8 ms·

WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarant

WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does.

OrgNet 6y ago
iMessage is e2e encrypted but Apple has the key... so I would not consider this e2e....
otachack 6y ago
You also have to trust the source code, or trust a recent audit, then also make sure the build you have kept it's integrity and matches the audit build.
- Moodles 6y ago
  The question was: do we have any reason to believe it's more secure than weChat? I say yes but those are all valid points.
- jdm2212 6y ago
  There are degrees of security between "I personally built it from source using a compiler I personally built from source" and "Xi Jinping is CC'ed a plaintext copy of every message". The allegation here is that WeChat is basically the latter. No one makes any remotely similar claim about iMessage or WhatsApp.
  - freepor 6y ago
    You forgot "I personally built it from source using a compiler I personally built from source with a micro-compiler that I handcoded in assembly on a computer that I assembled from transistors myself."
    - 9nGQluzmnq3M 6y ago
      But what if the transistors contain microchips that are phoning home? Clearly the only solution is to forage your own silicon for artisanal fabrication of your own chips.
      - LeonB 6y ago
        All of which you did inside a simulated world built for spying on you. There’s no theoretical ability to verify the whole stack.
  - jasdfijsflj 6y ago
    How about "Mark Zuckerberg is CC'ed a plaintext copy of every message"
    - MattGaiser 6y ago
      Better Zuckerberg than Xi. Zuckerberg has no power to have a bag put over anyone's head and have them carried away to the river.
      - deleted 6y ago
        [deleted]
      - pinewurst 6y ago
        Not yet anyway - remember his “listening” campaign and seeming murmurs of entering politics. He’s still young, unlike Winnie the Pooh...
        aplummer 6y ago
        Even if he did enter politics (in America), it’s not at all the same thing.
        pinewurst 6y ago
        I wouldn’t trust him not to use all the tools at his disposal to grasp the levers of power. He’s a stone sociopath IHMO.
  - jbombadil 6y ago
    If you have never read "Reflections on Trusting Trust" by Ken Thompson, I wholeheartedly recommend it. It's a short read (3 pages), but absolutely worht your time. https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...
    - notlukesky 6y ago
      Why is your link downvoted?
      - jdm2212 6y ago
        People might've mistaken it for pedantry/condescension? I certainly didn't take it that way (gave it an upvote) -- though I have read that paper, and was thinking of it when I wrote my original comment :)
        jbombadil 6y ago
        It was not my intention to be condescending. I legitimately enjoyed that paper (the technical part mostly), and thought it was relevant to what you were saying. I've found a lot of many interesting articles in hackernews comments and wanted to share one back.
madeofpalk 6y ago
We one downfall of iMessage is that because they facilitate key exchange, Apple can add their own key to your profile and read all your messages. Though, my limited understanding of iMessage is that if you were to sniff the network traffic you could detect this.
- modeless 6y ago
  There's another downfall of iMessage. If you have iCloud backup enabled, your iMessage encryption keys are saved to iCloud, allowing Apple to decrypt your messages. And even if you disable iCloud backup, Apple can still read your messages if the person you're talking to has iCloud backup enabled. This is not a secret, it's documented behavior. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 And it's not theoretical, because Apple does decrypt iMessage communications in response to law enforcement requests: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
  - deleted 6y ago
    [deleted]
  - madeofpalk 6y ago
    Are your iMessage encryption keys stored in iCloud? Or is a seperate copy of your messages (encrypted with a key Apple controls) uploaded to iCloud for sync? Edit: > Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple. So Messages in iCloud is end-to-end encrypted, but if you enable iCloud Backup (a different product/feature), then your backup will include the key used to encrypt it.
    - deleted 6y ago
      [deleted]
fossuser 6y ago
WhatsApp message content is secure, but metadata does get turned over in subpoenas.
- Moodles 6y ago
  The question was: do we have any reason to believe it is more secure than weChat? I say yes.
  - fossuser 6y ago
    Yeah I don't disagree, definitely the answer is yes - I was just adding some extra detail.
    - Moodles 6y ago
      Fair enough, good points
- ggus 6y ago
  whatsapp backups on google are not encrypted. anyone wanting to read the messages just has to ask google.
  - theelous3 6y ago
    That is if you allow backups, and considering 99.9% of messages are unimportant faff, there's not much reason to. I changed phones a while ago. Lost hundreds of thousands of messages. Didn't inconvenience me in the least. Anything important is on less ephemeral services like email or backed up manually.
- MattGaiser 6y ago
  > but metadata does get turned over in subpoenas. A subpoena is another form of security, at least as far as a free society is concerned.
sandworm101 6y ago
>> WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does. Except that there is no way to prove this. There is no way to prove that it isn't also sending a copy from the client back to the server. Whatsapp could deploy individualized specific clients to target users, perhaps at the behest of governments. The only full answer is totally open-source software with users able to cryptographically verify that they are downloading and running the same software as everyone else.
- zxcmx 6y ago
  That's still not a full answer, of course, your proprietary operating system or closed chipsets can spy on you. Absolutism isn't helpful IMHO, there is no true security in this world only degrees of trust and risk. You can always go one step further in securing a product but the first step still matters. I think there's real value in companies implementing e2e (and it's hard! it's super hard politically to get this done when the business sees little value for the effort and I know this because I've successfully fought to get e2e into a product). The reality from my point of view is that it takes idealists inside to convince a commercial entity to lock themselves out of value (commercial surveillance) they could capture. I find a company's stance on e2e to be a valuable signal.
  - danielheath 6y ago
    AFAIR Whatsapp does send a copy of your messages to facebook if the messages flag the apps internal 'sounds-like-criminal-activity' scanner.
    - zxcmx 6y ago
      Do you have a reference for this please? All I can find is this "false alarm": https://www.schneier.com/blog/archives/2019/08/more_on_backdoo.html https://www.schneier.com/blog/archives/2019/08/more_on_backd...

OrgNet 6y ago

iMessage is e2e encrypted but Apple has the key... so I would not consider this e2e....

otachack 6y ago

You also have to trust the source code, or trust a recent audit, then also make sure the build you have kept it's integrity and matches the audit build.

Moodles 6y ago
The question was: do we have any reason to believe it's more secure than weChat? I say yes but those are all valid points.
jdm2212 6y ago
There are degrees of security between "I personally built it from source using a compiler I personally built from source" and "Xi Jinping is CC'ed a plaintext copy of every message". The allegation here is that WeChat is basically the latter. No one makes any remotely similar claim about iMessage or WhatsApp.
- freepor 6y ago
  You forgot "I personally built it from source using a compiler I personally built from source with a micro-compiler that I handcoded in assembly on a computer that I assembled from transistors myself."
  - 9nGQluzmnq3M 6y ago
    But what if the transistors contain microchips that are phoning home? Clearly the only solution is to forage your own silicon for artisanal fabrication of your own chips.
    - LeonB 6y ago
      All of which you did inside a simulated world built for spying on you. There’s no theoretical ability to verify the whole stack.
- jasdfijsflj 6y ago
  How about "Mark Zuckerberg is CC'ed a plaintext copy of every message"
  - MattGaiser 6y ago
    Better Zuckerberg than Xi. Zuckerberg has no power to have a bag put over anyone's head and have them carried away to the river.
    - deleted 6y ago
      [deleted]
    - pinewurst 6y ago
      Not yet anyway - remember his “listening” campaign and seeming murmurs of entering politics. He’s still young, unlike Winnie the Pooh...
      - aplummer 6y ago
        Even if he did enter politics (in America), it’s not at all the same thing.
        pinewurst 6y ago
        I wouldn’t trust him not to use all the tools at his disposal to grasp the levers of power. He’s a stone sociopath IHMO.
- jbombadil 6y ago
  If you have never read "Reflections on Trusting Trust" by Ken Thompson, I wholeheartedly recommend it. It's a short read (3 pages), but absolutely worht your time. https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...
  - notlukesky 6y ago
    Why is your link downvoted?
    - jdm2212 6y ago
      People might've mistaken it for pedantry/condescension? I certainly didn't take it that way (gave it an upvote) -- though I have read that paper, and was thinking of it when I wrote my original comment :)
      - jbombadil 6y ago
        It was not my intention to be condescending. I legitimately enjoyed that paper (the technical part mostly), and thought it was relevant to what you were saying. I've found a lot of many interesting articles in hackernews comments and wanted to share one back.

madeofpalk 6y ago

We one downfall of iMessage is that because they facilitate key exchange, Apple can add their own key to your profile and read all your messages. Though, my limited understanding of iMessage is that if you were to sniff the network traffic you could detect this.

modeless 6y ago
There's another downfall of iMessage. If you have iCloud backup enabled, your iMessage encryption keys are saved to iCloud, allowing Apple to decrypt your messages. And even if you disable iCloud backup, Apple can still read your messages if the person you're talking to has iCloud backup enabled. This is not a secret, it's documented behavior. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 And it's not theoretical, because Apple does decrypt iMessage communications in response to law enforcement requests: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
- deleted 6y ago
  [deleted]
- madeofpalk 6y ago
  Are your iMessage encryption keys stored in iCloud? Or is a seperate copy of your messages (encrypted with a key Apple controls) uploaded to iCloud for sync? Edit: > Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple. So Messages in iCloud is end-to-end encrypted, but if you enable iCloud Backup (a different product/feature), then your backup will include the key used to encrypt it.
  - deleted 6y ago
    [deleted]

fossuser 6y ago

WhatsApp message content is secure, but metadata does get turned over in subpoenas.

Moodles 6y ago
The question was: do we have any reason to believe it is more secure than weChat? I say yes.
- fossuser 6y ago
  Yeah I don't disagree, definitely the answer is yes - I was just adding some extra detail.
  - Moodles 6y ago
    Fair enough, good points
ggus 6y ago
whatsapp backups on google are not encrypted. anyone wanting to read the messages just has to ask google.
- theelous3 6y ago
  That is if you allow backups, and considering 99.9% of messages are unimportant faff, there's not much reason to. I changed phones a while ago. Lost hundreds of thousands of messages. Didn't inconvenience me in the least. Anything important is on less ephemeral services like email or backed up manually.
MattGaiser 6y ago
> but metadata does get turned over in subpoenas. A subpoena is another form of security, at least as far as a free society is concerned.

sandworm101 6y ago

>> WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does. Except that there is no way to prove this. There is no way to prove that it isn't also sending a copy from the client back to the server. Whatsapp could deploy individualized specific clients to target users, perhaps at the behest of governments. The only full answer is totally open-source software with users able to cryptographically verify that they are downloading and running the same software as everyone else.

zxcmx 6y ago
That's still not a full answer, of course, your proprietary operating system or closed chipsets can spy on you. Absolutism isn't helpful IMHO, there is no true security in this world only degrees of trust and risk. You can always go one step further in securing a product but the first step still matters. I think there's real value in companies implementing e2e (and it's hard! it's super hard politically to get this done when the business sees little value for the effort and I know this because I've successfully fought to get e2e into a product). The reality from my point of view is that it takes idealists inside to convince a commercial entity to lock themselves out of value (commercial surveillance) they could capture. I find a company's stance on e2e to be a valuable signal.
- danielheath 6y ago
  AFAIR Whatsapp does send a copy of your messages to facebook if the messages flag the apps internal 'sounds-like-criminal-activity' scanner.
  - zxcmx 6y ago
    Do you have a reference for this please? All I can find is this "false alarm": https://www.schneier.com/blog/archives/2019/08/more_on_backdoo.html https://www.schneier.com/blog/archives/2019/08/more_on_backd...