4 ms·

You can't prove whether or not it was intentional. Marketing speak can spin this as a convenience for the user. It's still a backdoor until they fix this. I do

by feld 10y ago

You can't prove whether or not it was intentional. Marketing speak can spin this as a convenience for the user. It's still a backdoor until they fix this. I don't believe Moxie has the actual insight into Facebook's true intentions with the Whatsapp platform. He may believe their intentions are honest, but he's just a cog in their wheel. If he honestly believed Whatsapp was sufficiently secure why would he bother with Signal?

FabHK 10y ago
It was intentional, they've thought about it. Yes, of course it is clearly less secure than Signal. It's an UI tradeoff given the reality that the vast majority of the billion+ WhatsApp users will not verify key fingerprints ("security number", I believe, in Signal speak) out of band. Again, let me quote Moxie from the other thread: "Given that reality, the most important thing is to design your product so that the server has no knowledge of who has verified keys or who has enabled a setting to see key change notifications. That way the server has no knowledge of who it can MITM without getting caught. I've been impressed with the level of care that WhatsApp has given to that requirement." https://news.ycombinator.com/item?id=13394900 https://news.ycombinator.com/item?id=13394900 The point is, if you need the extra security, use Signal, Threema. But if you want to get good crypto in the hands of billions, make it simple and invisible. That's what they've aimed for, and achieved.
nodesocket 10y ago
Well perhaps it was just a bug or edge-case, and WhatsApp is just "spinning" it as convenience. We could go back and forth all day. Immediately jumping to backdoor and malicious intent for use by the Government is disingenuous and we don't know that to be factual. Yet the media and this YouTuber seems to be distributing that very message.
- feld 10y ago
  You seem to attribute backdoor with malicious intent. Step back for a minute and consider the power of PR spin.

by feld 10y ago

FabHK 10y ago

It was intentional, they've thought about it. Yes, of course it is clearly less secure than Signal. It's an UI tradeoff given the reality that the vast majority of the billion+ WhatsApp users will not verify key fingerprints ("security number", I believe, in Signal speak) out of band. Again, let me quote Moxie from the other thread: "Given that reality, the most important thing is to design your product so that the server has no knowledge of who has verified keys or who has enabled a setting to see key change notifications. That way the server has no knowledge of who it can MITM without getting caught. I've been impressed with the level of care that WhatsApp has given to that requirement." https://news.ycombinator.com/item?id=13394900 https://news.ycombinator.com/item?id=13394900 The point is, if you need the extra security, use Signal, Threema. But if you want to get good crypto in the hands of billions, make it simple and invisible. That's what they've aimed for, and achieved.

nodesocket 10y ago

Well perhaps it was just a bug or edge-case, and WhatsApp is just "spinning" it as convenience. We could go back and forth all day. Immediately jumping to backdoor and malicious intent for use by the Government is disingenuous and we don't know that to be factual. Yet the media and this YouTuber seems to be distributing that very message.

feld 10y ago
You seem to attribute backdoor with malicious intent. Step back for a minute and consider the power of PR spin.