11 ms·

> I mean, yeah, by that metric, Signal could too, and every other encrypted messenger. Open source ones would be a lot less likely to get away with it.

gcthomas 8y ago
The difference between Signal and Wattsapp is really in all the non-message-contents data that Wattsapp collects, as you can see in their privacy (hah!) policy: ( https://www.whatsapp.com/legal/#privacy-policy-information-we-collect https://www.whatsapp.com/legal/#privacy-policy-information-w...) "(We collect) hardware model, operating system information, battery level, signal strength, app version, browser information, and mobile network, connection information including phone number, mobile operator or ISP, language and time zone, and IP, device operations information, and identifiers like device identifiers (including identifiers unique to Facebook Company Products associated with the same device or account) "...how you interact with others using our Services, and the time, frequency, and duration of your activities and interactions), log files, and diagnostic, crash, website, and performance logs and reports. This also includes information about when you registered to use our Services, the features you use like our messaging, calling, Status, or groups features, profile photo, about information, whether you are online, when you last used our Services (your "last seen"), and when you last updated your about information. "We collect device location information if you use our location features, like when you choose to share your location with your contacts, view locations nearby or those others have shared with you, and the like, and for diagnostics and troubleshooting purposes such as if you are having trouble with our app's location features. We use various technologies to determine location, including IP, GPS, Bluetooth signals, and information about nearby Wi-Fi access points, beacons, and cell towers. "We receive information about you from other users and businesses. For example, when other users or businesses you know use our Services, they may provide your phone number, name, and other information "Businesses you interact with using WhatsApp provide us information about their interactions with you.
- anticensor 8y ago
  > battery level, signal strength, This reminds me Windows 10 collecting color of the device, in that it is unnecessary for operation but enough to pinpoint a person in combination.
  - crtasm 8y ago
    It asks you what colour your device is? Haven't run into that yet.
    - anticensor 8y ago
      It collects without noticing you. There is a chassis color stored in somewhere as I understand it correctly.
azahk 8y ago
Why? These applications are super complex and you can't count on all eyeballs detecting a potential backdoor. And, you don't know if the code in the repo matches what you download from the App Store.
- xxs 8y ago
  This is a very weak argument, eyeballs do find backdoors. Usually each commit is checked by few people and the introduction of the backdoor is rather obvious. As for not knowing what has been downloading (if someone tempered with), the best approach is compiling it on your own.
  - gaius 8y ago
    This is a very weak argument, eyeballs do find backdoors Eventually, maybe. How many eyeballs and how long to find Heartbleed?
    - Coxa 8y ago
      There's a difference between a potential backdoor and a bug. While a lot of eyeballs might oversee a bug, you have to make an effort to design your backdoor to go unnoticed.
      - gaius 8y ago
        Good backdoors are indistinguishable from bugs, for plausible deniability
    - zAy0LfpBZLC8mAC 8y ago
      The question isn't whether there won't ever be backdoors, but how likely that is, how long they will stay in place undetected, and what the effects on the reputation of the product/project/committer are once they are discovered. Bringing this up as an argument is a sensible as claiming that transparency and democracy isn't any better than a dictatorship because there is still corruption.
  - 8y ago
MuppetMaster42 8y ago
If you are being super paranoid... Unless the open source app is transparently built and app store deployed from a public build server, it's very easy for the owner to inject a back-door into it. There's no mechanism built into the app stores to validate an app against its source code. So the owner could checkout master, add a back-door, build and publish to the app stores, and you'd update, never knowing you're exposed. Nothing is 100% safe. It's just dependent on how much trust you assign.

gcthomas 8y ago

The difference between Signal and Wattsapp is really in all the non-message-contents data that Wattsapp collects, as you can see in their privacy (hah!) policy: ( https://www.whatsapp.com/legal/#privacy-policy-information-we-collect https://www.whatsapp.com/legal/#privacy-policy-information-w...) "(We collect) hardware model, operating system information, battery level, signal strength, app version, browser information, and mobile network, connection information including phone number, mobile operator or ISP, language and time zone, and IP, device operations information, and identifiers like device identifiers (including identifiers unique to Facebook Company Products associated with the same device or account) "...how you interact with others using our Services, and the time, frequency, and duration of your activities and interactions), log files, and diagnostic, crash, website, and performance logs and reports. This also includes information about when you registered to use our Services, the features you use like our messaging, calling, Status, or groups features, profile photo, about information, whether you are online, when you last used our Services (your "last seen"), and when you last updated your about information. "We collect device location information if you use our location features, like when you choose to share your location with your contacts, view locations nearby or those others have shared with you, and the like, and for diagnostics and troubleshooting purposes such as if you are having trouble with our app's location features. We use various technologies to determine location, including IP, GPS, Bluetooth signals, and information about nearby Wi-Fi access points, beacons, and cell towers. "We receive information about you from other users and businesses. For example, when other users or businesses you know use our Services, they may provide your phone number, name, and other information "Businesses you interact with using WhatsApp provide us information about their interactions with you.

anticensor 8y ago
> battery level, signal strength, This reminds me Windows 10 collecting color of the device, in that it is unnecessary for operation but enough to pinpoint a person in combination.
- crtasm 8y ago
  It asks you what colour your device is? Haven't run into that yet.
  - anticensor 8y ago
    It collects without noticing you. There is a chassis color stored in somewhere as I understand it correctly.

azahk 8y ago

Why? These applications are super complex and you can't count on all eyeballs detecting a potential backdoor. And, you don't know if the code in the repo matches what you download from the App Store.

xxs 8y ago
This is a very weak argument, eyeballs do find backdoors. Usually each commit is checked by few people and the introduction of the backdoor is rather obvious. As for not knowing what has been downloading (if someone tempered with), the best approach is compiling it on your own.
- gaius 8y ago
  This is a very weak argument, eyeballs do find backdoors Eventually, maybe. How many eyeballs and how long to find Heartbleed?
  - Coxa 8y ago
    There's a difference between a potential backdoor and a bug. While a lot of eyeballs might oversee a bug, you have to make an effort to design your backdoor to go unnoticed.
    - gaius 8y ago
      Good backdoors are indistinguishable from bugs, for plausible deniability
  - zAy0LfpBZLC8mAC 8y ago
    The question isn't whether there won't ever be backdoors, but how likely that is, how long they will stay in place undetected, and what the effects on the reputation of the product/project/committer are once they are discovered. Bringing this up as an argument is a sensible as claiming that transparency and democracy isn't any better than a dictatorship because there is still corruption.
- 8y ago

MuppetMaster42 8y ago

If you are being super paranoid... Unless the open source app is transparently built and app store deployed from a public build server, it's very easy for the owner to inject a back-door into it. There's no mechanism built into the app stores to validate an app against its source code. So the owner could checkout master, add a back-door, build and publish to the app stores, and you'd update, never knowing you're exposed. Nothing is 100% safe. It's just dependent on how much trust you assign.