4 ms·

That's not necessarily true. I haven't spent much time analyzing it yet, but your assertion seems seems. Please correct me if I'm mistaken, but can't you veri

by zxexz 11y ago

That's not necessarily true. I haven't spent much time analyzing it yet, but your assertion seems seems. Please correct me if I'm mistaken, but can't you verify end-to-end encryption without viewing the source of the program? They're using the Signal protocol, which has been well-vetted. What I've seen so far in Wireshark looks good, but I am not a crypto expert. I'm in the process of reading and trying to understand the whitepaper[0] now. I doubt OpenWhisperSystems would condone the use of WhatsApp without verifying the app uses e2e. [0] https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf https://www.whatsapp.com/security/WhatsApp-Security-Whitepap... EDIT: Spelling.

jamesdwilson 11y ago
without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.
- zxexz 11y ago
  You can definitely verify the code without the source. It may often be much harder, but it is not un-verifiable. Please stop spreading misinformation like this. With all the wonderful reverse-engingeering tools, dissassemblers, debuggers, etc. available, and the numerous massive communities that use them, it seems pretty out-there that you could seriously think such a thing...
  - jamesdwilson 11y ago
    skype is encrypted and backdoored. how can you know the same isn't true of whatsapp?
    - zxexz 11y ago
      People have verified that Skype is NOT secure[0]. Also Skype has not claimed to use end to end encryption. [0] https://www.eff.org/deeplinks/2014/11/scorecard-update-we-cannot-credit-skype-end-end-encryption https://www.eff.org/deeplinks/2014/11/scorecard-update-we-ca...
    - pfg 11y ago
      Obfuscation would be a better term here. They've made it hard to reverse-engineer, but certainly not impossible.
    - cortesoft 11y ago
      Well, people were able to figure out skype was not secure without the source.
  - AgentME 11y ago
    It's much easier to verify the source of a program once, and then verify the future changes to the source code with the aid of a diff. With a binary, a change can result in a very different binary that takes a lot of effort comparable to the original verification all over again.
- criddell 11y ago
  > without the source, it is not verifiable And would you also claim that without the source, you can't find security problems?

by zxexz 11y ago

jamesdwilson 11y ago

without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.

zxexz 11y ago
You can definitely verify the code without the source. It may often be much harder, but it is not un-verifiable. Please stop spreading misinformation like this. With all the wonderful reverse-engingeering tools, dissassemblers, debuggers, etc. available, and the numerous massive communities that use them, it seems pretty out-there that you could seriously think such a thing...
- jamesdwilson 11y ago
  skype is encrypted and backdoored. how can you know the same isn't true of whatsapp?
  - zxexz 11y ago
    People have verified that Skype is NOT secure[0]. Also Skype has not claimed to use end to end encryption. [0] https://www.eff.org/deeplinks/2014/11/scorecard-update-we-cannot-credit-skype-end-end-encryption https://www.eff.org/deeplinks/2014/11/scorecard-update-we-ca...
  - pfg 11y ago
    Obfuscation would be a better term here. They've made it hard to reverse-engineer, but certainly not impossible.
  - cortesoft 11y ago
    Well, people were able to figure out skype was not secure without the source.
- AgentME 11y ago
  It's much easier to verify the source of a program once, and then verify the future changes to the source code with the aid of a diff. With a binary, a change can result in a very different binary that takes a lot of effort comparable to the original verification all over again.
criddell 11y ago
> without the source, it is not verifiable And would you also claim that without the source, you can't find security problems?