7 ms·

I don't know anybody in security community who would prefer WhatsApp over Signal. Of course, my sample is limited.

by kbart 9y ago

659087 9y ago
While I still trust Signal more than whatsapp, Moxie's "you can definitely trust Facebook" PR tour left me wondering if he had been compromised in some way.
- nickik 9y ago
  > "PR tour" What PR tour? All that I remember was that he helped with the implementation and that they have a functioning system that they consider correct. I think he and everybody else knows the limits of the security model of WhatsApp. Just because they have a working setup, does not mean they are actually using it, or have not changed it without his knowledge. His assertion was simply that WhatsApp was capable of offering the same service as Signal. This is from memory, but I don't remember any 'PR tour'.
gcthomas 9y ago
Like others, I specifically picked Signal over WhatsApp due to the problem of trusting proprietary apps. I think that the UK Govt Ministers that use WhatsApp to coordinate their actions should switch to whatever GCHQ recommends for givt business – I'm sure that they haven't approved WhatsApp.
tptacek 9y ago
I talk to more cryptographers over WhatsApp than Signal.
- kbart 9y ago
  I'm sure your sample is bigger than mine, so maybe that's a regional thing (I'm in Europe)? Did you notice some trends?
  - tptacek 9y ago
    Just that WhatsApp can be more reliable than Signal.
cup-of-tea 9y ago
It doesn't matter about preference. Many security people will tell you "WhatsApp is encrypted" as if that makes it secure. My feeling is that rather than deriding it as the false sense of security that it is, the community prefer to trust its claims and believe that it's secure.
- nickik 9y ago
  Yes many security will tell you "WhatsApp is encrpyted" and that is true, and it is simply your assertion that this implies that they believe it is secure. But its not just a false sense of security. Yes, everybody that understands security will have issues with all the problems all of us know that exists. That however does not change that for user there was a real increase in security. I would rather say it is rather disingenuous for you to claim that it is all false security just because it is not what you would consider perfect.
  - cup-of-tea 9y ago
    > it is not what you would consider perfect. And that is exactly what I mean by security people giving up. Twenty years ago what I think is perfect was merely the norm. Now WhatsApp is OK and it's just me who doesn't consider it perfect.
    - UncleMeat 9y ago
      Best I can tell, people are still publishing papers on messaging. For example, this very paper published in RWC. Where have people given up?
    - nickik 9y ago
      Pretty arrogant of you. I was just at a confrence where new more secure communications was one of the topics and there are many people working on new apps, improved protocols and working on figuring out flaws in existing products. Everybody there understands the security constraints of Whatsapp, and believe me they can hardly shut up about it.
CommentCard 9y ago
Signal has the perception of being more secure simply because it isn't owned by Facebook. I will never trust a Facebook server with private messages, despite both Signal and WhatsApp having the same security features on paper.
- reitanqild 9y ago
  Same with me. I refuse to think Mark Zuckerberg * bought it for north of USD10Bn * made it free * stopped all other monetization efforts (paid api gateways etc) just to provide free messaging service to everyone. I have two explanations: * either he felt it was a threat to his future messenging monopoly or * (and this is already not a secret anymore) they wanted to feed the data into their already huge tracking and ad serving network. Both of those are good enough reasons for me to leave as I care about healthy competition and my future privacy. But maybe the biggest reason why is because they lied to me: they promised to be the service that provided a good messaging service in exchange for a modest fee. They were profitable and yet sold out.
  - kbart 9y ago
    Another possibility is that Zuckerberg's plans were destroyed (or at least delayed) by EU ruling[0], so he didn't get what actually expected. 0. https://www.theguardian.com/business/2017/may/18/facebook-fined-eu-whatsapp-european-commission https://www.theguardian.com/business/2017/may/18/facebook-fi...
    - reitanqild 9y ago
      ? You mean you agree he had an evil plan and it was thwarted?
      - kbart 9y ago
        "An evil plan" might be a bit of an exaggeration, but I think he might have expected more (read more private data or ad push) from WhatsApp users than he currently can get. Of course, that's just speculation, but as you've originally mentioned, it makes no business sense for Facebook to maintain a free messaging app with no strings attached.
TheChaplain 9y ago
But that in itself is also a problem, because people outside the security community does not like Signal. I've tried so many times to convert people, but every non-security person prefer LINE, WhatsApp and Telegram. The reasons are simple; they are fun to use, good user experience and the most important one "my friends use it".
- kbart 9y ago
  Yes, "my friends use it" argument greatly impedes switching to another app, even though it is better. Anyway, slowly, but surely I expand my circle of Signal users. Current version of Signal is actually quite polished, at least not worse than WhatsApp was the last time I used it (before acquisition by Facebook), and I rarely hear complaints about usability anymore from people who have actually tried it.
  - Outpox 9y ago
    I'm trying to push Keybase within my friend group. I've yet to try Signal.
    - Jtsummers 9y ago
      Ditto, but you'll have more luck with Signal. They'll see the value of it more quickly. I'm currently trying to get 3 people to use Keybase. My girlfriend/fiancee: Lives in another country, we're sharing data involving PII to deal with immigration stuffs. My sister: We have a side project and I'd like to use the team based, private git repos. A colleague: Same as sister, plus he's generally interested in privacy/security. And it's still been like pulling teeth to get him to do it.
- vitro 9y ago
  Yes, in Signal you for example still cannot share one photo to multiple recipients or share multiple photos. I've installed it to all my relatives and they use it anyway, just those simple things would make it a bit better for your average "share pictures of my kids" types of use.

I don't know anybody in security community who would prefer WhatsApp over Signal. Of course, my sample is limited.

by kbart 9y ago

I don't know anybody in security community who would prefer WhatsApp over Signal. Of course, my sample is limited.

While I still trust Signal more than whatsapp, Moxie's "you can definitely trust Facebook" PR tour left me wondering if he had been compromised in some way.

nickik 9y ago
> "PR tour" What PR tour? All that I remember was that he helped with the implementation and that they have a functioning system that they consider correct. I think he and everybody else knows the limits of the security model of WhatsApp. Just because they have a working setup, does not mean they are actually using it, or have not changed it without his knowledge. His assertion was simply that WhatsApp was capable of offering the same service as Signal. This is from memory, but I don't remember any 'PR tour'.

gcthomas 9y ago

Like others, I specifically picked Signal over WhatsApp due to the problem of trusting proprietary apps. I think that the UK Govt Ministers that use WhatsApp to coordinate their actions should switch to whatever GCHQ recommends for givt business – I'm sure that they haven't approved WhatsApp.

tptacek 9y ago

I talk to more cryptographers over WhatsApp than Signal.

kbart 9y ago
I'm sure your sample is bigger than mine, so maybe that's a regional thing (I'm in Europe)? Did you notice some trends?
- tptacek 9y ago
  Just that WhatsApp can be more reliable than Signal.

cup-of-tea 9y ago

It doesn't matter about preference. Many security people will tell you "WhatsApp is encrypted" as if that makes it secure. My feeling is that rather than deriding it as the false sense of security that it is, the community prefer to trust its claims and believe that it's secure.

nickik 9y ago
Yes many security will tell you "WhatsApp is encrpyted" and that is true, and it is simply your assertion that this implies that they believe it is secure. But its not just a false sense of security. Yes, everybody that understands security will have issues with all the problems all of us know that exists. That however does not change that for user there was a real increase in security. I would rather say it is rather disingenuous for you to claim that it is all false security just because it is not what you would consider perfect.
- cup-of-tea 9y ago
  > it is not what you would consider perfect. And that is exactly what I mean by security people giving up. Twenty years ago what I think is perfect was merely the norm. Now WhatsApp is OK and it's just me who doesn't consider it perfect.
  - UncleMeat 9y ago
    Best I can tell, people are still publishing papers on messaging. For example, this very paper published in RWC. Where have people given up?
  - nickik 9y ago
    Pretty arrogant of you. I was just at a confrence where new more secure communications was one of the topics and there are many people working on new apps, improved protocols and working on figuring out flaws in existing products. Everybody there understands the security constraints of Whatsapp, and believe me they can hardly shut up about it.

CommentCard 9y ago

Signal has the perception of being more secure simply because it isn't owned by Facebook. I will never trust a Facebook server with private messages, despite both Signal and WhatsApp having the same security features on paper.

reitanqild 9y ago
Same with me. I refuse to think Mark Zuckerberg * bought it for north of USD10Bn * made it free * stopped all other monetization efforts (paid api gateways etc) just to provide free messaging service to everyone. I have two explanations: * either he felt it was a threat to his future messenging monopoly or * (and this is already not a secret anymore) they wanted to feed the data into their already huge tracking and ad serving network. Both of those are good enough reasons for me to leave as I care about healthy competition and my future privacy. But maybe the biggest reason why is because they lied to me: they promised to be the service that provided a good messaging service in exchange for a modest fee. They were profitable and yet sold out.
- kbart 9y ago
  Another possibility is that Zuckerberg's plans were destroyed (or at least delayed) by EU ruling[0], so he didn't get what actually expected. 0. https://www.theguardian.com/business/2017/may/18/facebook-fined-eu-whatsapp-european-commission https://www.theguardian.com/business/2017/may/18/facebook-fi...
  - reitanqild 9y ago
    ? You mean you agree he had an evil plan and it was thwarted?
    - kbart 9y ago
      "An evil plan" might be a bit of an exaggeration, but I think he might have expected more (read more private data or ad push) from WhatsApp users than he currently can get. Of course, that's just speculation, but as you've originally mentioned, it makes no business sense for Facebook to maintain a free messaging app with no strings attached.

TheChaplain 9y ago

But that in itself is also a problem, because people outside the security community does not like Signal. I've tried so many times to convert people, but every non-security person prefer LINE, WhatsApp and Telegram. The reasons are simple; they are fun to use, good user experience and the most important one "my friends use it".

kbart 9y ago
Yes, "my friends use it" argument greatly impedes switching to another app, even though it is better. Anyway, slowly, but surely I expand my circle of Signal users. Current version of Signal is actually quite polished, at least not worse than WhatsApp was the last time I used it (before acquisition by Facebook), and I rarely hear complaints about usability anymore from people who have actually tried it.
- Outpox 9y ago
  I'm trying to push Keybase within my friend group. I've yet to try Signal.
  - Jtsummers 9y ago
    Ditto, but you'll have more luck with Signal. They'll see the value of it more quickly. I'm currently trying to get 3 people to use Keybase. My girlfriend/fiancee: Lives in another country, we're sharing data involving PII to deal with immigration stuffs. My sister: We have a side project and I'd like to use the team based, private git repos. A colleague: Same as sister, plus he's generally interested in privacy/security. And it's still been like pulling teeth to get him to do it.
vitro 9y ago
Yes, in Signal you for example still cannot share one photo to multiple recipients or share multiple photos. I've installed it to all my relatives and they use it anyway, just those simple things would make it a bit better for your average "share pictures of my kids" types of use.