231–240 of 334 posts
Without being open-source, who can assure that there isn't always encryption with a second backdoor key ? I can't easily even see a hash of my key, how do I know it has or hasn't changed? It's pretty easy to have a feature that only shows some of the keys changes and not all of them.
Earlier quoted context omitted.
It makes WhatsApp effectively not E2E encrypted. All messages can be recovered by Facebook. How is that NOT a backdoor?
No, all messages cannot be recovered by Facebook. Read the article - messages that are not yet delivered can potentially be read; if it has been delivered it cannot be retrieved.
Earlier quoted context omitted.
I'd go further and say Moxie is complicit by way of negligence. It's unethical to assist in the implementation of your protocol when you can't guarantee its privacy protections will actually stand. Otherwise it's free PR for Facebook to tout "Snowden-approved crypto". I have no doubt Moxie acted in good faith and wanted to expand encryption to a large number of users, but this is just another example of why proprieta…
> OWS should denounce these implementations as least as firmly as they do open source Signal client forks. They don't. Moxie does not want the forks to use his servers or the name of his app, that is all.
Earlier quoted context omitted.
Whatsapp is both a server and a client. The server might be written in Erlang, but the client (where all the end-to-end encryption happens) is written in whatever the device can run.
The device runs machine code. Client code can be written in any language which can be either compiled or interpreted to machine code.
Earlier quoted context omitted.
> OWS should denounce these implementations as least as firmly as they do open source Signal client forks. They don't. Moxie does not want the forks to use his servers or the name of his app, that is all.
Well since the server for Signal is closed source, the signal client forks are pretty much useless (correct me if I’m wrong)?
This is really damning on the part of Facebook and WhatsApp! How could they just brush this off as "expected behavior" and wasn't being actively worked on? I guess their priorities are where a social media company like Facebook would have them be - make more avenues to monetize the usage.
The initial response from the WhatsApp spokesperson is just PR speak, and really terrible for a response (until the direct question came up and another statement was issued).
It's sad that Signal and Open Whisper Systems are being dragged in here, because many people may just look at the headline, probably skim the beginning of the article a little bit and assume that the OWS implementation is the culprit or that OWS is somehow complicit in this.
Earlier quoted context omitted.
check out Ricochet. If i recall correctly, it uses blockchain type transport over tor.
how does that help, I think tor can be blocked..?
> The firewall searches for a bunch of bytes which identify a network connection as Tor. If these bytes are found the firewall initiates a scan of the host which is believed to be a bridge. In particular the scan is run by seemingly arbitrary Chinese computers which connect to the bridge and try to “speak Tor” to it. If this succeeds, the bridge is blocked.
Earlier quoted context omitted.
Simple explanation would be that activists use Signal. [1] They don't trust WhatsApp and rely on Signal for secure messaging. Blocking Signal means they are able to target activists without impacting much of the rest of the population. [1] Many of the people I know who are activists in countries where they need to protect their identities use Signal
I wouldn't trust whatsapp even before this revelation. I would never trust a closed source messaging app if I was an activist, regardless of what encryption they claim to implement.
Earlier quoted context omitted.
It is in fact all messages. They can simply not deliver the first message and force a resend record that mesaage. Afterwards force again a resend with the old encryption key and deliver that mesaage. No one would get a notification.
I can see how you would leave the receiver in the dark by sending them the original, deferred message, but how would asking the sender's device to resend with a different key not result in a notification? Furthermore, as soon as the sender attempts to deliver another message to the recipient, they would get another notification (because the encryption key changed back to the real key); alternatively the attacker coul…
Earlier quoted context omitted.
I wouldn't trust whatsapp even before this revelation. I would never trust a closed source messaging app if I was an activist, regardless of what encryption they claim to implement.
Good point. At least as a technical person, I would like to use an open-source messaging application. Of course I'm not going to read the source code but at least I'm sure developers behind the app do not open a backdoor for someone else.