Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rust at Scale: An Added Layer of Security for WhatsApp

engineering.fb.com

Post reply on HN
Print view View original

91–100 of 151 posts

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#91

Post by harikb »

rvnx wrote: post #87
harikb wrote: post #80

Earlier quoted context omitted.

As a developer, I tried building an app that needs to use Whatsapp for communication. Unfortunately my phone number got blocked by the second test message. No Spam. Not marketing, just a test message to my own number. Along with it, they blocked my entire business, my LLC, and anything tied to it. I have been trying to get hold of anyone or anything at Whatsapp. I've spent 6 months trying to navigate the bureaucracy.…

Telegram API is easier to handle as far as I know if that can somehow help (in case you want live ChatGPT or notifications for yourself in a mobile chat)

I will look into it. But my user base is either WhatsApp or plain SMS text messaging.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#92

Post by moomoo11 »

londons_explore wrote: post #66

> over 3 billion people to message securely each and every day. Whatsapp is a chat application with 3 billion daily active users. For those of you in the US (where Whatsapp is seldom used), this is a fact worth remembering. If you want to build products for the rest of the world, you need to know how those users think and breathe - and for 3 billion of them, Whatsapp is how they talk.

Sure, but like with most things, maybe like 200 million max of them in NA/EU would actually bring in real money.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#93

Post by Capricorn2481 »

londons_explore wrote: post #66

> over 3 billion people to message securely each and every day. Whatsapp is a chat application with 3 billion daily active users. For those of you in the US (where Whatsapp is seldom used), this is a fact worth remembering. If you want to build products for the rest of the world, you need to know how those users think and breathe - and for 3 billion of them, Whatsapp is how they talk.

Doesn't this description describe Facebook itself? Should we make apps more like that as well? Because they could not be more polar opposite each other.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#94

Post by antonvs »

londons_explore wrote: post #72
antonvs wrote: post #59

Earlier quoted context omitted.

It's not entirely accurate to say "any party other than the sender and the intended receiver," since the messaging app running on the user's device can read the messages. Something like "any third party (other than the app vendor)" would be more accurate. Without actually analyze app behavior, it comes down to trusting that the vendor doesn't do anything nefarious.

One could imagine a design where even the app vendor is untrusted... You would send an encrypted chunk direct to the GPU, which would then decrypt and render the message text in some secure environment onto the screen. Neither the OS nor the application would know the contents of your message beyond "it's 500x700 pixels". Similar things are done for DRM video, and widevine level 1 or 2 haven't seen many breaches desp…

Oh it's definitely possible. The (dis)incentives tend to be strongly against such secure systems, though.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#95

Post by yandie »

rvnx wrote: post #87
harikb wrote: post #80

Earlier quoted context omitted.

As a developer, I tried building an app that needs to use Whatsapp for communication. Unfortunately my phone number got blocked by the second test message. No Spam. Not marketing, just a test message to my own number. Along with it, they blocked my entire business, my LLC, and anything tied to it. I have been trying to get hold of anyone or anything at Whatsapp. I've spent 6 months trying to navigate the bureaucracy.…

Telegram API is easier to handle as far as I know if that can somehow help (in case you want live ChatGPT or notifications for yourself in a mobile chat)

Yeah telegram is so easy to develop with - I was blown away. I was able to spin up a bot that checks for GE appointments with minimal effort.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#96

Post by riffraff »

embedding-shape wrote: post #86
01HNNWZ0MV43FF wrote: post #84

Earlier quoted context omitted.

Network effect is killer. "better" would include having more than 3 billion people already on it. Maybe the EU or China will crack down on it. A single company shouldn't decide who gets to talk to half the world. If that company is American they will not tolerate it for long. Personally DeltaChat is my new favorite Thing but it falls afoul of Zooko's Triangle - A WhatsApp number or POTS number is short because it's c…

> Network effect is killer. "better" would include having more than 3 billion people already on it. At one point people moved from something else to Whatsapp, and that happened before Whatsapp had 3 billion people on it. If it's good, early adopters will adopt it and want others to adopt it too, then it snowballs from there. It has happened before, and as long as new regulation doesn't solidify Whatsapp/FB in their p…

WhatsApp happened at a time when, in Europe, you paid for SMS.

WhatsApp allowed people to send SMS without paying, or rather, paying just once to buy the app, so it was instantly valuable if you just convinced your spouse or parents or a single friend to install it.

To overcome it now, you need a lot more effort (or rely on enshittification, which I'm sure will happen).

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#97

Post by mr_mitm »

rvnx wrote: post #64
antonvs wrote: post #59

Earlier quoted context omitted.

It's not entirely accurate to say "any party other than the sender and the intended receiver," since the messaging app running on the user's device can read the messages. Something like "any third party (other than the app vendor)" would be more accurate. Without actually analyze app behavior, it comes down to trusting that the vendor doesn't do anything nefarious.

As far as I remember, Google does the final signing of the APK, which is eventually the signature verified by the OS to verify if an update is valid or not. So Google can, if ordered or willing to help, create a new release track (e.g. experimental-do-not-deleted) and add specific e-mails to that track with the "improved" version. Nobody would be able to see that in real world, and you know what, if WhatsApp themselv…

Yes, the app could be compromised, or the OS, or the compiler of the app, or of the OS, or the OS of the compiler, or the CPU any of these things run on, etc. etc. None of that is relevant to the definition of E2EE.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#98

Post by embedding-shape »

riffraff wrote: post #96
embedding-shape wrote: post #86

Earlier quoted context omitted.

> Network effect is killer. "better" would include having more than 3 billion people already on it. At one point people moved from something else to Whatsapp, and that happened before Whatsapp had 3 billion people on it. If it's good, early adopters will adopt it and want others to adopt it too, then it snowballs from there. It has happened before, and as long as new regulation doesn't solidify Whatsapp/FB in their p…

WhatsApp happened at a time when, in Europe, you paid for SMS. WhatsApp allowed people to send SMS without paying, or rather, paying just once to buy the app, so it was instantly valuable if you just convinced your spouse or parents or a single friend to install it. To overcome it now, you need a lot more effort (or rely on enshittification, which I'm sure will happen).

No, before Whatsapp, people were mostly using Facebook messages, at least where I lived at the time.

And no one was paying per SMS at the time we were using SMS for communication, almost everyone I know were on monthly plans that gave you N text messages and N minutes of calls for static sum each month.

The first people I saw who started using whatsapp, was people who were communicating across the border, because even if you had a monthly plan, those didn't include international messages. Eventually we all converged on whatsapp because that's what outside family and relatives used anyways.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#99

Post by tremon »

jraph wrote: post #71
londons_explore wrote: post #66

> over 3 billion people to message securely each and every day. Whatsapp is a chat application with 3 billion daily active users. For those of you in the US (where Whatsapp is seldom used), this is a fact worth remembering. If you want to build products for the rest of the world, you need to know how those users think and breathe - and for 3 billion of them, Whatsapp is how they talk.

What one should do about this? I mean, beside working on lowering that number. (Asking as a European who quite stubbornly refuses to install it - there are dozens of us. Dozens!) Edit: please don't participate in making WhatsApp even more inescapable as it is today.

Advocate protocols over platforms. Have your government take an active interest in opening up closed communication systems and mandating third-party client access.

Re: Rust at Scale: An Added Layer of Security for WhatsApp

#100

Post by londons_explore »

rvnx wrote: post #89
londons_explore wrote: post #69

Earlier quoted context omitted.

I don't trust un-auditable client applications... If you want to assure me your e2e is secure, there must be at least two clients implemented by different people, with at least one of them opensource. Whatsapp used to have this, but lately they have cracked down on third party clients.

Even if they have, this doesn't prevent from turning on a feature flag, or push an experimental build to some users.

If there is a 2nd opensource client written by someone else, you would hope they would raise the alarm when asked to implement "feature flag 437 means send all the crypto keys to the server".
Post reply on HN