Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp's Signal Protocol integration is now complete

whispersystems.org

Post reply on HN
Print view View original

61–70 of 386 posts

Re: WhatsApp's Signal Protocol integration is now complete

#61

Post by tptacek »

jamesdwilson wrote: post #57
tptacek wrote: post #55

Earlier quoted context omitted.

I'm sorry, but that's not how computer software works. Anyone who knows what a basic block is can straightforwardly verify the claims WhatsApp is making.

you don't know how e2e security works, do you? without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.

Very angry open source advocate, I understand how frustrating it must be that the current safest mainstream messaging protocol is not open source, but once again: that's not how computer software works. WhatsApp isn't even obfuscated. There are tens of thousands of people who read "closed source" software as a hobby.

Later:

Also? That's not what the term "side channel" means.

Re: WhatsApp's Signal Protocol integration is now complete

#62

Post by jszymborski »

cft wrote: post #50

Looks like they feel threatened by Telegram growth, which means Telegram is doing quite well.

All they need to do to supplant Telegram (at the very least for my use-case) is to have a decent desktop app, preferably native. Their current web interface (is that still active?) is a UX nightmare. Of course it's "for the sake of encryption" but it comes at the cost of adoption.

Re: WhatsApp's Signal Protocol integration is now complete

#63

Post by tptacek »

wyager wrote: post #60
tptacek wrote: post #37

Earlier quoted context omitted.

Closed source software isn't impenetrable. The idea that you need source code to evaluate security claims is mostly a meme from the 1990s.

You don't need the source, but it makes it a hell of a lot easier.

Only if builds are fully reproducible, which is rarely true. Otherwise, the source can make it harder, by lying to you.

Re: WhatsApp's Signal Protocol integration is now complete

#64

Post by dest »

tptacek wrote: post #37
nnnnnn wrote: post #36

Without whatsapp being open source, how do we know for sure that Facebook is not somehow storing or reading our messages? As good as this sounds on paper, I hesitate to trust Facebook to transmit my data without wanting to peek a bit. I currently use both Whatsapp and Signal and will probably continue to do the same unless there is a way for users to verify Facebook doesn't keep a copy.

Closed source software isn't impenetrable. The idea that you need source code to evaluate security claims is mostly a meme from the 1990s.

Taking the example of Skype, the hardening/on-the-fly decryption techniques used in the binary made the reverse engineering very difficult [0]. Difficult to reliably audit such software. Don't know about Whatsapp though.

[0] http://www.oklabs.net/skype-reverse-engineering-the-long-jou...

Re: WhatsApp's Signal Protocol integration is now complete

#65

Post by StavrosK »

mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

> 12 words seems so much more friendly, at least to English speakers

I have a feeling that English speakers are the minority of WhatsApp users.

> if you don't speak a common language with your chat partner then the app is useless anyway

They do speak a common language, it's usually just not English.

Re: WhatsApp's Signal Protocol integration is now complete

#66

Post by jamesdwilson »

tptacek wrote: post #61
jamesdwilson wrote: post #57

Earlier quoted context omitted.

you don't know how e2e security works, do you? without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.

Very angry open source advocate, I understand how frustrating it must be that the current safest mainstream messaging protocol is not open source, but once again: that's not how computer software works. WhatsApp isn't even obfuscated. There are tens of thousands of people who read "closed source" software as a hobby . Later : Also? That's not what the term "side channel" means.

do you know even with source, backdoors can be hidden? open source is a must to even begin to work to verify any claims of security.

Re: WhatsApp's Signal Protocol integration is now complete

#68

Post by elasticdog »

martindevans wrote: post #29
mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

> It's a shame to see key words be killed off by internationalisation concerns [....] I hope further research here can develop better replacements for encoding short binary strings in i18n friendly ways I rather like the urbit way of encoding numbers. I can't remember the exact details but it's something like: There are 256 unique three letter words (all nonsense, but deliberately picked to be possible to pronounce).…

Still western-focused, but Oren Tirosh's mnemonic encoding [1] project is pretty close as well.

[1] http://web.archive.org/web/20090918202746/http://tothink.com...

Re: WhatsApp's Signal Protocol integration is now complete

#69

Post by pfg »

mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

I keep wondering if package managers (be it Google Play, apt or dnf) are in need of a solution like Certificate Transparency. Like Certificate Transparency, it would not necessarily prevent a backdoor(/certificate) from being pushed to selected users, but it would guarantee detectability, at least after the fact. If the package as a whole is included in the log, it would also allow BinDiff-style reverse engineering of any backdoor. Application developers could scan the log for unauthorized builds of their software (i.e. key compromises), and I imagine there are some things you can do with gossip protocols for end-users as well (i.e.: how popular is this build? Am I the only one running it?).

This would solve part of the trust issue both for proprietary and open source software (I mean, who's actually using or verifying reproducible builds?). It would also be a huge problem for intelligence agencies or other adversaries who want to do this undetected.

Post reply on HN