5 ms·

Why? Do you have any proof WhatsApp is insecure?

by toephu2 9y ago

ams6110 9y ago
I think the question should be do we have proof that it is secure?
- moosingin3space 9y ago
  Moxie Marlinspike's reputation is dependent on his ability to deliver a secure product. Signal/Signal Protocol development is funded by donations and grants from groups like the Freedom of the Press Foundation, EFF, etc, and those groups desire a secure messaging product. Moxie has staked his reputation on WhatsApp's implementation of the Signal Protocol multiple times on the OWS blog, which he would not do if he disapproved of WhatsApp's implementation. There's no hard proof (except what can be gained through analysis of the executables), but there's no incentive for Moxie to lie, therefore, WhatsApp's implementation should be reasonably secure.
  - vkazanov 9y ago
    And you call that a proof? :-)
    - moosingin3space 9y ago
      I did say "there's no hard proof". This was purely an analysis of incentives.
      - vkazanov 9y ago
        I think "speculation" is a better word here. :-)
snakeanus 9y ago
Yes https://news.ycombinator.com/item?id=13389935 https://news.ycombinator.com/item?id=13389935
- rspeer 9y ago
  That article is false. A large number of people in the security community have spoken out against that article, which had the effect of convincing people in dangerous situations to switch to less secure communication methods. "Security researchers call for Guardian to retract false WhatsApp backdoor story" [1] The Guardian claims they have offered to let Zeynep Tufekci write a rebuttal; according to Tufekci, they have repeatedly delayed and are not taking the offer they made seriously. If you have spread this misinformation in other places, you might want to follow up with the people you misled. [1] https://techcrunch.com/2017/01/20/security-researchers-call-for-guardian-to-retract-false-whatsapp-backdoor-story/ https://techcrunch.com/2017/01/20/security-researchers-call-...
  - snakeanus 9y ago
    There is absolutely nothing wrong with the article, claiming that it is FUD will not change the fact that WhatsApp can re-send messages encrypted with different keys at will (which makes it ABSOLUTELY USELESS for people who actually care about their privacy). The argument against the article seems to be around "we can trust whatsapp not to abuse their ability", which blows my mind. You should not have to trust anyone with cryptography. > WhatsApp does not give governments a “backdoor” into its systems and would fight any government request to create a backdoor The problem is that I have to take their word for that, while they have the ability to activate the backdoor at will. I linked to HN for a reason, so that people could see what other people think concerning the article. Here is the HN version of that opinion https://news.ycombinator.com/item?id=13394900 https://news.ycombinator.com/item?id=13394900 The misleading is that people are told that proprietary and centralised messaging services such as whatsapp can guarantee security - the truth is that they probably can't.
    - rspeer 9y ago
      I'm going to go out on a limb and say that Zeynep Tufekci knows more people who need crypto to survive than the average HN user, and understands their trust model better.
    - rspeer 9y ago
sandov 9y ago
As long as it's closed source, we have to assume that it's unsecure.
- fidget 9y ago
  Man, I've got some horrible news about your CPU.
  - was_boring 9y ago
    Sad, but true https://arstechnica.com/security/2013/12/we-cannot-trust-intel-and-vias-chip-based-crypto-freebsd-developers-say/ https://arstechnica.com/security/2013/12/we-cannot-trust-int...

Why? Do you have any proof WhatsApp is insecure?

ams6110 9y ago

I think the question should be do we have proof that it is secure?

moosingin3space 9y ago
Moxie Marlinspike's reputation is dependent on his ability to deliver a secure product. Signal/Signal Protocol development is funded by donations and grants from groups like the Freedom of the Press Foundation, EFF, etc, and those groups desire a secure messaging product. Moxie has staked his reputation on WhatsApp's implementation of the Signal Protocol multiple times on the OWS blog, which he would not do if he disapproved of WhatsApp's implementation. There's no hard proof (except what can be gained through analysis of the executables), but there's no incentive for Moxie to lie, therefore, WhatsApp's implementation should be reasonably secure.
- vkazanov 9y ago
  And you call that a proof? :-)
  - moosingin3space 9y ago
    I did say "there's no hard proof". This was purely an analysis of incentives.
    - vkazanov 9y ago
      I think "speculation" is a better word here. :-)

snakeanus 9y ago

Yes https://news.ycombinator.com/item?id=13389935 https://news.ycombinator.com/item?id=13389935

rspeer 9y ago
That article is false. A large number of people in the security community have spoken out against that article, which had the effect of convincing people in dangerous situations to switch to less secure communication methods. "Security researchers call for Guardian to retract false WhatsApp backdoor story" [1] The Guardian claims they have offered to let Zeynep Tufekci write a rebuttal; according to Tufekci, they have repeatedly delayed and are not taking the offer they made seriously. If you have spread this misinformation in other places, you might want to follow up with the people you misled. [1] https://techcrunch.com/2017/01/20/security-researchers-call-for-guardian-to-retract-false-whatsapp-backdoor-story/ https://techcrunch.com/2017/01/20/security-researchers-call-...
- snakeanus 9y ago
  There is absolutely nothing wrong with the article, claiming that it is FUD will not change the fact that WhatsApp can re-send messages encrypted with different keys at will (which makes it ABSOLUTELY USELESS for people who actually care about their privacy). The argument against the article seems to be around "we can trust whatsapp not to abuse their ability", which blows my mind. You should not have to trust anyone with cryptography. > WhatsApp does not give governments a “backdoor” into its systems and would fight any government request to create a backdoor The problem is that I have to take their word for that, while they have the ability to activate the backdoor at will. I linked to HN for a reason, so that people could see what other people think concerning the article. Here is the HN version of that opinion https://news.ycombinator.com/item?id=13394900 https://news.ycombinator.com/item?id=13394900 The misleading is that people are told that proprietary and centralised messaging services such as whatsapp can guarantee security - the truth is that they probably can't.
  - rspeer 9y ago
    I'm going to go out on a limb and say that Zeynep Tufekci knows more people who need crypto to survive than the average HN user, and understands their trust model better.
  - rspeer 9y ago

sandov 9y ago

As long as it's closed source, we have to assume that it's unsecure.

fidget 9y ago
Man, I've got some horrible news about your CPU.
- was_boring 9y ago
  Sad, but true https://arstechnica.com/security/2013/12/we-cannot-trust-intel-and-vias-chip-based-crypto-freebsd-developers-say/ https://arstechnica.com/security/2013/12/we-cannot-trust-int...