Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook, WhatsApp Will Have to Share Messages With U.K.?

bloomberg.com

Post reply on HN
Print view View original

561–570 of 591 posts

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#561

Post by commandersaki »

brenden2 wrote: post #77
londons_explore wrote: post #60

Earlier quoted context omitted.

The Whatsapp binary is sufficiently transparent to enable someone determined to write their own client. Thats enough info for an expert to verify their "messages are end to end encrypted and we don't know the key" claim. The fly in the ointment is the client might have additional functionality to leak the e2e encryption key. That is far harder to find, but if it's use were widespread, it would be found by researchers…

Yep, the chat log backup basically renders WhatsApp completely insecure. They also constantly nag you inside the app to enable it. This is how they caught Michael Cohen (and presumably others). Unfortunately Signal does it, too.

At least on iOS - whatsapp doesn't seem to nag about backups (i don't think i've ever enabled it), but you can do a local backup/restore if you replace handset. Signal encrypts your chats locally (but not binary blobs/video/images) but they cannot be backed up and restored locally.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#562

Post by londons_explore »

samsonradu wrote: post #494
londons_explore wrote: post #60

Earlier quoted context omitted.

The Whatsapp binary is sufficiently transparent to enable someone determined to write their own client. Thats enough info for an expert to verify their "messages are end to end encrypted and we don't know the key" claim. The fly in the ointment is the client might have additional functionality to leak the e2e encryption key. That is far harder to find, but if it's use were widespread, it would be found by researchers…

Having a 'secure' conversation definitely implies trust in Google/Apple, regardless of the Whatsapp binary behaving flawlessly (e2e encryption, solid PRNG, no logs etc.) They could indeed serve you a different binary from the app-store. "Do you think that's Whatsapp you're using?"

Trust in the OS made by Google/Apple is slightly different from trust in the ability of Google/Apple to keep your data stored on their servers secure against nation states.

I have much more trust in the former than the latter.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#563

Post by dbbk »

rdl wrote: post #424
wcathcart wrote: post #395

We were surprised to read this story and are not aware of discussions that would force us to change our product. We believe people have a fundamental right to have private conversations. End-to-end encryption protects that right for over a billion people every day. We will always oppose government attempts to build backdoors because they would weaken the security of everyone who uses WhatsApp including governments th…

If so, sounds like someone from FB Legal and the SEC should have Words with Bloomberg. Wouldn't be the first time they've intentionally maliciously misrepresented/lied about an infosec issue to the detriment of a company in order to move the market (Supermicro "grain of rice"...)

The reporting is accurate.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#564

Post by incompatible »

commandersaki wrote: post #559
incompatible wrote: post #525

Earlier quoted context omitted.

Unfortunately, the WhatsApp terms of service say you must not "reverse engineer, alter, modify, create derivative works from, decompile, or extract code from our Services"

In (at least) the US this wouldn't hold up in court if they went after you: https://cr.yp.to/softwarelaw.html . Of course if WhatsApp detected an abnormal or tampered version of the app, they can suspend or disable your account. I'm sure security labs that do reverse engineering of this sort probably do it on test handsets with burner numbers and identities so it wouldn't affect any personal accounts they use.

Perhaps, I just thought it was an odd thing for the head of WhatsApp to say: You don't have to take our word on this - just do this thing that we prohibit in our terms of service.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#565

Post by conanbatt »

ghayes wrote: post #548
conanbatt wrote: post #544

Earlier quoted context omitted.

Tactically, warrant canaries are dead-man switches. Conceptually, you can't compel someone to explicitly lie publicly.

But the FBI could advise the canary poster that not continuing to post the canary notice could lead to legal action (esp. since that person has willfully put him/herself into the situation). Then it would be up to the recipient of the NSL to decide if it’s worth that risk, which is as stated above, untested. It’s a fine line between telling them to lie versus telling them the ruse could be in violation of the gag ord…

Conceptually you can't because you can put as a citizen any requirement to make a canary that the law cant compel you to do. For example, you can pay to publish the canary: the state can't compel you to spend money on it. Or you can make a small petty crime with it (say, an IP Violation).

In places where there are limits to what the government can do to an with you, its possible to resist.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#566

Post by inimino »

paulddraper wrote: post #533
inimino wrote: post #511

Earlier quoted context omitted.

Which part of Adam Smith are you paraphrasing exactly? Have you read him?

> Which part of Adam Smith are you paraphrasing exactly? No one quote in particular; just a recurring theme. "It is not from the benevolence of the butcher, the brewer, or the baker, that we expect our dinner, but from their regard to their own interest" - The Wealth of Nations "The natural effort of every individual to better his own condition...is so powerful, that it is alone, and without any assistance, not only…

But also:

"The man of the most perfect virtue, the man whom we naturally love and revere the most, is he who joins, to the most perfect command of his own original and selfish feelings, the most exquisite sensibility both to the original and sympathetic feelings of others."

Self-interest, yes, but in a system regulated just as much by the church and the aristocracy as by the flow of capital. Pure monetary greed without regard for doing what is right is nothing Smith would ever have advocated.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#567

Post by soulofmischief »

conanbatt wrote: post #565
ghayes wrote: post #548

Earlier quoted context omitted.

But the FBI could advise the canary poster that not continuing to post the canary notice could lead to legal action (esp. since that person has willfully put him/herself into the situation). Then it would be up to the recipient of the NSL to decide if it’s worth that risk, which is as stated above, untested. It’s a fine line between telling them to lie versus telling them the ruse could be in violation of the gag ord…

Conceptually you can't because you can put as a citizen any requirement to make a canary that the law cant compel you to do. For example, you can pay to publish the canary: the state can't compel you to spend money on it. Or you can make a small petty crime with it (say, an IP Violation). In places where there are limits to what the government can do to an with you, its possible to resist.

Why are you arguing about what is conceptually possible? The reality is such that people can absolutely be compelled to lie in public, especially for "national security" means. It happens all the time. Failing to update could signal something, but continuing to update means nothing. "Resistance" and other such concepts don't hold up to scrutiny against shareholders and 40 year sentences.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#568

Post by soulofmischief »

nradov wrote: post #531
soulofmischief wrote: post #527

Earlier quoted context omitted.

If you can be compelled to be silent while breaking constitutional guidelines on the basis of national security, you can be compelled to update a beacon. Warrant canaries are nice to have, but viewing them as something which provides proof of absence of government meddling is incorrect.

Perhaps, but that legal theory has never been tested in US federal court (as far as we know). It's entirely possible that the judicial branch wouldn't allow the executive branch to force private citizens into actively making false statements.

Right. My whole point is that there are unknowns in the equation which render the proposition void.

Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?

#569

Post by anoncake »

martinbooth wrote: post #538
huhtenberg wrote: post #452

Earlier quoted context omitted.

> it's possible enough to tear through our binaries No, it's not "possible enough" and I strongly suspect you fully realize that. A backdoor doesn't need to be in a form of an IF statement or something comparably obvious and silly. It can be a weakly seeded PRNG that would allow a "determined party" to brute-force the key exchange in a reasonable time. That would take man-years to fish out from a binary, and that's w…

Distributing an altered binary to specific targets should be impossible as WhatsApp don't control the distribution, Apple and Google do. They would also have to be complicit too for a targeted attack to be feasible. By having to distribute the same binary to everyone it is much harder to conceal a backdoor

That doesn't help against attacks by US authorities. If they can make Facebook create a backdoor, they can make Apple and Google distribute it.

Signal has the same issue.

Post reply on HN