Earlier quoted context omitted.
Outlawing AES will be difficult since it is embedded into P CPUs.
That's assuming AES is safe.
AES implemented on CPUs and AES being safe are two different things.
Facebook, WhatsApp Will Have to Share Messages With U.K.?
581–590 of 591 posts
Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?
#582Earlier quoted context omitted.
> it's possible enough to tear through our binaries No, it's not "possible enough" and I strongly suspect you fully realize that. A backdoor doesn't need to be in a form of an IF statement or something comparably obvious and silly. It can be a weakly seeded PRNG that would allow a "determined party" to brute-force the key exchange in a reasonable time. That would take man-years to fish out from a binary, and that's w…
Distributing an altered binary to specific targets should be impossible as WhatsApp don't control the distribution, Apple and Google do. They would also have to be complicit too for a targeted attack to be feasible. By having to distribute the same binary to everyone it is much harder to conceal a backdoor
Are you sure that there's no way for whatsapp to download and execute some code which will lead to upload of protected information?
Simple example: I'm sure that whatsapp main window is webview. Imagine that application inserts some kind of resource (e.g. CSS) from whatsapp server. So now whatsapp server can serve slightly altered CSS which will leak secret data via custom fonts, etc and you won't be able to find that, unless you're intercepting all traffic and can decrypt it (and apps nowadays love to pin certificates).
This is imaginary attack, I have no idea whether whatsapp does that. But HTML is a powerful and dangerous beast, yet it's used a lot in applications for rich media.
Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?
#583Earlier quoted context omitted.
Conceptually you can't because you can put as a citizen any requirement to make a canary that the law cant compel you to do. For example, you can pay to publish the canary: the state can't compel you to spend money on it. Or you can make a small petty crime with it (say, an IP Violation). In places where there are limits to what the government can do to an with you, its possible to resist.
Why are you arguing about what is conceptually possible? The reality is such that people can absolutely be compelled to lie in public, especially for "national security" means. It happens all the time. Failing to update could signal something, but continuing to update means nothing. "Resistance" and other such concepts don't hold up to scrutiny against shareholders and 40 year sentences.
“Compelled Speech“ has been tested in the Supreme Court.
EX: https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of...
The US government can’t legally compel you to lie, but may restrict what you can say.
Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?
#584Earlier quoted context omitted.
If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everyt…
Your assumption how backdoors work is very limited/wrong, I am afraid. You assume that you actually understand the code well enough to identify the backdoor - e.g. as some sort of function that will bypass authentication when some secret hardwired password is provided (to give a dumb example). However, to give a real world example of backdoored crypto, it is nothing of the sort. For example, the issue with the potent…
Yes, it is theoretically possible to create backdoors that are hard or impossible to detect, if you start 20 years ago and subvert the standards used by the entire industry.
An improvement in security and privacy isn't limited to "make it impossible, even theoretically, for anything bad to ever happen OR you've accomplished nothing". Most back doors aren't inserted by competent NSA-level actors 20 years in advance. Most are "whenever a message passes through, send a copy to this third party". They are inserted by court order for a specific case due to the government becoming interested late in the game due to a specific case. For example, when terrorists start using some secure email service, the government tries to force the service to allow them to snoop on the relevant conversations. Open sourcing the code would allow you (with the help of the community) to detect these sorts of attempts when the product involves end-to-end encryption.
So while having the source and a community auditing changes to that source doesn't prevent every possible attack against your privacy, it prevents almost every one that is plausibly detectable, which is literally as good as you can do.
Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?
#585Earlier quoted context omitted.
I think you are the one not understanding at this point. This has nothing to do with "how encryption works". Whatsapp decided to go for E2E encryption for commercial and marketing purposes following all those privacy scandals. They did not have to. They could have gone with P2P encryption, i.e. that their databases could have stored messages in cleartext. That way authorities would not have needed to ask for any back…
Oh. I didn't realise you were arguing against encryption in its entirety. Okay. Let's just get rid of E2E entirely and let Facebook mine not only our metadata but also the content of our messages. Nice plan.
I am not arguing against encryption in its entirety...
> let Facebook mine not only our metadata...
Don't use Facebook, then.
Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?
#586Earlier quoted context omitted.
We do not. You don't have to take our word on this -- I wouldn't want you to. As others on this thread have pointed out it's possible enough to tear through our binaries that if we did have a backdoor it would be discovered.
> tear through our binaries That's explicitly against your terms of service.
We now have explicit, written authorization from the head of WhatsApp to reverse engineer ("tear through") the binaries. The ToS only prohibits unauthorized reverse engineering. I agree with you that it was disallowed prior to this comment, but I think it's OK now.
Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?
#587Earlier quoted context omitted.
What's buggy?
One example is that voice calls only ring on one side, sometimes (on the calling side). Another is that when some rooms get updated, you can get unread notices from the old room and your client keeps telling you that you have new messages even if you don't. Another thing that I think should be considered a bug, is that when you enable encryption in a room and you have multiple devices on the same account, you have to…
The encryption things are being worked on. Encryption is still in beta. I think riot fixed that problem with the unread notices. Have you reported the bug about calls only ringing on one side?
Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?
#588We were surprised to read this story and are not aware of discussions that would force us to change our product. We believe people have a fundamental right to have private conversations. End-to-end encryption protects that right for over a billion people every day. We will always oppose government attempts to build backdoors because they would weaken the security of everyone who uses WhatsApp including governments th…
[deleted]
Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?
#589We were surprised to read this story and are not aware of discussions that would force us to change our product. We believe people have a fundamental right to have private conversations. End-to-end encryption protects that right for over a billion people every day. We will always oppose government attempts to build backdoors because they would weaken the security of everyone who uses WhatsApp including governments th…
Keep the government out, we do not live in China. Priti Patel is trying to create a name for her self, using children as excuse
Re: Facebook, WhatsApp Will Have to Share Messages With U.K.?
#590Earlier quoted context omitted.
Sure, but the Signal source code is open source. I've been compiling it myself for years on Android (and signing the binary with my own key). They can't silently push a binary from the Play Store and overwrite my binary.
Dude, I can only imagine what you are doing that you need to be so secretive lol
I think "trust, but verify" and "verifiable security" are good axioms.