5 ms·

absolutely no proof it is e2e encrypted without the source.

tptacek 11y ago
I'm sorry, but that's not how computer software works. Anyone who knows what a basic block is can straightforwardly verify the claims WhatsApp is making.
- jamesdwilson 11y ago
  you don't know how e2e security works, do you? without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.
  - tptacek 11y ago
    Very angry open source advocate, I understand how frustrating it must be that the current safest mainstream messaging protocol is not open source, but once again: that's not how computer software works. WhatsApp isn't even obfuscated. There are tens of thousands of people who read "closed source" software as a hobby. Later: Also? That's not what the term "side channel" means.
    - jamesdwilson 11y ago
      do you know even with source, backdoors can be hidden? open source is a must to even begin to work to verify any claims of security.
      - tptacek 11y ago
        Your comment here is incoherent. I agree: source can easily lie. How does that make it the gold standard for verification? The reverse-engineering of the actual shipped binary (for instance, the ARM code lifted to LLVM) seems like a safer analysis target. But, what do I know.
        jamesdwilson 11y ago
        I actually in agreement with what you are saying about viewing the shipped binary, but source is a must also. ideally it is a reproducible build to verify the source created the binary.
        tptacek 11y ago
        You keep saying "source is a must" but you have yet to explain why that is the case.
        jamesdwilson 11y ago
        fair enough! https://www.schneier.com/blog/archives/2016/03/possible_govern.html https://www.schneier.com/blog/archives/2016/03/possible_gove... i think this is why source is a must. if a user compiled and installed the app themselves, and hypothetically had the entire stack above it be similarly open, then it would prevent the kind of attack mentioned. do you agree? if the source is closed anywhere in the stack, or pushed out in a walled garden as it is currently, then it allows the vulnerability mentioned.
        swombat 11y ago
        Just in case you don't know, tptacek is a world-class security/cryptography expert who happens to hang around and share his wisdom here. You appear to be assuming he's someone thinking one or more levels lower than you. I think it would be smarter for you to assume that he fully understands your argument but is thinking one or more levels higher than you.
        jamesdwilson 11y ago
        agreed, i had no idea. i am humbled.
        tptacek 11y ago
      - crazy1van 11y ago
        > open source is a must to even begin to work to verify any claims of security. I think this is losing sight of what source code actually is. It's the easier to read and easier to edit way to define what a person wants the computer to do. But, it isn't actually the exact instructions the computer executes.
  - cortesoft 11y ago
    Yeah.... I am pretty sure he DOES know how e2e security works.
- dingo_bat 11y ago
  How would we go about verifying Whatsapp's claims? It seems to me that they can easily be lying and we have no way to check. Also, they can just make a client that simply copies the unencrypted text displayed on-screen and leaks it to wherever they want.
zxexz 11y ago
That's not necessarily true. I haven't spent much time analyzing it yet, but your assertion seems seems. Please correct me if I'm mistaken, but can't you verify end-to-end encryption without viewing the source of the program? They're using the Signal protocol, which has been well-vetted. What I've seen so far in Wireshark looks good, but I am not a crypto expert. I'm in the process of reading and trying to understand the whitepaper[0] now. I doubt OpenWhisperSystems would condone the use of WhatsApp without verifying the app uses e2e. [0] https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf https://www.whatsapp.com/security/WhatsApp-Security-Whitepap... EDIT: Spelling.
- jamesdwilson 11y ago
  without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.
  - zxexz 11y ago
    You can definitely verify the code without the source. It may often be much harder, but it is not un-verifiable. Please stop spreading misinformation like this. With all the wonderful reverse-engingeering tools, dissassemblers, debuggers, etc. available, and the numerous massive communities that use them, it seems pretty out-there that you could seriously think such a thing...
    - jamesdwilson 11y ago
      skype is encrypted and backdoored. how can you know the same isn't true of whatsapp?
      - zxexz 11y ago
        People have verified that Skype is NOT secure[0]. Also Skype has not claimed to use end to end encryption. [0] https://www.eff.org/deeplinks/2014/11/scorecard-update-we-cannot-credit-skype-end-end-encryption https://www.eff.org/deeplinks/2014/11/scorecard-update-we-ca...
drudru11 11y ago
That is not absolute. The binaries are the absolute truth.
dang 11y ago
We detached this subthread from https://news.ycombinator.com/item?id=11432031 https://news.ycombinator.com/item?id=11432031 and marked it off-topic.
nickik 11y ago
Can you stop spamming your comment into every single thread? If you have a smart comment post it at the top level. A smart comment would be a detailed analysis of the pros and cons of OpenSource in terms of verification. Your are barly more then a troll.

I'm sorry, but that's not how computer software works. Anyone who knows what a basic block is can straightforwardly verify the claims WhatsApp is making.

jamesdwilson 11y ago
you don't know how e2e security works, do you? without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.
- tptacek 11y ago
  Very angry open source advocate, I understand how frustrating it must be that the current safest mainstream messaging protocol is not open source, but once again: that's not how computer software works. WhatsApp isn't even obfuscated. There are tens of thousands of people who read "closed source" software as a hobby. Later: Also? That's not what the term "side channel" means.
  - jamesdwilson 11y ago
    do you know even with source, backdoors can be hidden? open source is a must to even begin to work to verify any claims of security.
    - tptacek 11y ago
      Your comment here is incoherent. I agree: source can easily lie. How does that make it the gold standard for verification? The reverse-engineering of the actual shipped binary (for instance, the ARM code lifted to LLVM) seems like a safer analysis target. But, what do I know.
      - jamesdwilson 11y ago
        I actually in agreement with what you are saying about viewing the shipped binary, but source is a must also. ideally it is a reproducible build to verify the source created the binary.
        tptacek 11y ago
        You keep saying "source is a must" but you have yet to explain why that is the case.
        jamesdwilson 11y ago
        fair enough! https://www.schneier.com/blog/archives/2016/03/possible_govern.html https://www.schneier.com/blog/archives/2016/03/possible_gove... i think this is why source is a must. if a user compiled and installed the app themselves, and hypothetically had the entire stack above it be similarly open, then it would prevent the kind of attack mentioned. do you agree? if the source is closed anywhere in the stack, or pushed out in a walled garden as it is currently, then it allows the vulnerability mentioned.
        swombat 11y ago
        Just in case you don't know, tptacek is a world-class security/cryptography expert who happens to hang around and share his wisdom here. You appear to be assuming he's someone thinking one or more levels lower than you. I think it would be smarter for you to assume that he fully understands your argument but is thinking one or more levels higher than you.
        jamesdwilson 11y ago
        agreed, i had no idea. i am humbled.
        tptacek 11y ago
    - crazy1van 11y ago
      > open source is a must to even begin to work to verify any claims of security. I think this is losing sight of what source code actually is. It's the easier to read and easier to edit way to define what a person wants the computer to do. But, it isn't actually the exact instructions the computer executes.
- cortesoft 11y ago
  Yeah.... I am pretty sure he DOES know how e2e security works.
dingo_bat 11y ago
How would we go about verifying Whatsapp's claims? It seems to me that they can easily be lying and we have no way to check. Also, they can just make a client that simply copies the unencrypted text displayed on-screen and leaks it to wherever they want.

zxexz 11y ago

That's not necessarily true. I haven't spent much time analyzing it yet, but your assertion seems seems. Please correct me if I'm mistaken, but can't you verify end-to-end encryption without viewing the source of the program? They're using the Signal protocol, which has been well-vetted. What I've seen so far in Wireshark looks good, but I am not a crypto expert. I'm in the process of reading and trying to understand the whitepaper[0] now. I doubt OpenWhisperSystems would condone the use of WhatsApp without verifying the app uses e2e. [0] https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf https://www.whatsapp.com/security/WhatsApp-Security-Whitepap... EDIT: Spelling.

jamesdwilson 11y ago
without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.
- zxexz 11y ago
  You can definitely verify the code without the source. It may often be much harder, but it is not un-verifiable. Please stop spreading misinformation like this. With all the wonderful reverse-engingeering tools, dissassemblers, debuggers, etc. available, and the numerous massive communities that use them, it seems pretty out-there that you could seriously think such a thing...
  - jamesdwilson 11y ago
    skype is encrypted and backdoored. how can you know the same isn't true of whatsapp?
    - zxexz 11y ago
      People have verified that Skype is NOT secure[0]. Also Skype has not claimed to use end to end encryption. [0] https://www.eff.org/deeplinks/2014/11/scorecard-update-we-cannot-credit-skype-end-end-encryption https://www.eff.org/deeplinks/2014/11/scorecard-update-we-ca...

drudru11 11y ago

That is not absolute. The binaries are the absolute truth.

dang 11y ago

We detached this subthread from https://news.ycombinator.com/item?id=11432031 https://news.ycombinator.com/item?id=11432031 and marked it off-topic.

nickik 11y ago

Can you stop spamming your comment into every single thread? If you have a smart comment post it at the top level. A smart comment would be a detailed analysis of the pros and cons of OpenSource in terms of verification. Your are barly more then a troll.