5 ms·

Of course it is, it's funny that there even is any arguing about that in the comments. Since when it's even a question? The real question is: so what can we do

by krick 9y ago

Of course it is, it's funny that there even is any arguing about that in the comments. Since when it's even a question? The real question is: so what can we do about that? I, for one, don't really see an answer to that. All this babbling by Snowden or anyone else for that matter is worth nothing. If there is any war going on, FB is hopelessly winning and I don't see any attempts (or even possible attempts) to change anything. Fuck, nobody even uses any somewhat "secure" messenger, people use WhatsApp and Telegram (and even dare to speak about them in terms of "privacy", which is mind boggling) and nobody gives a fuck about anything — and "somewhat secure messenger" isn't even that hard to achieve if people would really want it. And here you are talking about FB or Android being evil — yeah, of course they are, but they don't even have any plausible alternative to cover people's needs, so what do you expect…

kruczek 9y ago
> people use WhatsApp and Telegram (and even dare to speak about them in terms of "privacy", which is mind boggling) I don't know about WhatsApp, but from what I recall about Telegram, its main criticism is the fact that it isn't using secret chats (i.e. private conversations) by default. However when using secret chats, the communication is end-to-end encrypted. Is there anything else wrong with it?
- 215163831328308 9y ago
  The main criticism of Telegram is that it created it's own cryptography. It does not use a well established cryptographic scheme. Instead the creators of Telegram created their own scheme, and that has not been checked as thoroughly. The mostly strict rule in these things is, don't roll your own crypto. This is reiterated in [1] and an attack on telegram [2] [1]: https://security.stackexchange.com/questions/49782/is-telegram-secure https://security.stackexchange.com/questions/49782/is-telegr... [2]: https://security.stackexchange.com/questions/49782/is-telegram-secure https://security.stackexchange.com/questions/49782/is-telegr...
- pigeons 9y ago
  not only not default, secret chats are not even available on linux.
  - jhasse 9y ago
    They are (e.g. https://github.com/Aseman-Land/Cutegram https://github.com/Aseman-Land/Cutegram), but not with the official Desktop client.
- krick 9y ago
  First off, I consider no e2e enryption by default a big deal, given even WhatsApp does that. In Telegram it's so inconvenient — "they" obviously don't want you to use it. So yeah. But for me all these apps are broken on more fundamental level. First, as somebody else already noted that I'm "confusing security and privacy" let me introduce my custom definition (or rather a trait) of "security" for the sake of this argument: no 3rd party can access any data of mine without explicit permission, unless it's absolutely necessary for the app to work. So any messenger that must use a phone number for a log in without giving me any choice is shit, regardless of whether its crypto is broken or not. Any messenger that can non-locally access all of my contacts without asking me which contacts I agree to share — is shit. Any messenger that won't work without Google Services or cannot be installed without Google Play account — is shit. And so on. That said, Matrix/Riot probably is the only messenger out there that has any chance of becoming not-shitty messenger. But nobody uses it.
anonytrary 9y ago
> what can we do about that? But you do know the answer: Quit Facebook. We all have time, so we should vote with it.
- toss1 9y ago
  Yes, but you not only have to just quit -- you also must do more. Before deleting your account overwrite everything with garbage data. If you simply close or delete your account, FB saves everything (in case you might come back, they can offer you a better experience, don'tcha' know?). At least overwriting garbage may give you a slightly better chance. You also need to use NoScript or the like and deny all FB scripts. FB tracks and maintains profiles on everyone, even whether or not you are members. They are being sued over this in the EU. Also find and delete their hidden Super-cookies; 200kb of data, including all your other browsing habits, Amazon purchases, etc. Several tutorials are searchable online.
  - Erlangolem 9y ago
    Don’t forget that all of your friends and family who use Facebook are potentially leaking your data as well. FB has become quite the tentacled monster!
    - mrhappyunhappy 9y ago
      Had to explain this to my now aging mother who likes to post photos of me without my permission. She gets it in the moment but weeks later back to the same behavior haha. I can't control it if I tried.
- deleted 9y ago
  [deleted]
runeb 9y ago
Could you expand on WhatsApp? You are conflating privacy and "secure" and I am confused. I thought WhatsApp had end to end encryption, even if FB can probably see who chats with who.
- matheusmoreira 9y ago
  WhatsApp does have end-to-end encryption. It integrated Signal's features a couple years ago. It's enabled by default. https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/ I'm not sure if it's good enough to foil the US government agencies and their boundless stockpile of zero days. It did, however, make some judges here feel very impotent and powerless. They really, really wanted the messages in order to investigate some crime and couldn't understand why WhatsApp was resisting their requests. They ended up ordering ISPs to block the messaging service for a while as punishment. https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-founder-brazil-shut-down-facebook/ https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-... Sure, it's true that people won't be able to audit the thing... But I think it's significant that a huge number of people are using end-to-end encryption by default without even realizing it. That's gotta count for something. It's a lot better security-wise than whatever it is we used before, and most certainly objectively a lot better than facebook messenger or SMS.
  - krick 9y ago
    > I think it's significant that a huge number of people are using end-to-end encryption by default without even realizing it > most certainly objectively a lot better than facebook messenger or SMS Sure, I wouldn't argue with that. Doesn't make up for making me use Google Services (or a phone & a phone number, for that matter) and sharing all my contacts with FB though. It might be even making me angrier about whole situation: it's so close to being good that it makes it obvious, how much technologically possible it in fact is to have a sane messenger. We don't have it though. And no surprise, because who would pay for it, if money cannot be made out of our metadata?
- crtasm 9y ago
  FB can definitely see who chats to who (and from what kind of device, and from what IP address, etc.) - they own Whatsapp. While the content is secured by end-to-end encryption the metadata is still incredibly valuable.
hutzlibu 9y ago
"Fuck, nobody even uses any somewhat "secure" messenger, people use WhatsApp and Telegram (and even dare to speak about them in terms of "privacy", which is mind boggling) and nobody gives a fuck about anything" So I was wondering, why you did not mention Signal or Diaspora then? It is easy to bitch, but there are actual things you can do. Even it is only tell people of alternatives. And while I by myself don't even tried Diaspora yet, I like that it exists and getting more mature. And Signal I do use and see no downside compared to WhatsApp, except most people beeing too lazy to change or having, oh my god, 2 installed messengers. And my main issue with signal, that it uses Google Servers, is something that could be changed in the future, as far as I know, but till then, it is still 100% open source and private
- krick 9y ago
  I would like to mention Matrix/Riot instead. It's not good enough still, but if anything will be in a foreseeable future, I believe it has the biggest chance.
mmjaa 9y ago
> Since when it's even a question? We roll through new generations of computer-using society every year, and every 4 - 5 years, after some intensive studying, new waves of developers and "computer people" evolve from being clueless teenagers, to clued-in members of society. This is of course, of benefit to society at large - but there is a deleterious effect at play here, as well. While cramming hard to graduate, people keep their heads down - and/or in the sand - and tend to ignore the wider, broader aspects of society in the meanwhile. And this is why we must continually rehash themes that we - living in the static world - consider to be 'old news'. Always remember - ALWAYS - that there is a generation of kids on the cusp of making their way into society, and no matter what we adults do, no matter how hard we try and cry and pound our fists on the table, these kids were NOT paying attention to the important issues in the last few years. So this is why we must consistently push key social issues to the forefront, no matter how tiresome it becomes. Its the kids who are coming to this scene who can do something about it, before its too late - before they too, become jaded adults who just want to pay the mortgage. Between these two worlds is a no-mans land of social issues, and a war being waged by all the special interests to obfuscate and confuse and devolve the issues, such that the powerful young new adult elite don't put them in their spotlights. "Since when its even a question?" - every day, there are people learning the extent to which our society has devolved. It is ALWAYS a question.

by krick 9y ago

kruczek 9y ago

> people use WhatsApp and Telegram (and even dare to speak about them in terms of "privacy", which is mind boggling) I don't know about WhatsApp, but from what I recall about Telegram, its main criticism is the fact that it isn't using secret chats (i.e. private conversations) by default. However when using secret chats, the communication is end-to-end encrypted. Is there anything else wrong with it?

215163831328308 9y ago
The main criticism of Telegram is that it created it's own cryptography. It does not use a well established cryptographic scheme. Instead the creators of Telegram created their own scheme, and that has not been checked as thoroughly. The mostly strict rule in these things is, don't roll your own crypto. This is reiterated in [1] and an attack on telegram [2] [1]: https://security.stackexchange.com/questions/49782/is-telegram-secure https://security.stackexchange.com/questions/49782/is-telegr... [2]: https://security.stackexchange.com/questions/49782/is-telegram-secure https://security.stackexchange.com/questions/49782/is-telegr...
pigeons 9y ago
not only not default, secret chats are not even available on linux.
- jhasse 9y ago
  They are (e.g. https://github.com/Aseman-Land/Cutegram https://github.com/Aseman-Land/Cutegram), but not with the official Desktop client.
krick 9y ago
First off, I consider no e2e enryption by default a big deal, given even WhatsApp does that. In Telegram it's so inconvenient — "they" obviously don't want you to use it. So yeah. But for me all these apps are broken on more fundamental level. First, as somebody else already noted that I'm "confusing security and privacy" let me introduce my custom definition (or rather a trait) of "security" for the sake of this argument: no 3rd party can access any data of mine without explicit permission, unless it's absolutely necessary for the app to work. So any messenger that must use a phone number for a log in without giving me any choice is shit, regardless of whether its crypto is broken or not. Any messenger that can non-locally access all of my contacts without asking me which contacts I agree to share — is shit. Any messenger that won't work without Google Services or cannot be installed without Google Play account — is shit. And so on. That said, Matrix/Riot probably is the only messenger out there that has any chance of becoming not-shitty messenger. But nobody uses it.

anonytrary 9y ago

> what can we do about that? But you do know the answer: Quit Facebook. We all have time, so we should vote with it.

toss1 9y ago
Yes, but you not only have to just quit -- you also must do more. Before deleting your account overwrite everything with garbage data. If you simply close or delete your account, FB saves everything (in case you might come back, they can offer you a better experience, don'tcha' know?). At least overwriting garbage may give you a slightly better chance. You also need to use NoScript or the like and deny all FB scripts. FB tracks and maintains profiles on everyone, even whether or not you are members. They are being sued over this in the EU. Also find and delete their hidden Super-cookies; 200kb of data, including all your other browsing habits, Amazon purchases, etc. Several tutorials are searchable online.
- Erlangolem 9y ago
  Don’t forget that all of your friends and family who use Facebook are potentially leaking your data as well. FB has become quite the tentacled monster!
  - mrhappyunhappy 9y ago
    Had to explain this to my now aging mother who likes to post photos of me without my permission. She gets it in the moment but weeks later back to the same behavior haha. I can't control it if I tried.
deleted 9y ago
[deleted]

runeb 9y ago

Could you expand on WhatsApp? You are conflating privacy and "secure" and I am confused. I thought WhatsApp had end to end encryption, even if FB can probably see who chats with who.

matheusmoreira 9y ago
WhatsApp does have end-to-end encryption. It integrated Signal's features a couple years ago. It's enabled by default. https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/ I'm not sure if it's good enough to foil the US government agencies and their boundless stockpile of zero days. It did, however, make some judges here feel very impotent and powerless. They really, really wanted the messages in order to investigate some crime and couldn't understand why WhatsApp was resisting their requests. They ended up ordering ISPs to block the messaging service for a while as punishment. https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-founder-brazil-shut-down-facebook/ https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-... Sure, it's true that people won't be able to audit the thing... But I think it's significant that a huge number of people are using end-to-end encryption by default without even realizing it. That's gotta count for something. It's a lot better security-wise than whatever it is we used before, and most certainly objectively a lot better than facebook messenger or SMS.
- krick 9y ago
  > I think it's significant that a huge number of people are using end-to-end encryption by default without even realizing it > most certainly objectively a lot better than facebook messenger or SMS Sure, I wouldn't argue with that. Doesn't make up for making me use Google Services (or a phone & a phone number, for that matter) and sharing all my contacts with FB though. It might be even making me angrier about whole situation: it's so close to being good that it makes it obvious, how much technologically possible it in fact is to have a sane messenger. We don't have it though. And no surprise, because who would pay for it, if money cannot be made out of our metadata?
crtasm 9y ago
FB can definitely see who chats to who (and from what kind of device, and from what IP address, etc.) - they own Whatsapp. While the content is secured by end-to-end encryption the metadata is still incredibly valuable.

hutzlibu 9y ago

"Fuck, nobody even uses any somewhat "secure" messenger, people use WhatsApp and Telegram (and even dare to speak about them in terms of "privacy", which is mind boggling) and nobody gives a fuck about anything" So I was wondering, why you did not mention Signal or Diaspora then? It is easy to bitch, but there are actual things you can do. Even it is only tell people of alternatives. And while I by myself don't even tried Diaspora yet, I like that it exists and getting more mature. And Signal I do use and see no downside compared to WhatsApp, except most people beeing too lazy to change or having, oh my god, 2 installed messengers. And my main issue with signal, that it uses Google Servers, is something that could be changed in the future, as far as I know, but till then, it is still 100% open source and private

krick 9y ago
I would like to mention Matrix/Riot instead. It's not good enough still, but if anything will be in a foreseeable future, I believe it has the biggest chance.

mmjaa 9y ago

> Since when it's even a question? We roll through new generations of computer-using society every year, and every 4 - 5 years, after some intensive studying, new waves of developers and "computer people" evolve from being clueless teenagers, to clued-in members of society. This is of course, of benefit to society at large - but there is a deleterious effect at play here, as well. While cramming hard to graduate, people keep their heads down - and/or in the sand - and tend to ignore the wider, broader aspects of society in the meanwhile. And this is why we must continually rehash themes that we - living in the static world - consider to be 'old news'. Always remember - ALWAYS - that there is a generation of kids on the cusp of making their way into society, and no matter what we adults do, no matter how hard we try and cry and pound our fists on the table, these kids were NOT paying attention to the important issues in the last few years. So this is why we must consistently push key social issues to the forefront, no matter how tiresome it becomes. Its the kids who are coming to this scene who can do something about it, before its too late - before they too, become jaded adults who just want to pay the mortgage. Between these two worlds is a no-mans land of social issues, and a war being waged by all the special interests to obfuscate and confuse and devolve the issues, such that the powerful young new adult elite don't put them in their spotlights. "Since when its even a question?" - every day, there are people learning the extent to which our society has devolved. It is ALWAYS a question.