7 ms·

Unless I'm missing something, it appears Mr. Stamos (and others) are refuting the original reporting [1][2] with details from the US CLOUD act [3]. The original

Unless I'm missing something, it appears Mr. Stamos (and others) are refuting the original reporting [1][2] with details from the US CLOUD act [3]. The original reporting did not mention the CLOUD act and only mentioned an upcoming "treaty" or "accord". While it's a reasonable guess that these are related, I fear the Hacker News headline prematurely burns Bloomberg with unsubstantiated opinion that currently holds no more weight than the original reporting. [1] https://www.bloomberg.com/news/articles/2019-09-28/facebook-whatsapp-will-have-to-share-messages-with-u-k-police https://www.bloomberg.com/news/articles/2019-09-28/facebook-... [2] https://www.thetimes.co.uk/article/police-can-access-suspects-facebook-and-whatsapp-messages-in-deal-with-us-q7lrfmchz https://www.thetimes.co.uk/article/police-can-access-suspect... [3] https://www.justice.gov/dag/cloudact https://www.justice.gov/dag/cloudact

otterley 7y ago
Quoting John Gruber: "Bloomberg, of course, is the publication that published “The Big Hack” in October — a sensational story alleging that data centers of Apple, Amazon, and dozens of other companies were compromised by China’s intelligence services. The story presented no confirmable evidence at all, was vehemently denied by all companies involved, has not been confirmed by a single other publication (despite much effort to do so), and has been largely discredited by one of Bloomberg’s own sources. By all appearances “The Big Hack” was complete bullshit. Yet Bloomberg has issued no correction or retraction, and seemingly hopes we’ll all just forget about it. I say we do not just forget about it. Bloomberg’s institutional credibility is severely damaged, and everything they publish should be treated with skepticism until they retract the story or provide evidence that it was true."
- TazeTSchnitzel 7y ago
  The same reporters (IIRC) also published the “NSA knew about Cloudbleed for ages” story which was similarly incredible.
  - edoceo 7y ago
    "incredible"? Or "uncredible"?
    - TazeTSchnitzel 7y ago
      The latter is what the former originally means :)
  - TazeTSchnitzel 7y ago
    Sorry, it was Heartbleed actually.
- solidasparagus 7y ago
  I have seen absolutely no evidence that the story was bullshit. It's clearly unconfirmed and probably shouldn't have been reported for that reason. But there's a difference between unproven and proven wrong. Did I miss some evidence that proved this story false?
  - zepto 7y ago
    It is literally a conspiracy theory. Why should anyone believe it true without some kind of proof.
    - solidasparagus 7y ago
      I generally believe that the default reaction to a news story should be "it might be true, it might not". The ratio depends on the claim and the evidence. This is an extraordinary claim with mediocre-to-weak evidence, so I'm on the "unlikely to be true" side, but it's hardly an impossible story. The story is essentially that there was a breakthrough in an effort that everyone in the world is pursuing (hardware supply chain attacks) and then everyone involved behaved as you'd expect them to behave (secretive at first and then defensively once the secret was out). While I don't expect people to believe it, I do expect some evidence if you're going to call it bullshit.
      - otterley 7y ago
        You’re needlessly nitpicking. The more fantastic the story, the greater the burden of proof needed to sustain it. It’s never been the public’s burden to disprove a story that no one has ever heard before. And at this point, enough time has passed since the story broke without any evidence being put forth that it’s reasonable for people to think that yes, in fact, the story is likely bullshit.
        solidasparagus 7y ago
        It is reasonable to think that the story is likely bullshit. It is not, IMO, reasonable to go from that to claiming that it has ruined the credibility of the reporting organization and that you should presume all stories from them are likely false. To come to that conclusion, I believe you need some proof that the reporting was incorrect, not a lack of proof that the story was correct. When we are talking about national security, the consequences of sources being identified are so high that it is not surprising that Bloomberg is unwilling to provide primary sources.
phyzome 7y ago
Bloomberg lost a shitload of credibility with the implants story. I'd definitely believe Alex Stamos over Bloomberg.
2arrs2ells 7y ago
If you remove the word "encrypted" from this sentence in the Bloomberg article: Social media platforms based in the U.S. including Facebook and WhatsApp will be forced to share users’ encrypted messages with British police under a new treaty between the two countries, according to a person familiar with the matter. Then the article matches Stamos's account entirely. With the word "encrypted," the article makes no sense – it would take legislation to force US companies to build backdoors to encryption, not an international accord. I agree the HN headline could be better (my fault!) - but my money is on another Bloomberg security reporting error. Hope they actually issue a correction this time...
- Marsymars 7y ago
  > With the word "encrypted," the article makes no sense – it would take legislation to force US companies to build backdoors to encryption, not an international accord. It makes sense if you take it to mean that WhatsApp with share the encrypted messages, without any means to decrypt. It's not a very meaningful statement though, and will only confuse people.
  - larkeith 7y ago
    If that's truly what they mean, that's far more than confusing - it's flat-out deceptive.
- ncmncm 7y ago
  The resolution is simple. Originally, WhatsApp encrypted end-to-end, and they had no ability to examine traffic. Now, it is encrypted between you and the server, decrypted and scanned, and then re-encrypted for transmission. If you want end-to-end encryption, you will need to use something else.
  - eloff 7y ago
    It is still encrypted end-to-end. I don't know where you're getting your information from.
- fencepost 7y ago
brown9-2 7y ago
What is the name of the upcoming treaty or accord? Seems like if that is accurate then it should not be a mystery.

otterley 7y ago

Quoting John Gruber: "Bloomberg, of course, is the publication that published “The Big Hack” in October — a sensational story alleging that data centers of Apple, Amazon, and dozens of other companies were compromised by China’s intelligence services. The story presented no confirmable evidence at all, was vehemently denied by all companies involved, has not been confirmed by a single other publication (despite much effort to do so), and has been largely discredited by one of Bloomberg’s own sources. By all appearances “The Big Hack” was complete bullshit. Yet Bloomberg has issued no correction or retraction, and seemingly hopes we’ll all just forget about it. I say we do not just forget about it. Bloomberg’s institutional credibility is severely damaged, and everything they publish should be treated with skepticism until they retract the story or provide evidence that it was true."

TazeTSchnitzel 7y ago
The same reporters (IIRC) also published the “NSA knew about Cloudbleed for ages” story which was similarly incredible.
- edoceo 7y ago
  "incredible"? Or "uncredible"?
  - TazeTSchnitzel 7y ago
    The latter is what the former originally means :)
- TazeTSchnitzel 7y ago
  Sorry, it was Heartbleed actually.
solidasparagus 7y ago
I have seen absolutely no evidence that the story was bullshit. It's clearly unconfirmed and probably shouldn't have been reported for that reason. But there's a difference between unproven and proven wrong. Did I miss some evidence that proved this story false?
- zepto 7y ago
  It is literally a conspiracy theory. Why should anyone believe it true without some kind of proof.
  - solidasparagus 7y ago
    I generally believe that the default reaction to a news story should be "it might be true, it might not". The ratio depends on the claim and the evidence. This is an extraordinary claim with mediocre-to-weak evidence, so I'm on the "unlikely to be true" side, but it's hardly an impossible story. The story is essentially that there was a breakthrough in an effort that everyone in the world is pursuing (hardware supply chain attacks) and then everyone involved behaved as you'd expect them to behave (secretive at first and then defensively once the secret was out). While I don't expect people to believe it, I do expect some evidence if you're going to call it bullshit.
    - otterley 7y ago
      You’re needlessly nitpicking. The more fantastic the story, the greater the burden of proof needed to sustain it. It’s never been the public’s burden to disprove a story that no one has ever heard before. And at this point, enough time has passed since the story broke without any evidence being put forth that it’s reasonable for people to think that yes, in fact, the story is likely bullshit.
      - solidasparagus 7y ago
        It is reasonable to think that the story is likely bullshit. It is not, IMO, reasonable to go from that to claiming that it has ruined the credibility of the reporting organization and that you should presume all stories from them are likely false. To come to that conclusion, I believe you need some proof that the reporting was incorrect, not a lack of proof that the story was correct. When we are talking about national security, the consequences of sources being identified are so high that it is not surprising that Bloomberg is unwilling to provide primary sources.

phyzome 7y ago

Bloomberg lost a shitload of credibility with the implants story. I'd definitely believe Alex Stamos over Bloomberg.

2arrs2ells 7y ago

If you remove the word "encrypted" from this sentence in the Bloomberg article: Social media platforms based in the U.S. including Facebook and WhatsApp will be forced to share users’ encrypted messages with British police under a new treaty between the two countries, according to a person familiar with the matter. Then the article matches Stamos's account entirely. With the word "encrypted," the article makes no sense – it would take legislation to force US companies to build backdoors to encryption, not an international accord. I agree the HN headline could be better (my fault!) - but my money is on another Bloomberg security reporting error. Hope they actually issue a correction this time...

Marsymars 7y ago
> With the word "encrypted," the article makes no sense – it would take legislation to force US companies to build backdoors to encryption, not an international accord. It makes sense if you take it to mean that WhatsApp with share the encrypted messages, without any means to decrypt. It's not a very meaningful statement though, and will only confuse people.
- larkeith 7y ago
  If that's truly what they mean, that's far more than confusing - it's flat-out deceptive.
ncmncm 7y ago
The resolution is simple. Originally, WhatsApp encrypted end-to-end, and they had no ability to examine traffic. Now, it is encrypted between you and the server, decrypted and scanned, and then re-encrypted for transmission. If you want end-to-end encryption, you will need to use something else.
- eloff 7y ago
  It is still encrypted end-to-end. I don't know where you're getting your information from.
fencepost 7y ago

brown9-2 7y ago

What is the name of the upcoming treaty or accord? Seems like if that is accurate then it should not be a mystery.