4 ms·

6 months isn't just "a lot of time". 6 months is "let's wait until everyone completely forgets about this and hope we can slide the apology under the radar".

deleted 9y ago
[deleted]
egeozcan 9y ago
I feel that it took long because the security "issue" is not discussed on technical merits anymore. The technical side of the study is very well understood by practically anyone. People have different type of opinions on the matter not because they misinterpret the technical details but because they have different expectations on how the privacy situation will end up being for different groups in the light of this knowledge. So all of this makes it way harder to define if the story was overblown or not. Apparently Guardian editors ended up thinking that it was indeed, after giving it a long consideration. This is not a technical fact (and it cannot be), it is just their interpretation of it (and also the interpretation of many security experts but that's not the point).
- willstrafach 9y ago
  Could you explain why you believe this is about opinions and interpretations, not the technical facts? I disagree with that assertion, but would really be interested to know if there is something I am missing.
  - egeozcan 9y ago
    Because technically a "flaw" in the system, however impractical to be exploited, did exist and it would be correct to point to that fact. Discussion of if this reaction is overblown and if it would direct users to more dangerous methods of communication is where it stops being technical. It could be that I am the one who is missing something. That's why we are discussing here, right? :)
    - willstrafach 9y ago
      Sure, but I think you might be missing an important aspect. The system is designed to not block communications upon key changes, just display an alert so the other user knows (And can verify out of band if they are about to discuss a sensitive topic). The initial "vulnerability" seemed to just be based on an opinion that it would be more secure if it did indeed block communications (until manual verification was performed) upon key changes. You are correct that it is impractical to "exploit" the chosen design, I think the bigger issue their portrayal of this as a vulnerability rather than a security suggestion.
      - egeozcan 9y ago
        If I'm not mistaken, they called this a "flaw", not a "vulnerability", which definitely wouldn't have been correct. I personally would have preferred "trade-off" but I'm honestly not sure about the word "flaw". My general point is, even if they made some technical errors as well, their consideration, I believe, was more about the consequences of their interpretation.
        idlewords 9y ago
        They called it a "backdoor", and reported it as a game-over vulnerability. Everything since then has been trying to walk the claim back.
        egeozcan 9y ago
        > They called it a "backdoor", and reported it as a game-over vulnerability. I didn't remember that and it seems to have been removed from the article (with a note on the end which I have missed). Well, that's just sensationalism and must have been picked up way earlier in a sane review process. I stand corrected.
        Trundle 9y ago
        "The original article – now amended and associated with the conclusions of this review – led to follow-up coverage, some of which sustained the wrong impression given at the outset. The most serious inaccuracy was a claim that WhatsApp had a “backdoor”, an intentional, secret way for third parties to read supposedly private messages. This claim was withdrawn within eight hours of initial publication online, but withdrawn incompletely. The story retained material predicated on the existence of a backdoor, including strongly expressed concerns about threats to freedom, betrayal of trust and benefits for governments which surveil. In effect, having dialled back the cause for alarm, the Guardian failed to dial back expressions of alarm." From this linked article.

deleted 9y ago

[deleted]

egeozcan 9y ago

I feel that it took long because the security "issue" is not discussed on technical merits anymore. The technical side of the study is very well understood by practically anyone. People have different type of opinions on the matter not because they misinterpret the technical details but because they have different expectations on how the privacy situation will end up being for different groups in the light of this knowledge. So all of this makes it way harder to define if the story was overblown or not. Apparently Guardian editors ended up thinking that it was indeed, after giving it a long consideration. This is not a technical fact (and it cannot be), it is just their interpretation of it (and also the interpretation of many security experts but that's not the point).

willstrafach 9y ago
Could you explain why you believe this is about opinions and interpretations, not the technical facts? I disagree with that assertion, but would really be interested to know if there is something I am missing.
- egeozcan 9y ago
  Because technically a "flaw" in the system, however impractical to be exploited, did exist and it would be correct to point to that fact. Discussion of if this reaction is overblown and if it would direct users to more dangerous methods of communication is where it stops being technical. It could be that I am the one who is missing something. That's why we are discussing here, right? :)
  - willstrafach 9y ago
    Sure, but I think you might be missing an important aspect. The system is designed to not block communications upon key changes, just display an alert so the other user knows (And can verify out of band if they are about to discuss a sensitive topic). The initial "vulnerability" seemed to just be based on an opinion that it would be more secure if it did indeed block communications (until manual verification was performed) upon key changes. You are correct that it is impractical to "exploit" the chosen design, I think the bigger issue their portrayal of this as a vulnerability rather than a security suggestion.
    - egeozcan 9y ago
      If I'm not mistaken, they called this a "flaw", not a "vulnerability", which definitely wouldn't have been correct. I personally would have preferred "trade-off" but I'm honestly not sure about the word "flaw". My general point is, even if they made some technical errors as well, their consideration, I believe, was more about the consequences of their interpretation.
      - idlewords 9y ago
        They called it a "backdoor", and reported it as a game-over vulnerability. Everything since then has been trying to walk the claim back.
        egeozcan 9y ago
        > They called it a "backdoor", and reported it as a game-over vulnerability. I didn't remember that and it seems to have been removed from the article (with a note on the end which I have missed). Well, that's just sensationalism and must have been picked up way earlier in a sane review process. I stand corrected.
        Trundle 9y ago
        "The original article – now amended and associated with the conclusions of this review – led to follow-up coverage, some of which sustained the wrong impression given at the outset. The most serious inaccuracy was a claim that WhatsApp had a “backdoor”, an intentional, secret way for third parties to read supposedly private messages. This claim was withdrawn within eight hours of initial publication online, but withdrawn incompletely. The story retained material predicated on the existence of a backdoor, including strongly expressed concerns about threats to freedom, betrayal of trust and benefits for governments which surveil. In effect, having dialled back the cause for alarm, the Guardian failed to dial back expressions of alarm." From this linked article.