4 ms·

Could you expand on WhatsApp? You are conflating privacy and "secure" and I am confused. I thought WhatsApp had end to end encryption, even if FB can probably s

by runeb 9y ago

Could you expand on WhatsApp? You are conflating privacy and "secure" and I am confused. I thought WhatsApp had end to end encryption, even if FB can probably see who chats with who.

matheusmoreira 9y ago
WhatsApp does have end-to-end encryption. It integrated Signal's features a couple years ago. It's enabled by default. https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/ I'm not sure if it's good enough to foil the US government agencies and their boundless stockpile of zero days. It did, however, make some judges here feel very impotent and powerless. They really, really wanted the messages in order to investigate some crime and couldn't understand why WhatsApp was resisting their requests. They ended up ordering ISPs to block the messaging service for a while as punishment. https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-founder-brazil-shut-down-facebook/ https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-... Sure, it's true that people won't be able to audit the thing... But I think it's significant that a huge number of people are using end-to-end encryption by default without even realizing it. That's gotta count for something. It's a lot better security-wise than whatever it is we used before, and most certainly objectively a lot better than facebook messenger or SMS.
- krick 9y ago
  > I think it's significant that a huge number of people are using end-to-end encryption by default without even realizing it > most certainly objectively a lot better than facebook messenger or SMS Sure, I wouldn't argue with that. Doesn't make up for making me use Google Services (or a phone & a phone number, for that matter) and sharing all my contacts with FB though. It might be even making me angrier about whole situation: it's so close to being good that it makes it obvious, how much technologically possible it in fact is to have a sane messenger. We don't have it though. And no surprise, because who would pay for it, if money cannot be made out of our metadata?
crtasm 9y ago
FB can definitely see who chats to who (and from what kind of device, and from what IP address, etc.) - they own Whatsapp. While the content is secured by end-to-end encryption the metadata is still incredibly valuable.
krick 9y ago
Please see my answer to @kruczek in the same thread. This might be quite broad (maybe unconventional) definition of "secure" I'm talking about here, but the point is: everything that leaks important personal data to the 3rd party (I mean "not me and not the person I'm talking to", so FB is a 3rd party) leaking which is not absolutely mathematically necessary to perform its most basic functions — is not "secure" in my book. It doesn't matter if data end ups leaked because of using ROT13 for message encryption, or because it shares it with FB by design. Sharing my whole contactbook with FB, using proprietary closed-source app and protocol, requiring to have a real phone number (and sharing my access code via SMS with my mobile network operator on the first login — this is truly brilliant for a "secure" app, although I don't quite remember if it was WhatsApp or something similar) is not absolutely necessary for its most basic features and thus is not secure. I want to be clear that `conflating privacy and "secure"` is intentional — violating my privacy automatically harms my security in most direct way. If something quite literally puts me in danger it shouldn't be considered "secure" by definition, no matter how good its crypto is on paper.

by runeb 9y ago

Could you expand on WhatsApp? You are conflating privacy and "secure" and I am confused. I thought WhatsApp had end to end encryption, even if FB can probably see who chats with who.

matheusmoreira 9y ago

WhatsApp does have end-to-end encryption. It integrated Signal's features a couple years ago. It's enabled by default. https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/ I'm not sure if it's good enough to foil the US government agencies and their boundless stockpile of zero days. It did, however, make some judges here feel very impotent and powerless. They really, really wanted the messages in order to investigate some crime and couldn't understand why WhatsApp was resisting their requests. They ended up ordering ISPs to block the messaging service for a while as punishment. https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-founder-brazil-shut-down-facebook/ https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-... Sure, it's true that people won't be able to audit the thing... But I think it's significant that a huge number of people are using end-to-end encryption by default without even realizing it. That's gotta count for something. It's a lot better security-wise than whatever it is we used before, and most certainly objectively a lot better than facebook messenger or SMS.

krick 9y ago
> I think it's significant that a huge number of people are using end-to-end encryption by default without even realizing it > most certainly objectively a lot better than facebook messenger or SMS Sure, I wouldn't argue with that. Doesn't make up for making me use Google Services (or a phone & a phone number, for that matter) and sharing all my contacts with FB though. It might be even making me angrier about whole situation: it's so close to being good that it makes it obvious, how much technologically possible it in fact is to have a sane messenger. We don't have it though. And no surprise, because who would pay for it, if money cannot be made out of our metadata?

crtasm 9y ago

FB can definitely see who chats to who (and from what kind of device, and from what IP address, etc.) - they own Whatsapp. While the content is secured by end-to-end encryption the metadata is still incredibly valuable.

krick 9y ago

Please see my answer to @kruczek in the same thread. This might be quite broad (maybe unconventional) definition of "secure" I'm talking about here, but the point is: everything that leaks important personal data to the 3rd party (I mean "not me and not the person I'm talking to", so FB is a 3rd party) leaking which is not absolutely mathematically necessary to perform its most basic functions — is not "secure" in my book. It doesn't matter if data end ups leaked because of using ROT13 for message encryption, or because it shares it with FB by design. Sharing my whole contactbook with FB, using proprietary closed-source app and protocol, requiring to have a real phone number (and sharing my access code via SMS with my mobile network operator on the first login — this is truly brilliant for a "secure" app, although I don't quite remember if it was WhatsApp or something similar) is not absolutely necessary for its most basic features and thus is not secure. I want to be clear that `conflating privacy and "secure"` is intentional — violating my privacy automatically harms my security in most direct way. If something quite literally puts me in danger it shouldn't be considered "secure" by definition, no matter how good its crypto is on paper.