5 ms·

E2E encryption in closed source automatically updated programs doesn't provide any real assurance: whoever makes the program can subvert your privacy at any tim

E2E encryption in closed source automatically updated programs doesn't provide any real assurance: whoever makes the program can subvert your privacy at any time. Do you trust the author of the program? Then E2E doesn't add much. Do you not trust the author of the program? E2E doesn't help. Either way, what's the point? Sure, I guess E2E provides some kind of additional privacy at the margin or something, but you can't rely on it for anything.

vlovich123 6y ago
Are you verifying that all your OSS binaries you’re running match a reproducible build hash that’s been validated by multiple trusted sources? If not, you’re already engaging in a level of trust. The real question is how do you establish trust in the code you run and while OSS provides benefits at the margin or something, you can’t really rely on it for anything. For an example to illustrate the fallacious reasoning of OSS = trust, consider the malicious compiler that Ken Thompson presented[1]. [1] https://wiki.c2.com/?TheKenThompsonHack https://wiki.c2.com/?TheKenThompsonHack
- ryukafalz 6y ago
  Not GP, but: although I'm not currently doing this consistently (I don't have the resources to set up build servers and there aren't many build servers for my distro yet) the distro I use does make it pretty straightforward to do this: https://guix.gnu.org/manual/en/html_node/Invoking-guix-challenge.html https://guix.gnu.org/manual/en/html_node/Invoking-guix-chall... If I want to do this for any particular package as a one-off, it's two commands.
  - vlovich123 6y ago
    Reproducible builds are a step up but remember that it requires you to build with the exact same binary-identical toolchain. If that’s already compromised your guix challenge isn’t really doing anything of value. Again, I’m not saying these aren’t valuable things that make attacks more difficult/expensive but the uncomfortable truth is we haven’t figured out how to truly establish zero-knowledge trust. So on that spectrum, ultimately Guix + OSS is closer to WhatsApp than where we’d like to be.
    - ryukafalz 6y ago
      I mean, sure, we're not there yet. If the Guix folks are able to get a bootstrap path going all the way from something like stage0, though, we'll be in a pretty good place I think: http://bootstrappable.org/projects/mes.html http://bootstrappable.org/projects/mes.html Maybe the current state is closer to WhatsApp than where we'd really like to be, but that should be a challenge rather than a reason to give up.
      - vlovich123 6y ago
        Never said anyone should give up but my point is that to my knowledge there's no actual proof of how to solve this. We're just stumbling in the dark trying ideas. I'm curious if you've actually had a chance to read Ken Thompson's compiler virus hack. The Guix bootstrap path from stage0 still doesn't solve the problem as at the end of the day all compilers eventually self-host from a previous version. So whatever compiler you're using for stage0 can have the virus, inject it into the produced binary, & you'll never find it since the virus is in the binary not in the source. Now obviously this is an extreme example and no one actually has any knowledge of whether or not such attacks are practical or have existence proofs beyond a proof of concept. My overall point though is that everything boils down to trust & the question is who you choose to trust & where. Ultimately, we're all "careless" on that front as there's just too many dimensions to evaluate on. Beyond just basic malware packaged with the code, is the privacy being respected? Are the security practices good enough to withstand attacks? etc etc. Complaining that WhatsApp is slurping a copy of your messages that you are reporting to them & therefore E2E encryption isn't valuable is a fallacious & misdirected argument IMHO.
        ryukafalz 6y ago
        >The Guix bootstrap path from stage0 still doesn't solve the problem as at the end of the day all compilers eventually self-host from a previous version. So whatever compiler you're using for stage0 can have the virus, inject it into the produced binary, & you'll never find it since the virus is in the binary not in the source. The point of stage0 is that it doesn't need to be compiled, only assembled, and that it's small enough to inspect the binary or assemble it by hand if you really wanted to. (Not that you necessarily want to, but if you have to...)
deleted 6y ago
[deleted]
KaiserPro 6y ago
> Do you trust the author of the program? I agree, but also if you don't trust the recipient you're sunk to. Perhaps the better way to do this is to ask for permission to screenshot the message. either way, if there is no way to send info about the messages that are "offending" there is no real way to police the spread of it. (assuming that you've done your encryption properly.)
sschueller 6y ago
It's a sales gimmick. Just like Apple claiming they care about your privacy but at the same time collect everything you open on your Mac.
varispeed 6y ago
To achieve truly E2E encryption one must assume the channel they communicate with is not secure and then perform encryption themselves. For example you can exchange keys offline and then send messages encrypted with PGP between each other. You could also convert encrypted messages to text, so that it is less obvious it is encrypted.
Scarbutt 6y ago
Yep that's a weird title, in layman terms, whatsapp can read all your messages.
rand0mx1 6y ago
According to the article, recent messages will be sent to whatsapp on reporting contacts or groups just like we sent messages to other users. There is no mention of E2E encryption implemented by whatsapp and its loopholes.

vlovich123 6y ago

Are you verifying that all your OSS binaries you’re running match a reproducible build hash that’s been validated by multiple trusted sources? If not, you’re already engaging in a level of trust. The real question is how do you establish trust in the code you run and while OSS provides benefits at the margin or something, you can’t really rely on it for anything. For an example to illustrate the fallacious reasoning of OSS = trust, consider the malicious compiler that Ken Thompson presented[1]. [1] https://wiki.c2.com/?TheKenThompsonHack https://wiki.c2.com/?TheKenThompsonHack

ryukafalz 6y ago
Not GP, but: although I'm not currently doing this consistently (I don't have the resources to set up build servers and there aren't many build servers for my distro yet) the distro I use does make it pretty straightforward to do this: https://guix.gnu.org/manual/en/html_node/Invoking-guix-challenge.html https://guix.gnu.org/manual/en/html_node/Invoking-guix-chall... If I want to do this for any particular package as a one-off, it's two commands.
- vlovich123 6y ago
  Reproducible builds are a step up but remember that it requires you to build with the exact same binary-identical toolchain. If that’s already compromised your guix challenge isn’t really doing anything of value. Again, I’m not saying these aren’t valuable things that make attacks more difficult/expensive but the uncomfortable truth is we haven’t figured out how to truly establish zero-knowledge trust. So on that spectrum, ultimately Guix + OSS is closer to WhatsApp than where we’d like to be.
  - ryukafalz 6y ago
    I mean, sure, we're not there yet. If the Guix folks are able to get a bootstrap path going all the way from something like stage0, though, we'll be in a pretty good place I think: http://bootstrappable.org/projects/mes.html http://bootstrappable.org/projects/mes.html Maybe the current state is closer to WhatsApp than where we'd really like to be, but that should be a challenge rather than a reason to give up.
    - vlovich123 6y ago
      Never said anyone should give up but my point is that to my knowledge there's no actual proof of how to solve this. We're just stumbling in the dark trying ideas. I'm curious if you've actually had a chance to read Ken Thompson's compiler virus hack. The Guix bootstrap path from stage0 still doesn't solve the problem as at the end of the day all compilers eventually self-host from a previous version. So whatever compiler you're using for stage0 can have the virus, inject it into the produced binary, & you'll never find it since the virus is in the binary not in the source. Now obviously this is an extreme example and no one actually has any knowledge of whether or not such attacks are practical or have existence proofs beyond a proof of concept. My overall point though is that everything boils down to trust & the question is who you choose to trust & where. Ultimately, we're all "careless" on that front as there's just too many dimensions to evaluate on. Beyond just basic malware packaged with the code, is the privacy being respected? Are the security practices good enough to withstand attacks? etc etc. Complaining that WhatsApp is slurping a copy of your messages that you are reporting to them & therefore E2E encryption isn't valuable is a fallacious & misdirected argument IMHO.
      - ryukafalz 6y ago
        >The Guix bootstrap path from stage0 still doesn't solve the problem as at the end of the day all compilers eventually self-host from a previous version. So whatever compiler you're using for stage0 can have the virus, inject it into the produced binary, & you'll never find it since the virus is in the binary not in the source. The point of stage0 is that it doesn't need to be compiled, only assembled, and that it's small enough to inspect the binary or assemble it by hand if you really wanted to. (Not that you necessarily want to, but if you have to...)

deleted 6y ago

[deleted]

KaiserPro 6y ago

> Do you trust the author of the program? I agree, but also if you don't trust the recipient you're sunk to. Perhaps the better way to do this is to ask for permission to screenshot the message. either way, if there is no way to send info about the messages that are "offending" there is no real way to police the spread of it. (assuming that you've done your encryption properly.)

sschueller 6y ago

It's a sales gimmick. Just like Apple claiming they care about your privacy but at the same time collect everything you open on your Mac.

varispeed 6y ago

To achieve truly E2E encryption one must assume the channel they communicate with is not secure and then perform encryption themselves. For example you can exchange keys offline and then send messages encrypted with PGP between each other. You could also convert encrypted messages to text, so that it is less obvious it is encrypted.

Scarbutt 6y ago

Yep that's a weird title, in layman terms, whatsapp can read all your messages.

rand0mx1 6y ago

According to the article, recent messages will be sent to whatsapp on reporting contacts or groups just like we sent messages to other users. There is no mention of E2E encryption implemented by whatsapp and its loopholes.