5 ms·

Note that the Guardian has published multiple stories about this fake issue, and seems to be doubling down on its coverage: https://www.theguardian.com/technolo

Note that the Guardian has published multiple stories about this fake issue, and seems to be doubling down on its coverage: https://www.theguardian.com/technology/whatsapp https://www.theguardian.com/technology/whatsapp The list of names at the end of Zeynep's article is pretty much a who's who of people you don't want to be publicly called wrong by when reporting on security.

nullc 10y ago
This is not a fake issue.
- bascule 10y ago
  Neither was the Johnny Can't Encrypt issue. Now 1/7th of humanity is using E2E encryption. Making that happen involved some "security" vs usability tradeoffs (see my response here for the explanation of the scare quotes on security: https://news.ycombinator.com/item?id=13445337 https://news.ycombinator.com/item?id=13445337)
- deleted 10y ago
  [deleted]
- idlewords 10y ago
  Neither is the fact that vaccines can sometimes make you sick or kill you. But putting "VACCINES CAN KILL" as a headline in a mass-circulation paper would be just as wrong, and for the same reasons.
  - snowpanda 10y ago
    >But putting "VACCINES CAN KILL" as a headline in a mass-circulation paper would be just as wrong So you admit it's true, but it's wrong to write it as a headline? It's interesting to see people put their head in the sand regarding the Signal/Whatsapp security flaws.
    - tptacek 10y ago
      The people who signed this letter are the who's who of the study of cryptographic backdoors. What makes you believe you understand this subject better than they do?
      - aaron-lebo 10y ago
        You've repeated this sentiment several times (and I believe you are right), but isn't it an appeal to authority?
        maxerickson 10y ago
        There's nothing wrong with citing topical experts. The "appeal to authority" fallacy occurs when someone is cited outside their area of expertise or is not an expert.
        mynameisvlad 10y ago
        Yep, this exactly. Most books dealing with logic and fallacies now list it as "Appeal to unqualified authority" or similar.
        EGreg 10y ago
        I don't think the word "qualified" to qualify the word "authority" makes the appeal to auhority fallacy any truer. Most appeals to authority are actually to qualified authorities - the fallacy is neglecting to provide any reasoning behind the decision. In fact the authority may not have even intended their statement to indicate great certainty, or they may have been influenced by sociological phenomena. Qualified authorities in one century may be shown to be completely wrong. For example bloodletting, phlogiston, or even the age of the earth before radioactivity was discovered. Feynman talks about this... how the number stays close to the others until finally they jump to the right one. "A new scientific truth does not triumph by convincing its opponents and making them see the light, but rather because its opponents eventually die, and a new generation grows up that is familiar with it." - Max Planck
morganvachon 10y ago
A conspiracy theorist would say that it sounds like a hit piece, as if the Guardian has been nudged by some higher power to slander WhatsApp in an attempt to push their general readership to drop E2E encrypted messaging altogether, because the "more secure" options are too difficult or less popular. The Guardian in particular would be chosen because of its normally accurate and privacy-conscious coverage in the past; i.e. it has street cred among activists and others who wish to communicate securely and privately. A realist would, however, see this as a news outlet unable to own their mistake and instead doubling down as you said, in a failed attempt to save face. A journalist wrote this story seemingly by the seat of her pants, and her employer is on a noble if misguided campaign to defend her article. I'm taking the realist path on this one; I don't think there's any grand conspiracy behind their baffling decision to stand behind obviously shoddy reporting. The fact that so many top security researchers -- who certainly aren't going to be influenced by any particular government or corporate interest -- are calling for a retraction is all the assurance I need that the story is baseless and the Guardian is inexplicably enjoying the taste of shoe leather.
- idlewords 10y ago
  I take the realist path too, but if this kind of negligent disinformation succeeds, people who do want to discredit secure apps will notice and remember.
  - ABCLAW 10y ago
    Maciej, I have tremendous respect for you. What follows is a long post, so please don't feel like I am beating up on you - I am responding to a few things in this thread. --- This wasn't negligent disinformation (post-revision of the usage of 'backdoor') on the part of the Guardian. The reaction to the information presented on the part of the public - to switch to SMS in significant numbers - was irrational. That said, there is a productive issue raised by the Guardian that has been smoked out into the open, namely the revelation of two contradictory assumptions underlying the decision, as discussed by Moxie in the previous HN thread, to defend against state level snooping. The rationale goes a bit like this: 1 - People change keys in the regular course of using Whatsapp. It therefore needs to accept that without impeding usability. 2 - Most users do not care about security enough to prefer one service to another for the Whatsapp market segment - Those users use Signal or other offerings. 3 - Whatsapp's lack of 'post consent' resending is intentional, and designed to prevent the server from knowing who is monitoring the status of their keys. 4 - As such, Whatsapp effectively defends against dragnet surveillance! As security minded individuals will note inappropriate key changes once a MITM attack begins, confer, and determine they have been compromised at scale. The key flaw here is that 2 and 3 mean that for targeted surveillance, powerful attackers are unlikely to be uncovered while exfiltrating specific communications, and likely don't see very much reputational or legal risk to potentially triggering a key change event. So people are vulnerable to feasible, targeted message exfiltration, contrary to what they may have believed when E2E was rolled out. That's newsworthy. The fact that the security community is striking back makes me feel like they are circling the wagons now that the Guardian has caught them with their pants down - They should have been the ones raising these issues and providing the appropriate framing to protect the public.

nullc 10y ago

This is not a fake issue.

bascule 10y ago
Neither was the Johnny Can't Encrypt issue. Now 1/7th of humanity is using E2E encryption. Making that happen involved some "security" vs usability tradeoffs (see my response here for the explanation of the scare quotes on security: https://news.ycombinator.com/item?id=13445337 https://news.ycombinator.com/item?id=13445337)
deleted 10y ago
[deleted]
idlewords 10y ago
Neither is the fact that vaccines can sometimes make you sick or kill you. But putting "VACCINES CAN KILL" as a headline in a mass-circulation paper would be just as wrong, and for the same reasons.
- snowpanda 10y ago
  >But putting "VACCINES CAN KILL" as a headline in a mass-circulation paper would be just as wrong So you admit it's true, but it's wrong to write it as a headline? It's interesting to see people put their head in the sand regarding the Signal/Whatsapp security flaws.
  - tptacek 10y ago
    The people who signed this letter are the who's who of the study of cryptographic backdoors. What makes you believe you understand this subject better than they do?
    - aaron-lebo 10y ago
      You've repeated this sentiment several times (and I believe you are right), but isn't it an appeal to authority?
      - maxerickson 10y ago
        There's nothing wrong with citing topical experts. The "appeal to authority" fallacy occurs when someone is cited outside their area of expertise or is not an expert.
        mynameisvlad 10y ago
        Yep, this exactly. Most books dealing with logic and fallacies now list it as "Appeal to unqualified authority" or similar.
        EGreg 10y ago
        I don't think the word "qualified" to qualify the word "authority" makes the appeal to auhority fallacy any truer. Most appeals to authority are actually to qualified authorities - the fallacy is neglecting to provide any reasoning behind the decision. In fact the authority may not have even intended their statement to indicate great certainty, or they may have been influenced by sociological phenomena. Qualified authorities in one century may be shown to be completely wrong. For example bloodletting, phlogiston, or even the age of the earth before radioactivity was discovered. Feynman talks about this... how the number stays close to the others until finally they jump to the right one. "A new scientific truth does not triumph by convincing its opponents and making them see the light, but rather because its opponents eventually die, and a new generation grows up that is familiar with it." - Max Planck

morganvachon 10y ago

A conspiracy theorist would say that it sounds like a hit piece, as if the Guardian has been nudged by some higher power to slander WhatsApp in an attempt to push their general readership to drop E2E encrypted messaging altogether, because the "more secure" options are too difficult or less popular. The Guardian in particular would be chosen because of its normally accurate and privacy-conscious coverage in the past; i.e. it has street cred among activists and others who wish to communicate securely and privately. A realist would, however, see this as a news outlet unable to own their mistake and instead doubling down as you said, in a failed attempt to save face. A journalist wrote this story seemingly by the seat of her pants, and her employer is on a noble if misguided campaign to defend her article. I'm taking the realist path on this one; I don't think there's any grand conspiracy behind their baffling decision to stand behind obviously shoddy reporting. The fact that so many top security researchers -- who certainly aren't going to be influenced by any particular government or corporate interest -- are calling for a retraction is all the assurance I need that the story is baseless and the Guardian is inexplicably enjoying the taste of shoe leather.

idlewords 10y ago
I take the realist path too, but if this kind of negligent disinformation succeeds, people who do want to discredit secure apps will notice and remember.
- ABCLAW 10y ago
  Maciej, I have tremendous respect for you. What follows is a long post, so please don't feel like I am beating up on you - I am responding to a few things in this thread. --- This wasn't negligent disinformation (post-revision of the usage of 'backdoor') on the part of the Guardian. The reaction to the information presented on the part of the public - to switch to SMS in significant numbers - was irrational. That said, there is a productive issue raised by the Guardian that has been smoked out into the open, namely the revelation of two contradictory assumptions underlying the decision, as discussed by Moxie in the previous HN thread, to defend against state level snooping. The rationale goes a bit like this: 1 - People change keys in the regular course of using Whatsapp. It therefore needs to accept that without impeding usability. 2 - Most users do not care about security enough to prefer one service to another for the Whatsapp market segment - Those users use Signal or other offerings. 3 - Whatsapp's lack of 'post consent' resending is intentional, and designed to prevent the server from knowing who is monitoring the status of their keys. 4 - As such, Whatsapp effectively defends against dragnet surveillance! As security minded individuals will note inappropriate key changes once a MITM attack begins, confer, and determine they have been compromised at scale. The key flaw here is that 2 and 3 mean that for targeted surveillance, powerful attackers are unlikely to be uncovered while exfiltrating specific communications, and likely don't see very much reputational or legal risk to potentially triggering a key change event. So people are vulnerable to feasible, targeted message exfiltration, contrary to what they may have believed when E2E was rolled out. That's newsworthy. The fact that the security community is striking back makes me feel like they are circling the wagons now that the Guardian has caught them with their pants down - They should have been the ones raising these issues and providing the appropriate framing to protect the public.