12 ms·

Well, I kind of feel that I have to repost my comment on this old thread[1] with regards to the government of Egypt blocking Signal application: "Isn't it "wei

by niksakl 10y ago

Well, I kind of feel that I have to repost my comment on this old thread[1] with regards to the government of Egypt blocking Signal application: "Isn't it "weird" that they chose to block Signal app and not the signal-protocol based Whatsapp? If Whatsapp really implements the same kind of security and privacy measures that Signal does, why is Whatsapp allowed to continue operating? If signal is preventing them spy on users and they ban it, is in't it safe to assume that Whatsapp is NOT preventing them spy on users, so they let it operate? Wouldn't you expect Whatsapp to be also targeted, especially considering the broad user-base it has compared to Signal? Yes, I know they had blocked Whatsapp in the past, but they didn't block it now. Which means that something has changed in the relationship of the Egyptian gov and Whatsapp since 2015." 1. https://news.ycombinator.com/item?id=13219304 https://news.ycombinator.com/item?id=13219304

skrebbel 10y ago
This is a nice idea, but it's also baseless speculation. You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor whenever they want to (for those who haven't actually read the article: this backdoor only works when WhatsApp issues a key change for a conversation, and only then in certain circumstances). In other words, you imply that Egypt said "Hey WhatsApp, please actively hack into your Egyptian users' messages and send us the results" and WhatsApp said "ok sure here ya go". It might be true, but Zuckerberg might be a FSB informant and I might be Elvis reincarnate. These are all baseless, yet not entirely implausible claims.
- niksakl 10y ago
  Of course it is only speculation, but this is my argument: https://news.ycombinator.com/item?id=13390564 https://news.ycombinator.com/item?id=13390564
- jMyles 10y ago
  It is speculation, but it is far from baseless. Not all speculation is inappropriate; sometimes it is the seed from which a correct conclusion ultimately grows.
- tripzilch 10y ago
  well it's only baseless speculation if you can provide at least one plausible alternative so we can say, "we don't know which is true". niksakl's point is that the go-to "probably nothing going on" or the other "WhatsApp too popular to block so we block Signal instead" explanations are just not plausible at all. So I don't think it's entirely baseless, and with this new information, even less so. And Egypt making such a deal with a large company, you make it sound like you believe that's implausible, but this has in fact happened before: When Egypt hired Nokia and Siemens to develop, build and implement their DPI infrastructure. Later claiming "gosh we never expected they'd actually use this to hunt down, torture and kill dissidents". Maybe governments aren't that naive, but corporations surely will try and claim to be.
- Jare 10y ago
  > You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor It doesn't have to be THIS particular backdoor. "Why build one when you can build two at twice the price? Only, this [second] one can be kept secret."
- seppin 10y ago
  > You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor whenever they want to (for those who haven't actually read the article: this backdoor only works when WhatsApp issues a key change for a conversation, and only then in certain circumstances). In other words, you imply that Egypt said "Hey WhatsApp, please actively hack into your Egyptian users' messages and send us the results" and WhatsApp said "ok sure here ya go". No, the private hackers Govs hire were able to use an exploit to snoop on Whatsapp. That's very probable.
  - jyrkesh 10y ago
    Yeah, but that's not how the exploit would work. If you read the article, the "backdoor" is that WhatsApp could "generate" a new private key without your knowledge. Except that instead of generating a key, they'd use a well-known key. From there, they could give that key to state actors, or they could decrypt the traffic themselves and give it to state actors. Either way, you need server side control of WhatsApp.
    - swegg 10y ago
      Which you could get by hacking WhatsApp endpoints.
      - ameister14 10y ago
        Is there any evidence that this happened?
nothrabannosir 10y ago
Good point, but there is an explanation: blocking WhatsApp would lead to more intense backlash. See what happened in Brazil. Not to say it isn't both, but the price of blocking (one of) the most popular messaging apps is higher to a government than blocking one in the low low percentiles of usage.
- niksakl 10y ago
  What you say makes blocking Signal pointless. If they blocked Signal just because it was less of a trouble to block compared to WhatsApp, then all the people that were on Signal will easily switch to WhatsApp... What you have at this point, is a government paying the price of blocking a less popular messaging app they cannot control, while the people they are after can just switch to a MASSIVELY used messaging app the gov can also not control and additionally, is too expensive to block. If this was the case,it would actually work against the gov. Do not underestimate gov authorities, they are not THAT naive. If they had not blocked Signal at all, they could at least track Signal users and at least have that information: that this small group of people (Signal users), contains the group of people they are after. They could have their honey pot there. Mixing the "dangerous" Signal userbase with the chaotic massive userbase of WhatsApp makes no sense, unless you really have WhatsApp on your side. I hope you understand what I am trying to say. edit: rephrasing
  - JamisonM 10y ago
    I wouldn't overestimate government authorities either. A report on a person of interest crosses the desk of a deputy minister that says the person uses Signal could be enough to get the application blocked in the country. Elected officials and political appointees demand action on things that are counter to their interests all the time, the people that execute those orders (if they appreciate that the order is counter-productive in the first place) have to decide what measures are worth fighting and which ones are not.
- EGreg 10y ago
  Can you make an unblockable app?
nikcub 10y ago
There's a cost/benefit tradeoff to blocking each service and different governments have different thresholds. It is more likely that the cost of blocking Signal was negligible in contrast to the benefit, while blocking WhatsApp would likely have huge cost - especially in a country that has only recently experienced a number of citizen-driven coupés. It is also possible that they're specifically targeting a group (Muslim Brotherhood, or Jund al Islam and other Sinai insurgency groups) that utilize Signal.
- niksakl 10y ago
  this https://news.ycombinator.com/item?id=13390564 https://news.ycombinator.com/item?id=13390564
MrsPeaches 10y ago
Simple explanation would be that activists use Signal. [1] They don't trust WhatsApp and rely on Signal for secure messaging. Blocking Signal means they are able to target activists without impacting much of the rest of the population. [1] Many of the people I know who are activists in countries where they need to protect their identities use Signal
- admax88q 10y ago
  I wouldn't trust whatsapp even before this revelation. I would never trust a closed source messaging app if I was an activist, regardless of what encryption they claim to implement.
  - afshinmeh 10y ago
    Good point. At least as a technical person, I would like to use an open-source messaging application. Of course I'm not going to read the source code but at least I'm sure developers behind the app do not open a backdoor for someone else.
    - seangrogg 10y ago
      While I'm totally the same in this regard, this does feel a bit like an open-source version of the bystander effect.
      - OJFord 10y ago
        I don't know what the bystander effect is, but I assume we're taking about the same thing: I often feel that everyone is, along with myself, thinking "great - open source! I'm sure someone's checking it." Of course, the counter is that if you publish it you don't risk that someone actually is checking. Open beats closed, but we must be careful not to think it immediately makes the code sound. I've been thinking about this particularly recently in relation to Monzo, the will-be bank. There's no web app and slow progress on the android front. Lots of open source effort though, since they publish an API, but... That's my bank account I'm (not) giving open source developers access to.
eternalban 10y ago
Possibly answers your question: https://news.ycombinator.com/item?id=13234211 https://news.ycombinator.com/item?id=13234211
burntwater 10y ago
To add to those who have referenced the cost to the government: consider who else uses WhatsApp besides just activists - it's likely many government employees use WhatsApp as well. Anecdotal tidbit: I worked at the Rio 2016 Olympics. My team consisted of Brazilians, Americans, Britons, and Koreans. WhatsApp was how we communicated[1], I'm sure the same was true for most of the other thousands of people working setup for the Olympics. When a power-hungry judge forced WhatsApp to be blocked a couple weeks before the opening ceremonies, it was rather problematic for the Olympics staff. My first thought was "uhhh. This isn't going to last for long," and it didn't. I can't say for sure that it's because the IOC president called up the Brazilian president, and the Brazilian president yelled at the judge, but I like to think that's what happened. [1] Integrated language translation would be a FANTASTIC feature to add.
IvarTheHomeless 10y ago
There was a different commenter, possibly in a different HN thread, who was explaining that as an Egyptian resident he thought the government was blocking things like Whatsapp and Signal to protect one of the non government employers in Egypt, the telecommunications industry, which makes money from charging for phone calls and sms messages.

by niksakl 10y ago

skrebbel 10y ago

This is a nice idea, but it's also baseless speculation. You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor whenever they want to (for those who haven't actually read the article: this backdoor only works when WhatsApp issues a key change for a conversation, and only then in certain circumstances). In other words, you imply that Egypt said "Hey WhatsApp, please actively hack into your Egyptian users' messages and send us the results" and WhatsApp said "ok sure here ya go". It might be true, but Zuckerberg might be a FSB informant and I might be Elvis reincarnate. These are all baseless, yet not entirely implausible claims.

niksakl 10y ago
Of course it is only speculation, but this is my argument: https://news.ycombinator.com/item?id=13390564 https://news.ycombinator.com/item?id=13390564
jMyles 10y ago
It is speculation, but it is far from baseless. Not all speculation is inappropriate; sometimes it is the seed from which a correct conclusion ultimately grows.
tripzilch 10y ago
well it's only baseless speculation if you can provide at least one plausible alternative so we can say, "we don't know which is true". niksakl's point is that the go-to "probably nothing going on" or the other "WhatsApp too popular to block so we block Signal instead" explanations are just not plausible at all. So I don't think it's entirely baseless, and with this new information, even less so. And Egypt making such a deal with a large company, you make it sound like you believe that's implausible, but this has in fact happened before: When Egypt hired Nokia and Siemens to develop, build and implement their DPI infrastructure. Later claiming "gosh we never expected they'd actually use this to hunt down, torture and kill dissidents". Maybe governments aren't that naive, but corporations surely will try and claim to be.
Jare 10y ago
> You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor It doesn't have to be THIS particular backdoor. "Why build one when you can build two at twice the price? Only, this [second] one can be kept secret."
seppin 10y ago
> You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor whenever they want to (for those who haven't actually read the article: this backdoor only works when WhatsApp issues a key change for a conversation, and only then in certain circumstances). In other words, you imply that Egypt said "Hey WhatsApp, please actively hack into your Egyptian users' messages and send us the results" and WhatsApp said "ok sure here ya go". No, the private hackers Govs hire were able to use an exploit to snoop on Whatsapp. That's very probable.
- jyrkesh 10y ago
  Yeah, but that's not how the exploit would work. If you read the article, the "backdoor" is that WhatsApp could "generate" a new private key without your knowledge. Except that instead of generating a key, they'd use a well-known key. From there, they could give that key to state actors, or they could decrypt the traffic themselves and give it to state actors. Either way, you need server side control of WhatsApp.
  - swegg 10y ago
    Which you could get by hacking WhatsApp endpoints.
    - ameister14 10y ago
      Is there any evidence that this happened?

nothrabannosir 10y ago

Good point, but there is an explanation: blocking WhatsApp would lead to more intense backlash. See what happened in Brazil. Not to say it isn't both, but the price of blocking (one of) the most popular messaging apps is higher to a government than blocking one in the low low percentiles of usage.

niksakl 10y ago
What you say makes blocking Signal pointless. If they blocked Signal just because it was less of a trouble to block compared to WhatsApp, then all the people that were on Signal will easily switch to WhatsApp... What you have at this point, is a government paying the price of blocking a less popular messaging app they cannot control, while the people they are after can just switch to a MASSIVELY used messaging app the gov can also not control and additionally, is too expensive to block. If this was the case,it would actually work against the gov. Do not underestimate gov authorities, they are not THAT naive. If they had not blocked Signal at all, they could at least track Signal users and at least have that information: that this small group of people (Signal users), contains the group of people they are after. They could have their honey pot there. Mixing the "dangerous" Signal userbase with the chaotic massive userbase of WhatsApp makes no sense, unless you really have WhatsApp on your side. I hope you understand what I am trying to say. edit: rephrasing
- JamisonM 10y ago
  I wouldn't overestimate government authorities either. A report on a person of interest crosses the desk of a deputy minister that says the person uses Signal could be enough to get the application blocked in the country. Elected officials and political appointees demand action on things that are counter to their interests all the time, the people that execute those orders (if they appreciate that the order is counter-productive in the first place) have to decide what measures are worth fighting and which ones are not.
EGreg 10y ago
Can you make an unblockable app?

nikcub 10y ago

There's a cost/benefit tradeoff to blocking each service and different governments have different thresholds. It is more likely that the cost of blocking Signal was negligible in contrast to the benefit, while blocking WhatsApp would likely have huge cost - especially in a country that has only recently experienced a number of citizen-driven coupés. It is also possible that they're specifically targeting a group (Muslim Brotherhood, or Jund al Islam and other Sinai insurgency groups) that utilize Signal.

niksakl 10y ago
this https://news.ycombinator.com/item?id=13390564 https://news.ycombinator.com/item?id=13390564

MrsPeaches 10y ago

Simple explanation would be that activists use Signal. [1] They don't trust WhatsApp and rely on Signal for secure messaging. Blocking Signal means they are able to target activists without impacting much of the rest of the population. [1] Many of the people I know who are activists in countries where they need to protect their identities use Signal

admax88q 10y ago
I wouldn't trust whatsapp even before this revelation. I would never trust a closed source messaging app if I was an activist, regardless of what encryption they claim to implement.
- afshinmeh 10y ago
  Good point. At least as a technical person, I would like to use an open-source messaging application. Of course I'm not going to read the source code but at least I'm sure developers behind the app do not open a backdoor for someone else.
  - seangrogg 10y ago
    While I'm totally the same in this regard, this does feel a bit like an open-source version of the bystander effect.
    - OJFord 10y ago
      I don't know what the bystander effect is, but I assume we're taking about the same thing: I often feel that everyone is, along with myself, thinking "great - open source! I'm sure someone's checking it." Of course, the counter is that if you publish it you don't risk that someone actually is checking. Open beats closed, but we must be careful not to think it immediately makes the code sound. I've been thinking about this particularly recently in relation to Monzo, the will-be bank. There's no web app and slow progress on the android front. Lots of open source effort though, since they publish an API, but... That's my bank account I'm (not) giving open source developers access to.

eternalban 10y ago

Possibly answers your question: https://news.ycombinator.com/item?id=13234211 https://news.ycombinator.com/item?id=13234211

burntwater 10y ago

To add to those who have referenced the cost to the government: consider who else uses WhatsApp besides just activists - it's likely many government employees use WhatsApp as well. Anecdotal tidbit: I worked at the Rio 2016 Olympics. My team consisted of Brazilians, Americans, Britons, and Koreans. WhatsApp was how we communicated[1], I'm sure the same was true for most of the other thousands of people working setup for the Olympics. When a power-hungry judge forced WhatsApp to be blocked a couple weeks before the opening ceremonies, it was rather problematic for the Olympics staff. My first thought was "uhhh. This isn't going to last for long," and it didn't. I can't say for sure that it's because the IOC president called up the Brazilian president, and the Brazilian president yelled at the judge, but I like to think that's what happened. [1] Integrated language translation would be a FANTASTIC feature to add.

IvarTheHomeless 10y ago

There was a different commenter, possibly in a different HN thread, who was explaining that as an Egyptian resident he thought the government was blocking things like Whatsapp and Signal to protect one of the non government employers in Egypt, the telecommunications industry, which makes money from charging for phone calls and sms messages.