41–50 of 222 posts
Earlier quoted context omitted.
“This looks like a backdoor but if I think really hard maybe I can consider it to be incompetence?” Neither is a good look for a security team, of course.
Yes, it's not, but my (and his) point stands: it's likely incompetence. It's very biased and uncharitable to immediately assume malice.
Earlier quoted context omitted.
WhatsApps cloud backup on Android sits on Google drive by default. It is encrypted with a per user key known to WhatsApp. That means for a third party to access the chats, they need Google to hand over the data, and Facebook to hand over the key. The logical next step to add would be for Google to additionally encrypt the data with the users logon password or something derived from it. Google won't do this anytime so…
I've posted this here before. > It is encrypted with a per user key known to WhatsApp. This is no longer true! For a few years now. The backup is stored on Google Drive in plain text. https://faq.whatsapp.com/android/chats/about-google-drive-ba...
Do you have a better cite or did you check directly recently?
Earlier quoted context omitted.
I think you’re completely missing the nuance in the words surrounding the authors mention of “Hanlon’s razor”. Besides, look at Pavel Durovs flagkilled reply here. The lady doth protest too much, methinks.
That's not saying anything of substance unless you offer your own interpretation. "You're wrong" is not a discussion, it's a kick in the gut. > The lady doth protest too much, methinks. Solid criticism with well laid-out arguments from you, no doubt. > Besides, look at Pavel Durovs flagkilled reply here. Since when do upvote / downvote count mean anything at all about somebody's opinion or statements? (I haven't read…
Maybe do that. Not being snarky, you’re missing important context.
Earlier quoted context omitted.
>(and his) point stands: it's likely incompetence That’s not what the post is saying. > It's very biased and uncharitable It’s not “very biased”, if you actually look at what Telegram did the balance of probabilities leans heavily towards “backdoor” and not “not backdoor”
So, give me your definition of Hanlon's Razor then (mentioned at the end of the article by the author).
It's amazing to me that people still consider Telegram a legitimate contender in choosing a messenger. This blog post is far too charitable.
And it's amazing to me that any Telegram coverage on HN is met with extremely hostile reactions. All they did was not invent the best encryption in the world... like you, me, and 99.9% of the world. Mortal sin, right? So please stick to facts and what can be reasonably proven, please. The rest is meaningless noise and mindless hate. The author himself admits it's much more likely this was an amateurish mistake than s…
You seem to be exposing a bias.
Earlier quoted context omitted.
Yes, it's not, but my (and his) point stands: it's likely incompetence. It's very biased and uncharitable to immediately assume malice.
s/likely/unlikely but possibly/
Unless you put concrete % numbers on both sides then your replace is identical with the original.
Earlier quoted context omitted.
>All they did was not invent the best encryption in the world. They shipped a backdoor. It's pretty clear that Telegram is actively malicious. They haven't been caught again? They probably realized that the front door of not encrypting chats was sufficient. >The author himself admits it's much more likely this was an amateurish mistake than some man-in-the-middle conspiracy This is not at all what the author is sayin…
> Anyway, it’s been a while, the world is a different place now, and maybe Hanlon’s razor cuts deeper than I thought. Unless you have another interpretation of the Hanlon's Razor, it seems that he is saying this is a mistake and not a backdoor. > They shipped a backdoor. Did they? Might be. I am 50/50 about it, people do dumb mistakes with self-rolled crypto all the time and that's a sad reality. But who knows, it mi…
Earlier quoted context omitted.
WhatsApps cloud backup on Android sits on Google drive by default. It is encrypted with a per user key known to WhatsApp. That means for a third party to access the chats, they need Google to hand over the data, and Facebook to hand over the key. The logical next step to add would be for Google to additionally encrypt the data with the users logon password or something derived from it. Google won't do this anytime so…
I've posted this here before. > It is encrypted with a per user key known to WhatsApp. This is no longer true! For a few years now. The backup is stored on Google Drive in plain text. https://faq.whatsapp.com/android/chats/about-google-drive-ba...
> Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive.
That makes sense, why would you re-encrypt the messages with the end-to-end-key which is individual for each chat, if you could simply use a symmetric encryption for backups?
So the statement
> It is encrypted with a per user key known to WhatsApp.
could still hold true, there's no information contrary to that in the FAQ (but no information indicating another kind of encryption either).
Earlier quoted context omitted.
For me, chat history has a huge value. How many times things looks like meaningless when they are said but have a lot of values at a later date? For example, sometimes you wonder, "when was it that time when XXX event happened". Or "I remember that one day someone told me that he had the same problem as me, but who was it and what was his solution?" Otherwise, we are used to share thousands of links and snippets with…
Sure, but wouldn't you want to have control over these backups yourself? Not only do you get increased privacy from it, you also won't be in for a nasty surprise when the service decides to remove old logs/stop doing business.
Earlier quoted context omitted.
I've posted this here before. > It is encrypted with a per user key known to WhatsApp. This is no longer true! For a few years now. The backup is stored on Google Drive in plain text. https://faq.whatsapp.com/android/chats/about-google-drive-ba...
That page doesn't say that, and "tied to the phone number" sounds like they will only give you the key if you can authenticate via SMS. Do you have a better cite or did you check directly recently?
It's now "authenticate via SMS and pin (if enabled), or authenticate via SMS and wait 7 days (if pin enabled)"