5 ms·

WhatsApp is E2E encrypted

by nbvt45 9y ago

pmlnr 9y ago
And also closed source, so no real way of auditing this promise.
- sp332 9y ago
  You can audit the binary. It's not a magic black box.
  - pmlnr 9y ago
    The server part as well?
    - sp332 9y ago
      If you can be sure that the part running on your phone encrypts the message, then it doesn't matter as much what's running on the server. Anyway being open source wouldn't improve the auditability of the server.
    - cesarb 9y ago
      The whole point of it being E2E encrypted is that you don't need to audit the server. As long as it's implemented correctly on the client, both users verified the shared key out-of-band, and both users have enabled the option to warn when the shared key changes, the most the server can do is traffic analysis or denial of service.
- CGamesPlay 9y ago
  Do you trust that the source code for the Signal iOS app on Github is the source code of the application you're running on your phone? All you really have to go on is the word of each company.
  - JumpCrisscross 9y ago
    > Do you trust that the source code for the Signal iOS app On one hand, we have moxie and a team of people with no evidence against their integrity. On the other hand, a culture that responds to criticism with aggression [1] and then responds to criticism of that by deleting their communications [2]. TL; DR It's reasonable to trust Signal's iOS closed-source app while distrusting Facebook Messenger's also closed-source secret mode app. [1] https://www.nytimes.com/2018/03/30/technology/facebook-leaked-memo.html https://www.nytimes.com/2018/03/30/technology/facebook-leake... [2] https://fortune.com/2018/03/31/facebook-employees-are-reportedly-deleting-controversial-internal-messages/ https://fortune.com/2018/03/31/facebook-employees-are-report...
  - pmlnr 9y ago
    True, this is indeed a problem. I'm mostly trusting debian and f-droid, both non-profit, but still in need of trust.
  - gst 8y ago
    No. But I trust that the Signal binaries for Android match the source code that is published on Github: https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/
nugi 9y ago
You trust that? I do not. Perhaps my tin foil is showing from under my hoodie, but the incentive is to collect data, or else... what?
oarsinsync 9y ago
I believe that’s only text. Try sending someone a video. Takes a while. Try forwarding that video to someone else moments later. Happens pretty quickly. Same applies with photos.

WhatsApp is E2E encrypted

by nbvt45 9y ago

WhatsApp is E2E encrypted

pmlnr 9y ago

And also closed source, so no real way of auditing this promise.

sp332 9y ago
You can audit the binary. It's not a magic black box.
- pmlnr 9y ago
  The server part as well?
  - sp332 9y ago
    If you can be sure that the part running on your phone encrypts the message, then it doesn't matter as much what's running on the server. Anyway being open source wouldn't improve the auditability of the server.
  - cesarb 9y ago
    The whole point of it being E2E encrypted is that you don't need to audit the server. As long as it's implemented correctly on the client, both users verified the shared key out-of-band, and both users have enabled the option to warn when the shared key changes, the most the server can do is traffic analysis or denial of service.
CGamesPlay 9y ago
Do you trust that the source code for the Signal iOS app on Github is the source code of the application you're running on your phone? All you really have to go on is the word of each company.
- JumpCrisscross 9y ago
  > Do you trust that the source code for the Signal iOS app On one hand, we have moxie and a team of people with no evidence against their integrity. On the other hand, a culture that responds to criticism with aggression [1] and then responds to criticism of that by deleting their communications [2]. TL; DR It's reasonable to trust Signal's iOS closed-source app while distrusting Facebook Messenger's also closed-source secret mode app. [1] https://www.nytimes.com/2018/03/30/technology/facebook-leaked-memo.html https://www.nytimes.com/2018/03/30/technology/facebook-leake... [2] https://fortune.com/2018/03/31/facebook-employees-are-reportedly-deleting-controversial-internal-messages/ https://fortune.com/2018/03/31/facebook-employees-are-report...
- pmlnr 9y ago
  True, this is indeed a problem. I'm mostly trusting debian and f-droid, both non-profit, but still in need of trust.
- gst 8y ago
  No. But I trust that the Signal binaries for Android match the source code that is published on Github: https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/

nugi 9y ago

You trust that? I do not. Perhaps my tin foil is showing from under my hoodie, but the incentive is to collect data, or else... what?

oarsinsync 9y ago

I believe that’s only text. Try sending someone a video. Takes a while. Try forwarding that video to someone else moments later. Happens pretty quickly. Same applies with photos.