm not sure they've had any substantial uptake.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#105

Post by fabrice_d »

marisen wrote: post #4
nevi-me wrote: post #3

> We believe that this is the largest rollout globally of any library written in Rust. I suppose this is true because there's more phones using WhatsApp than there are say Windows 11 PCs. Given that WhatsApp uses libsignal, is it safe to assume that they haven't been using the Rust library directly?

WhatsApp doesn't use libsignal, and Android is already pretty Rusty and deployed more than WhatsApp around the world (not just smartphone. Tons of "embedded" use cases also run on custom Android)

WhatsApp was using libsignal (the C version) when I worked on the KaiOS integration in 2017/2018.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#106

Post by antonvs »

mr_mitm wrote: post #97
rvnx wrote: post #64

Earlier quoted context omitted.

As far as I remember, Google does the final signing of the APK, which is eventually the signature verified by the OS to verify if an update is valid or not. So Google can, if ordered or willing to help, create a new release track (e.g. experimental-do-not-deleted) and add specific e-mails to that track with the "improved" version. Nobody would be able to see that in real world, and you know what, if WhatsApp themselv…

Yes, the app could be compromised, or the OS, or the compiler of the app, or of the OS, or the OS of the compiler, or the CPU any of these things run on, etc. etc. None of that is relevant to the definition of E2EE.

It's relevant to how E2EE is described to users. Representing that it's not possible for anyone other than the sender or recipient to read messages is misleading and just incorrect in general.

A particularly relevant point is when it comes to government interception. E.g. it would be perfectly possible for an messaging app to have a "wiretap mode" that the vendor enables for users that are the subject of a relevant warrant.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#107

Post by antonvs »

Fripplebubby wrote: post #65
antonvs wrote: post #59

Earlier quoted context omitted.

It's not entirely accurate to say "any party other than the sender and the intended receiver," since the messaging app running on the user's device can read the messages. Something like "any third party (other than the app vendor)" would be more accurate. Without actually analyze app behavior, it comes down to trusting that the vendor doesn't do anything nefarious.

I think the draft covers this well: https://www.ietf.org/archive/id/draft-knodel-e2ee-definition...

Technical drafts will tend to get this right, where the communication often breaks down is how it's communicated to users.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#108

Post by zikani_03 »

londons_explore wrote: post #66

> over 3 billion people to message securely each and every day. Whatsapp is a chat application with 3 billion daily active users. For those of you in the US (where Whatsapp is seldom used), this is a fact worth remembering. If you want to build products for the rest of the world, you need to know how those users think and breathe - and for 3 billion of them, Whatsapp is how they talk.

Where I come from (Malawi, Africa), WhatsApp is so widespread that most people prefer it over email - to the extent that people don't really check their e-mails unless it's required for work or they are applying for something. For most people, WhatsApp is the de-facto communication channel.

I help moderate a community of developers and we hit the whatsapp group limit of 1024 members and sometimes have to wait for someone to leave (intentionally or accidentally) before we can add new members. We've tried to move people onto "better" platforms like Discord or Slack but we always end up coming back to WhatsApp which is subsidized via MNOs (mobile network operators) social media data/internet bundles and for the fact that most people are just stuck on whatsapp.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#109

Post by embedding-shape »

vlovich123 wrote: post #102
embedding-shape wrote: post #98

Earlier quoted context omitted.

No, before Whatsapp, people were mostly using Facebook messages, at least where I lived at the time. And no one was paying per SMS at the time we were using SMS for communication, almost everyone I know were on monthly plans that gave you N text messages and N minutes of calls for static sum each month. The first people I saw who started using whatsapp, was people who were communicating across the border, because eve…

WhatsApp launched in January of 2009 compared with Facebook Chat which launched in 2008. WhatsApp saw drastically wider adoption among the general populace and paying for “N text messages per month” is precisely what people refer to as paying per message - WhatsApp had unlimited messaging.

Is "Facebook Chat" not the same as "Facebook Messenger", the separate chat client? Because I seem to remember a lot of people using the chat built-in into Facebook (not Messenger) a lot earlier than the standalone app/client, maybe I misrecall.

> paying for “N text messages per month” is precisely what people refer to as paying per message

Maybe I said it wrong, "N text messages per month" for me means "Pay us 10 EUR per month, send up to 5000 messages" for example. Doesn't matter how many you send, you pay the same.

While "pay per message" is "Every text message you send, costs 0.01 EUR". Maybe I'm using the wrong words, but that's how I understand it.

Most of the people who were "texters" (in my circles) were on plans offering the first way of paying, while hardly anyone was doing it the second.

Another important part, was that most telecom's had free SMS and calls if you were with the same company (and still do, AFAIK), so constant bickering about what plan people are on and why they don't change so it's free and yadda yadda.

Many people were already mostly texting for free at this point.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#110

Post by stavros »

01HNNWZ0MV43FF wrote: post #84
embedding-shape wrote: post #73

Earlier quoted context omitted.

I guess if you want to lower that number, you'd need to build something better, in some way. Answered as another European who've had Whatsapp forever, as some stubborn people refuse to move away from it, and also bunch of businesses use it.

Network effect is killer. "better" would include having more than 3 billion people already on it. Maybe the EU or China will crack down on it. A single company shouldn't decide who gets to talk to half the world. If that company is American they will not tolerate it for long. Personally DeltaChat is my new favorite Thing but it falls afoul of Zooko's Triangle - A WhatsApp number or POTS number is short because it's c…

The EU has already forced WhatsApp to be interoperable. Of course, Meta complied maliciously, making it a setting that you have to enable, but at least it's a start.
Post reply on HN