11 ms·
Did anyone actually think WeChat communications are secure? Do we have reason to believe iMessage and Whatsapp are more secure?
by bgorman 6y ago
Did anyone actually think WeChat communications are secure?
Do we have reason to believe iMessage and Whatsapp are more secure?
- xvector 6y agowrt iMessage, yes, it’s E2EE and the keys are not stored in iCloud if you disable iMessage backup. Granted Apple still owns the keyset gets so, eh, depends on how paranoid you wanna get.
- Aperocky 6y agoAny time others have access to your keys the only logical assumption is that they already know. Relying on goodwill is just naive
- snazz 6y agoYep. WhatsApp is better and Signal is better still, but iMessage's level of privacy and security is more than enough for someone who isn't specifically targeted by a nation-state-level actor.
- maximente 6y agoit is critical to note that you also need to disable backing up your iPhone in iCloud to defeat having your key stored in iCloud: https://support.apple.com/en-us/HT207428 https://support.apple.com/en-us/HT207428
- modeless 6y agoIt is also critical to note that everyone you communicate with needs to do this too, or Apple can still read your messages to them.
- Moodles 6y agoWhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does.
- OrgNet 6y agoiMessage is e2e encrypted but Apple has the key... so I would not consider this e2e....
- otachack 6y agoYou also have to trust the source code, or trust a recent audit, then also make sure the build you have kept it's integrity and matches the audit build.
- Moodles 6y agoThe question was: do we have any reason to believe it's more secure than weChat? I say yes but those are all valid points.
- jdm2212 6y agoThere are degrees of security between "I personally built it from source using a compiler I personally built from source" and "Xi Jinping is CC'ed a plaintext copy of every message". The allegation here is that WeChat is basically the latter. No one makes any remotely similar claim about iMessage or WhatsApp.
- freepor 6y agoYou forgot "I personally built it from source using a compiler I personally built from source with a micro-compiler that I handcoded in assembly on a computer that I assembled from transistors myself."
- 9nGQluzmnq3M 6y agoBut what if the transistors contain microchips that are phoning home? Clearly the only solution is to forage your own silicon for artisanal fabrication of your own chips.
- LeonB 6y ago
- madeofpalk 6y agoI mean there’s a white paper on iMessage’s security, and there isn’t (i don’t think) on WeChat. WhatsApp’s encryption uses libsignal. The security qualities of iMessage and WhatsApp is known. It’s not of WeChat.
- KeepFlying 6y agoThere's a whitepaper on iMessage's security as it was at a single point in time. It may be possible to verify this on a recent build with enough effort, but the average user will never be able to make that validation. So we can't be completely secure there. More secure than WeChat? ABSA-FREAKING-LUTELY. And do I trust Apple to remain secure? Yes. I'm mostly putting this here because I've heard people talking about security guarantees without considering tweaks in the supply chain or binary deliveries. Even Signal could get breached with enough effort from Google to push new bits and bypass certificate validation. (Though practically that is not going to happen.)
- dionian 6y agoI know this is not really scientific, but: Apple's business model makes me more likely to trust them over Facebook.
- KeepFlying 6y agoSame. I'm more inclined to trust apple on privacy than most of the other big companies.
- LeoPanthera 6y agoThe white paper(s) are regularly updated, and were last published Spring 2020, so "a single point in time" is not accurate. https://support.apple.com/guide/security/welcome/web https://support.apple.com/guide/security/welcome/web
- gbrown 6y ago1. No 2. Secure? No. More secure? Yes.
- ggus 6y agoWhatsApp backups created by the built-in backup option of the messaging client on Android are not encrypted when they are transferred to Google Drive.
- FreakyT 6y agoThis narrative of false equivalency is dangerous, IMO. WeChat has been proven to be a heavily monitored and censored network. Whatever security failings iMessage and WhatsApp have, they pale in comparison to what's in place for WeChat.
- pengaru 6y ago> This narrative of false equivalency is dangerous, IMO. What's dangerous is convincing yourself that proprietary systems won't betray your trust.
- namelosw 6y agoFor me, this narrative seems to remind people don't over trust iMessage and WhatsApp, instead of "why don't you use Wechat they are not different anyway". All the westerners I know in China don't send sensitive information through Wechat. It's just good to have a low trust stance by default.
- ColanR 6y agoI think the assumption behind your claim of false equivalency is exactly what the parent comment wanted to discuss. You say the security failings of iMessage and WhatsApp pale in comparison to WeChat; I agree with parent comment and ask - in light of PRISM etc. - on what grounds can you say we should not be just as suspicious?
- 6y ago
- Barrin92 6y agoAll the technical explanations already given aside, the fact that companies in the US can and do resist attempts to undermine cryptography (see the San Bernardino case), and that there's an actual transparent public legal system where we can all follow along. It's not perfect but compared to the pretty much unlimited control the Chinese censors have over their companies it's a hell of a lot more trustworthy.
- 6gvONxR4sf7o 6y agoIt's really dangerous to downplay bad news with "Geez, you're surprised at this news? What a moron." It's newsworthy for badness, not for unexpectedness.