5 ms·

This entire conflict just seems completely absurd to me - why on earth are the 72 "experts" who signed the open letter so quick to trust WhatsApp without access

by eehee 9y ago

This entire conflict just seems completely absurd to me - why on earth are the 72 "experts" who signed the open letter so quick to trust WhatsApp without access to the source code?

eehee 9y ago
Thanks for not telling me what I'm missing, guys! Stay classy.
- cpach 9y ago
  This has been discussed at length on HN. See e.g. https://news.ycombinator.com/item?id=13382491 https://news.ycombinator.com/item?id=13382491
WillyOnWheels 9y ago
I doubt that would satisfy the anti Whatsapp crowd. It's impossible to know what binary Facebook/Whatsapp runs on their servers.
- idlewords 9y ago
  The point of end-to-end encryption is that it doesn't matter what they run on their servers.
g-clef 9y ago
The experts (no scare quotes needed, they really are experts) were commenting on the story's facts as presented. There was no need to read the source of whatsapp, as the facts as stated in the original article were overblown and based on fundamental misunderstandings of cryptography. The entire story was based on the question of "what do you do when someone you're communicating with using encryption changes keys?" Whatsapp chose to dynamically use the new key, rather than fail & force the user to verify the new key in some out-of-band way. This was described as a "backdoor" in the guardian story. That was simply false. Even calling it a vulnerability is a mis-understanding of how cryptography works and of the risk involved in that design decision.
- eehee 9y ago
  Thank you for actually replying instead of downvoting...and I'll admit, the scare quotes may have been a bit too much! That said, the open letter plainly states "WhatsApp effectively protects people against mass surveillance." How do they know? From this, and the entire tone of the letter, it looks to me like they're still implicitly trusting that WhatsApp does what it claims to do. I see absolutely no reason to do so, and am utterly baffled that top security experts do.
  - CiPHPerCoder 9y ago
    Most (if not all) people who signed that letter, myself included, are capable of reverse engineering and analyzing Android apps (i.e. WhatsApp). You don't need access to the source code to perform this analysis. Furthermore, if you can verify that the app does what it advertises, you don't need to trust their infrastructure. E2E takes care of that.
    - willstrafach 9y ago
      More emphasis should be put on this. Those who know how to reverse engineer apps already look at the code, regardless of source code availability. But posting some machine code to debunk the original story would not do much good, seeing as those who might be unsure would likely not know how to read assembly.
    - jolic 9y ago
      It's still not entirely accurate, or at least conclusive, that WhatsApp effectively protects people against mass surveillance. It might be that there's enough other sources, messages aren't that valuable in the first place or even that mass surveillance itself, between target surveillance and everyone being a public person, isn't that important to protect people against. I think it's much easier to conclude that WhatsApp protects peoples messages from leaking or being abused by providers and other "softer" merits.
      - CiPHPerCoder 9y ago
stefantalpalaru 9y ago
> This entire conflict just seems completely absurd to me - why on earth are the 72 "experts" who signed the open letter so quick to trust WhatsApp without access to the source code? It makes more sense when you notice that the open letter was written by a Turkish-American academic: http://technosociology.org/?page_id=1687 http://technosociology.org/?page_id=1687 Apparently, the only hope for a Turkish opposition is this religious leader with some sort of asylum in US: https://en.wikipedia.org/wiki/Fethullah_Gülen https://en.wikipedia.org/wiki/Fethullah_Gülen Since many people in Turkey were using WhatsApp to communicate, there were worries that they might read the article and switch to the completely intercepted SMS, thus risking prison, torture or even death at the hands of the regime. Many of those who signed that letter asking for censorship and white lies were probably persuaded by this argument.

by eehee 9y ago

This entire conflict just seems completely absurd to me - why on earth are the 72 "experts" who signed the open letter so quick to trust WhatsApp without access to the source code?

eehee 9y ago

Thanks for not telling me what I'm missing, guys! Stay classy.

cpach 9y ago
This has been discussed at length on HN. See e.g. https://news.ycombinator.com/item?id=13382491 https://news.ycombinator.com/item?id=13382491

WillyOnWheels 9y ago

I doubt that would satisfy the anti Whatsapp crowd. It's impossible to know what binary Facebook/Whatsapp runs on their servers.

idlewords 9y ago
The point of end-to-end encryption is that it doesn't matter what they run on their servers.

g-clef 9y ago

The experts (no scare quotes needed, they really are experts) were commenting on the story's facts as presented. There was no need to read the source of whatsapp, as the facts as stated in the original article were overblown and based on fundamental misunderstandings of cryptography. The entire story was based on the question of "what do you do when someone you're communicating with using encryption changes keys?" Whatsapp chose to dynamically use the new key, rather than fail & force the user to verify the new key in some out-of-band way. This was described as a "backdoor" in the guardian story. That was simply false. Even calling it a vulnerability is a mis-understanding of how cryptography works and of the risk involved in that design decision.

eehee 9y ago
Thank you for actually replying instead of downvoting...and I'll admit, the scare quotes may have been a bit too much! That said, the open letter plainly states "WhatsApp effectively protects people against mass surveillance." How do they know? From this, and the entire tone of the letter, it looks to me like they're still implicitly trusting that WhatsApp does what it claims to do. I see absolutely no reason to do so, and am utterly baffled that top security experts do.
- CiPHPerCoder 9y ago
  Most (if not all) people who signed that letter, myself included, are capable of reverse engineering and analyzing Android apps (i.e. WhatsApp). You don't need access to the source code to perform this analysis. Furthermore, if you can verify that the app does what it advertises, you don't need to trust their infrastructure. E2E takes care of that.
  - willstrafach 9y ago
    More emphasis should be put on this. Those who know how to reverse engineer apps already look at the code, regardless of source code availability. But posting some machine code to debunk the original story would not do much good, seeing as those who might be unsure would likely not know how to read assembly.
  - jolic 9y ago
    It's still not entirely accurate, or at least conclusive, that WhatsApp effectively protects people against mass surveillance. It might be that there's enough other sources, messages aren't that valuable in the first place or even that mass surveillance itself, between target surveillance and everyone being a public person, isn't that important to protect people against. I think it's much easier to conclude that WhatsApp protects peoples messages from leaking or being abused by providers and other "softer" merits.
    - CiPHPerCoder 9y ago

stefantalpalaru 9y ago

> This entire conflict just seems completely absurd to me - why on earth are the 72 "experts" who signed the open letter so quick to trust WhatsApp without access to the source code? It makes more sense when you notice that the open letter was written by a Turkish-American academic: http://technosociology.org/?page_id=1687 http://technosociology.org/?page_id=1687 Apparently, the only hope for a Turkish opposition is this religious leader with some sort of asylum in US: https://en.wikipedia.org/wiki/Fethullah_Gülen https://en.wikipedia.org/wiki/Fethullah_Gülen Since many people in Turkey were using WhatsApp to communicate, there were worries that they might read the article and switch to the completely intercepted SMS, thus risking prison, torture or even death at the hands of the regime. Many of those who signed that letter asking for censorship and white lies were probably persuaded by this argument.