Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp's Signal Protocol integration is now complete

whispersystems.org

Post reply on HN
Print view View original

41–50 of 386 posts

Re: WhatsApp's Signal Protocol integration is now complete

#41

Post by schlowmo »

mike_hearn wrote: post #19
envy2 wrote: post #9

WhatsApp have published further details for users[1], as well as a technical whitepaper[2] explaining the implementation. There's also a blog post[3]. [1]: https://www.whatsapp.com/security/ [2]: https://www.whatsapp.com/security/WhatsApp-Security-Whitepap... [3]: https://blog.whatsapp.com/10000618/End-to-end-encryption

That last blog post is clearly written by Jan Koum, as it talks about his past in the Soviet Union. But his name doesn't appear anywhere on the blog post and if you didn't know that odd bit of trivia, it'd be completely confusing - who the heck is talking? Some random employee? They need to add the name and job title of the blog posts author to the bottom.

Neither is Open Whisper Systems or the signal protocol mentioned in this blog post, but maybe this would have been too much of advertisement for a competitor.

To be fair: whatsapp mentioned it at the other two links.

Re: WhatsApp's Signal Protocol integration is now complete

#42

Post by samueloph »

Great, now I really hope Telegram folks realise how much they already lost for not having open sourced their servers. Here in Brazil they've lost a huge amount of community power to Actor, which doesn't even have encryption.

Now, it's a shame Whatsapp doesn't have an open source client as well. As much as I appreciate encryption, it still looks like we're not going anywhere with a closed sourced program that is a pain in the arse to run on Linux.

Re: WhatsApp's Signal Protocol integration is now complete

#43

Post by jamesdwilson »

tptacek wrote: post #37
nnnnnn wrote: post #36

Without whatsapp being open source, how do we know for sure that Facebook is not somehow storing or reading our messages? As good as this sounds on paper, I hesitate to trust Facebook to transmit my data without wanting to peek a bit. I currently use both Whatsapp and Signal and will probably continue to do the same unless there is a way for users to verify Facebook doesn't keep a copy.

Closed source software isn't impenetrable. The idea that you need source code to evaluate security claims is mostly a meme from the 1990s.

how's that boot taste?

Re: WhatsApp's Signal Protocol integration is now complete

#44

Post by jamesdwilson »

mike_hearn wrote: post #27
humanrebar wrote: post #24

Earlier quoted context omitted.

> What's the next step? Is there any work on encrypting group chat sessions?

Please read the articles. It already says that those are encrypted, as well as voice calls. Apparently once everyone is upgraded, nothing will be unencrypted. Their white paper also describes the protocols used in quite a lot of detail.

no proof without open source

Re: WhatsApp's Signal Protocol integration is now complete

#45

Post by jamesdwilson »

mjs wrote: post #25

Is there any reasonable way to verify that end-to-end encryption is actually being used, and used correctly? From a user's point of view the app looks and works exactly the same as before, except for the addition of a QR code which could be doing anything.

i'm with you on this. claims of e2e encryption are easy to make and without open source, impossible to prove.

Re: WhatsApp's Signal Protocol integration is now complete

#47

Post by whyagaindavid »

robert_foss wrote: post #28

moxie: Does this mean that both Facebook and Signal servers are unable to see the plaintext? (I would assume so, but I would like to have it confirmed. From someone who actually knows what he's talking about.)

If he does not answer does it mean whatsapp or signal servers can see the message?

Re: WhatsApp's Signal Protocol integration is now complete

#48

Post by StavrosK »

mjs wrote: post #25

Is there any reasonable way to verify that end-to-end encryption is actually being used, and used correctly? From a user's point of view the app looks and works exactly the same as before, except for the addition of a QR code which could be doing anything.

What's more, my client says "You aren't secure because X needs to upgrade WhatsApp", but the other party is seeing "you are secure", complete with fingerprint and everything.

I wonder which of the two devices is lying.

Re: WhatsApp's Signal Protocol integration is now complete

#49

Post by owenversteeg »

This is insanely cool. For everyone (very rightfully) worried about the PATRIOT act, the NSA, etc., etc. this is absolutely huge.

One BILLION people just got their messages encrypted. Facebook was under no obligation to do this; for the vast majority of tech history the messages sent by 99% of people were very insecure, and when the tech giants responsible were asked their response was "ehh". This suddenly cuts into a huge portion of that. Pretty much everyone with a mobile phone in Europe or South America, as well as large parts of Asia, suddenly now has completely encrypted messages.

Kudos to Whatsapp for this fantastic move.

On a related note, if anyone is inspired by this announcement to start using encryption in other parts of their life, I have a handful of Keybase invites available (to bypass the 25k+ waiting list.) Keybase's security depends on lots of people tracking other people, so only ask for one if you'll track other people. I see too many people that make an account and nobody ever tracks them/they don't track anyone. My email's in my profile.

Post reply on HN