3 ms·
They are not that interesting. You have no way to verify if their statements about encryption are true, so you'd be nuts to bet much on assuming they are. Wha
by rstuart4133 8y ago
They are not that interesting. You have no way to verify if their statements about encryption are true, so you'd be nuts to bet much on assuming they are. WhatsApp being sold to an advertising company is just one fine example of why it's nuts.
In fact given the recent bill's introduced into the Australian parliament, it's irrelevant if they are true. The bill allows the government to demand they produce a version of WhatsApp with a bug that sends a copy of all data receives somewhere, and also allows them to demand they download that app via the automatic security patch mechanism. So unless there is a way to verify what software you have isn't bugged you have to assume even if it isn't now, it could well be in the future.
There are ways out of this mess, but none of them are based on taking someones word for it. Yet the "it's secure because that's what it says on the box" seems to be the most common security model people adopt. It's so clearly wrong I sometimes think I'd be less perplexed if most of the world's population started insisting water wasn't wet.
- ac4tw 8y agoActually a fellow on HN the other day demonstrated that you could decompile their APK and inspect the code, so you can make a pretty solid attempt to verify product statements if you have the skill and the time. Also, I think we're cross talking about their statements--I can't divine anything specific from what they say, but their answers (esp. Sandbergs non-answer) seem supportive of other things I've seen claiming the encryption they're using is leaking business analytical information to FB on purpose (effectively undermining the lay understanding of end-end encryption). BTW That situation in Australia is saddening.