Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

241–250 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#241

Post by palata »

digiown wrote: post #142
palata wrote: post #133

Earlier quoted context omitted.

> Easy: pass laws requiring chat providers to implement interoperability standards so that users can bring their own trusted clients. In Europe that's called the Digital Markets Act.

That's not permissionless afaik. "Users" can't really do it. It's frustrating that all these legislations appear to view it as a business problem rather than a private individual's right to communicate securely.

Right, I get what you mean.

But in a way, I feel like sometimes it makes sense to not completely open everything. Say a messaging app, it makes sense to not just make it free for all. As a company, if I let you interoperate with my servers that I pay and maintain, I guess it makes sense that I may want to check who you are before. I think?

Re: US has investigated claims WhatsApp chats aren't private

#243

Post by refulgentis »

JasonADrury wrote: post #237
parhamn wrote: post #233

Earlier quoted context omitted.

Expalin how you detect a branched/flaged sendKey (or whatever it would be called) call in the compiled WhatsApp iOS app? It could be interleaved in any of the many analytics tools in there too. You have to trust the client in E2E encryption. There's literally no way around that. You need to trust the client's OS (and in some cases, other processes) too.

>Expalin how you detect a branched/flaged sendKey (or whatever it would be called) call in the compiled WhatsApp iOS app? Vastly easier than spotting a clever bugdoor in the source code of said app.

Putting it all on the table: do you agree with the claim that binary analysis is just as good as source code analysis?

Re: US has investigated claims WhatsApp chats aren't private

#244

Post by JasonADrury »

oofbey wrote: post #236
TZubiri wrote: post #231

Earlier quoted context omitted.

With all due respect to Stallman, you can actually study binaries. The claim Stallman would make (after punishing you for using Open Source instead of Free Software for an hour) is that Closed Software (Proprietary Software) is unjust. but in the context of security, the claim would be limited to Free Software being capable of being secure too. You may be able to argue that Open Source reduces risk in threat models w…

What’s the state of the art of reverse engineering source code from binaries in the age of agentic coding? Seems like something agents should be pretty good at, but haven’t read anything about it.

I've been working on this, the results are pretty great when using the fancier models. I have successfully had gpt5.2 complete fairly complex matching decompilation projects, but also projects with more flexible requirements.

Re: US has investigated claims WhatsApp chats aren't private

#245

Post by sigmoid10 »

TZubiri wrote: post #231
coppsilgold wrote: post #227

No closed-source E2EE client can be truly secure because the ends of e2e are opaque. Detecting backdoors is only truly feasible with open source software and even then it can difficult. A backdoor can be a subtle remote code execution "vulnerability" that can only be exploited by the server. If used carefully and it exfiltrates data in expected client-server communications it can be all but impossible to detect. This…

With all due respect to Stallman, you can actually study binaries. The claim Stallman would make (after punishing you for using Open Source instead of Free Software for an hour) is that Closed Software (Proprietary Software) is unjust. but in the context of security, the claim would be limited to Free Software being capable of being secure too. You may be able to argue that Open Source reduces risk in threat models w…

This. Closed source doesn't stop people from finding exploits in the same way that open source doesn't magically make people find them. The Windows kernel is proprietary and closed source, but people constantly find exploits in it anyways. What matters is that there is a large audience that cares about auditing. OTOH if Microsoft really wanted to sneak in a super hard to detect spyware exploit, they probably could - but so could the Linux kernel devs. Some exploits have been openly sitting in the Linux kernel for more than a decade despite everyone being able to audit it in theory. Who's to say they weren't planted by some three letter agency who coerced a developer. Relying on either approach is pointless anyways. IT security is not a single means to all ends. It's a constant struggle between safety and usability at every single level from raw silicon all the way to user-land.

Re: US has investigated claims WhatsApp chats aren't private

#247

Post by JasonADrury »

refulgentis wrote: post #243
JasonADrury wrote: post #237

Earlier quoted context omitted.

>Expalin how you detect a branched/flaged sendKey (or whatever it would be called) call in the compiled WhatsApp iOS app? Vastly easier than spotting a clever bugdoor in the source code of said app.

Putting it all on the table: do you agree with the claim that binary analysis is just as good as source code analysis?

Binary analysis is vastly better than source code analysis, reliably detecting bugdoors via source code analysis tends to require an unrealistically deep knowledge of compiler behavior.

Re: US has investigated claims WhatsApp chats aren't private

#248

Post by TZubiri »

refulgentis wrote: post #243
JasonADrury wrote: post #237

Earlier quoted context omitted.

>Expalin how you detect a branched/flaged sendKey (or whatever it would be called) call in the compiled WhatsApp iOS app? Vastly easier than spotting a clever bugdoor in the source code of said app.

Putting it all on the table: do you agree with the claim that binary analysis is just as good as source code analysis?

Nono, analyzing binaries is harder.

But it's still possible. And analyzing source code is still hard.

Re: US has investigated claims WhatsApp chats aren't private

#249

Post by singpolyma3 »

TZubiri wrote: post #231
coppsilgold wrote: post #227

No closed-source E2EE client can be truly secure because the ends of e2e are opaque. Detecting backdoors is only truly feasible with open source software and even then it can difficult. A backdoor can be a subtle remote code execution "vulnerability" that can only be exploited by the server. If used carefully and it exfiltrates data in expected client-server communications it can be all but impossible to detect. This…

With all due respect to Stallman, you can actually study binaries. The claim Stallman would make (after punishing you for using Open Source instead of Free Software for an hour) is that Closed Software (Proprietary Software) is unjust. but in the context of security, the claim would be limited to Free Software being capable of being secure too. You may be able to argue that Open Source reduces risk in threat models w…

I was with you until you somehow claimed obfuscation can improve security, against all historical evidence even pre-computers.

Re: US has investigated claims WhatsApp chats aren't private

#250

Post by IcyWindows »

gruez wrote: post #84
cosmicgadget wrote: post #32

> “We look forward to moving forward with those claims and note WhatsApp’s denials have all been carefully worded in a way that stops short of denying the central allegation in the complaint – that Meta has the ability to read WhatsApp messages, regardless of its claims about end-to-end encryption.” My money is on the chats being end to end encrypted and separately uploaded to Facebook.

>being end to end encrypted and separately uploaded to Facebook That's a cute loophole you thought up, but whatsapp's marketing is pretty unequivocal that they can't read your messages. >With end-to-end encryption on WhatsApp, your personal messages and calls are secured with a lock. Only you and the person you're talking to can read or listen to them, and no one else, not even WhatsApp https://www.whatsapp.com/ That…

I'm not saying they are sending the content back, but WhatsApp has to read your message or it couldn't display it, so I don't even know exactly what that particular claim means?

They most likely mean their service or their employees, but this appears to be marketing fluff and not an enforceable statement.

Post reply on HN