141–150 of 386 posts
Earlier quoted context omitted.
I'm sorry, but that's not how computer software works. Anyone who knows what a basic block is can straightforwardly verify the claims WhatsApp is making.
you don't know how e2e security works, do you? without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.
This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…
> They seem to have replaced TLS/SSL between client and server with "Noise Pipes". WhatsApp was already using a custom protocol instead of TLS. We worked with them to transition over to Noise Pipes, which has some advantages over what they were doing before. Also, we've renamed Axolotl to Signal Protocol: https://whispersystems.org/blog/signal-inside-and-out/
Earlier quoted context omitted.
Ricochet appears to rely on Tor's encryption, with an additional custom RSA handshake. That's two added levels of "nope" for me, but other people might feel differently.
I can see that but I think the self authenticating nature of Tor Onion Services and therefore bypassing bgp, dns and CA weaknesses is worth something†. Maybe in the future when prop224†† is implemented the encryption will be more solid. † https://media.ccc.de/v/32c3-7322-tor_onion_services_more_use... †† https://gitweb.torproject.org/user/asn/torspec.git/tree/prop...
That's what's so exciting about the WhatsApp announcement. WhatsApp is by all accounts a pretty great messaging application, and it doesn't just have decent encryption now; it has best in class encryption specifically designed to protect a messaging application, designed by experts who thought about this problem for a long time.
Is it open source? I can't find the source code anywhere.
Earlier quoted context omitted.
I actually in agreement with what you are saying about viewing the shipped binary, but source is a must also. ideally it is a reproducible build to verify the source created the binary.
You keep saying "source is a must" but you have yet to explain why that is the case.
>If WhatsApp is so evil that they've backdoored their product
Unless they want to go the way of Lavabit, every company is evil when kindly asked to be. (Well, maybe it helps when you have the weight of Apple, but that wasn't even a NSL if we heard about it.)
>it is "supervillain monologuing for an hour while the hero escapes"-grade stupid to leave that backdoor in their source code.
And if they don't, a reproducible build process will cause someone to notice the binary doesn't match up and sound the alarm, somewhat similar to how a warrant canary works even if not everyone is checking it. (Sure, the company could always go back on their open source promise for other reasons, but at least everyone is left with a last known-likely-good inspectable and forkable version.)
How does this compare with Telegram?
By default, Telegram stores a plaintext copy of every message you've ever sent or received on their servers. WhatsApp does end to end encryption using the Signal Protocol by default, and doesn't store anything server side.
Earlier quoted context omitted.
It is killing me that you didn't rename Signal to Axolotl.
Why? "Axolotl" at least has seriously pronunciation issues so I am glad it is not used "user-side".
"Signal" in IT usually means UNIX inter-process communication.
Earlier quoted context omitted.
You can definitely verify the code without the source. It may often be much harder, but it is not un-verifiable. Please stop spreading misinformation like this. With all the wonderful reverse-engingeering tools, dissassemblers, debuggers, etc. available, and the numerous massive communities that use them, it seems pretty out-there that you could seriously think such a thing...
skype is encrypted and backdoored. how can you know the same isn't true of whatsapp?
Earlier quoted context omitted.
fair enough! https://www.schneier.com/blog/archives/2016/03/possible_gove... i think this is why source is a must. if a user compiled and installed the app themselves, and hypothetically had the entire stack above it be similarly open, then it would prevent the kind of attack mentioned. do you agree? if the source is closed anywhere in the stack, or pushed out in a walled garden as it is currently, then it allows the…
I understand what you're saying. I don't think source is bad thing! Source is good. But I think you're a little confused here. The cryptographic building blocks of the new WhatsApp protocol are available in source code. You can get source for the Signal Protocol (fka Axolotl). You can get source for the Noise framework. WhatsApp borrowed these tools from a very open secure messaging project. You're unhappy that the s…
Every Linux distribution out there compiles everything in their repo by hand. If you use an AUR package of almost everything on Arch, you are building the software by hand locally from source. You can pull build scripts from launchpad, the Suse OBS, or almost every distros package repository (they all have automated build systems for everything, and you can do it all yourself).
Oh, and there is a little distro called Gentoo some people use where you literally build everything from source yourself.
So nobody builds open source software from source, besides the millions of people who do it all the time. Sure, it is a tiny fraction of total users, but there is a dramatic difference between "nobody" and "somebody" just like there is a dramatic difference in confidence between "were using this secure crypto, trust us, its there! its not just something else masquerading as secure crypto that we have backdoors all over!" versus "here is the source, go build it yourself if you don't trust us".
The value is not in everyone building from source themselves, just like my confidence in my software is not in auditing every line myself. It is in the general freedom of information on the security, and by offering the information to test it myself I will have inherently more trust in a project even if I never take advantage of that source availability myself - even if nobody ever does find exploits in the disclosed code, there is still trust a proprietary vendor can never have that I implicitly give free software projects because it is much more precarious to backdoor transparent software than a black box, and by just making the box transparent at all you add value.