4 ms·

There is no way to prove WhatsApp didn't tamper with OpenWhisper internally.

joshuaissac 7y ago
Even if they did, it would just mean that Facebook (WhatsApp's parent company) could now see your messages, but that is still no worse than the default Telegram setting, which guarantees that the company will be able to decrypt your messages. And what prevents Telegram from tampering with their own end-to-end encryption for the binary they upload to app stores? Hardly anyone compiles their own apps if they can download it from a convenient app store instead.
- wrboyce 7y ago
  Telegram clients are open source and have reproducible builds. There is so much FUD being spread in the comments here which could probably be resolved by sticking your HN comment directly into your search engine of choice. https://core.telegram.org/reproducible-builds https://core.telegram.org/reproducible-builds
  - joshuaissac 7y ago
    They started having reproducible builds since the start of this month, when they released v5.13, and I admit that I had not checked to see if it had changed since the last time I looked. However, this still lets Telegram decrypt people's messages (on the default setting), which makes it less secure than WhatsApp and Signal. The article itself is riddled with FUD about WhatsApp, and the author has written similar FUD/unfounded claims before. 1. https://www.independent.co.uk/life-style/gadgets-and-tech/news/whatsapp-surveillance-privacy-telegram-pavel-durov-facebook-a9211151.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne... 2. https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15 https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15
    - dancemethis1 7y ago
      FUD "against" proprietary software is pretty much the "reverse racism" of technology. Again, there is no proof OpenWhisper wasn't tampered with. It'd take WhatsApp becoming Free Software and having independent audits to be reliable as a communications platform. Suspiscion is but a matter of survival, and chances will continue to be usually against the most vulnerable party: the users.
      - UncleMeat 7y ago
        Why would it need to be Free? Surely a license for modifying the code has exactly nothing to do with being able to audit it. They could distribute the source in a different manner if you really really really need to be able to see it in order to audit it (professionals don't).
UncleMeat 7y ago
There's no way to prove that any client hasn't tampered with a protocol. Halting problem and all that. But reading closed source code isn't hard. Most of whatsapp on android is implemented in dalvik bytecode, which is basically like reading source without good names or comments. And there are piles of professionals who are very skilled at reading decompiled binaries for the native code in the app. The idea that oss code is easy to verify and closed source code is impossible to verify is just bogus.

Even if they did, it would just mean that Facebook (WhatsApp's parent company) could now see your messages, but that is still no worse than the default Telegram setting, which guarantees that the company will be able to decrypt your messages. And what prevents Telegram from tampering with their own end-to-end encryption for the binary they upload to app stores? Hardly anyone compiles their own apps if they can download it from a convenient app store instead.

wrboyce 7y ago
Telegram clients are open source and have reproducible builds. There is so much FUD being spread in the comments here which could probably be resolved by sticking your HN comment directly into your search engine of choice. https://core.telegram.org/reproducible-builds https://core.telegram.org/reproducible-builds
- joshuaissac 7y ago
  They started having reproducible builds since the start of this month, when they released v5.13, and I admit that I had not checked to see if it had changed since the last time I looked. However, this still lets Telegram decrypt people's messages (on the default setting), which makes it less secure than WhatsApp and Signal. The article itself is riddled with FUD about WhatsApp, and the author has written similar FUD/unfounded claims before. 1. https://www.independent.co.uk/life-style/gadgets-and-tech/news/whatsapp-surveillance-privacy-telegram-pavel-durov-facebook-a9211151.html https://www.independent.co.uk/life-style/gadgets-and-tech/ne... 2. https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15 https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15
  - dancemethis1 7y ago
    FUD "against" proprietary software is pretty much the "reverse racism" of technology. Again, there is no proof OpenWhisper wasn't tampered with. It'd take WhatsApp becoming Free Software and having independent audits to be reliable as a communications platform. Suspiscion is but a matter of survival, and chances will continue to be usually against the most vulnerable party: the users.
    - UncleMeat 7y ago
      Why would it need to be Free? Surely a license for modifying the code has exactly nothing to do with being able to audit it. They could distribute the source in a different manner if you really really really need to be able to see it in order to audit it (professionals don't).

UncleMeat 7y ago

There's no way to prove that any client hasn't tampered with a protocol. Halting problem and all that. But reading closed source code isn't hard. Most of whatsapp on android is implemented in dalvik bytecode, which is basically like reading source without good names or comments. And there are piles of professionals who are very skilled at reading decompiled binaries for the native code in the app. The idea that oss code is easy to verify and closed source code is impossible to verify is just bogus.