4 ms·

> from people who pushed WhatsApp So Facebook?

eitland 5y ago
No, I'm thinking about well meaning security people who focused a bit too much on E2E-encryption and forgot that WhatsApp sent metadata in bulk to Facebook and uploaded backups unencrypted to Google and/or iCloud.
- Ar-Curunir 5y ago
  As opposed to Telegram, where chats are unencrypted by default, and synced to the cloud?
  - eitland 5y ago
    are we a community of technical people or sleazy sales people? What you say about being synced to the cloud in a way that can be decrypted is correct and can be problematic for some people but calling it unencrypted is wrong and detracts from your message.
    - maqp 5y ago
      Saying the database is encrypted when the database key has to sit in the RAM of the server is as disingenuous as saying this is proper way to lock up gems: https://i.imgur.com/0gBOPoQ.png https://i.imgur.com/0gBOPoQ.png You're basically arguing that "you can't say it's not locked when the lock is right there"
      - Dah00n 5y ago
        Your comment says nothing about what GP actually stated.
        maqp 5y ago
        Calling Telegram unencrypted isn't practically wrong when the key is stored right next to the data.
      - eitland 5y ago
        > Saying the database is encrypted when the database key has to sit in the RAM of the server First you are replying to something I didn't say. Secondly, going down that path and applying it as strictly to everything you'll find that nothing is encrypted: not your communication with the bank, certainly not WhatsApp as it stores temporary databases unencrypted (not only with a password stored in ram) and probably not much else either. In fact I guess if we apply your criteria to Signal clients they are not encrypted either.
- maqp 5y ago
  >forgot that WhatsApp uploaded backups unencrypted to Google and/or iCloud. This might finally get fixed: https://www.theverge.com/2021/7/16/22580800/icloud-google-drive-encrypted-whatsapp-cloud-backup https://www.theverge.com/2021/7/16/22580800/icloud-google-dr... Great news because it disproves Durov's BS that claims you can't have backups without giving the vendor the access.
  - eitland 5y ago
    Did he claim that? I'm fairly sure his claim was that it was easier to do it this way.
    - maqp 5y ago
      "Secret chats are e2e-encrypted chats that never under any circumstances get backed up. Cloud chats are encrypted in the same way, but also have a built-in cloud backup. " https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by-Default-08-14 https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by... Of course he's not dumb enough to walk into the mine of saying it directly. But he justifies the need to split chats in the context of backups, which gives any reader an impression you can't do client-side encrypted cloud backups on secret chats. He never even tries to explain why he doesn't try to bridge the feature gap.

No, I'm thinking about well meaning security people who focused a bit too much on E2E-encryption and forgot that WhatsApp sent metadata in bulk to Facebook and uploaded backups unencrypted to Google and/or iCloud.

Ar-Curunir 5y ago
As opposed to Telegram, where chats are unencrypted by default, and synced to the cloud?
- eitland 5y ago
  are we a community of technical people or sleazy sales people? What you say about being synced to the cloud in a way that can be decrypted is correct and can be problematic for some people but calling it unencrypted is wrong and detracts from your message.
  - maqp 5y ago
    Saying the database is encrypted when the database key has to sit in the RAM of the server is as disingenuous as saying this is proper way to lock up gems: https://i.imgur.com/0gBOPoQ.png https://i.imgur.com/0gBOPoQ.png You're basically arguing that "you can't say it's not locked when the lock is right there"
    - Dah00n 5y ago
      Your comment says nothing about what GP actually stated.
      - maqp 5y ago
        Calling Telegram unencrypted isn't practically wrong when the key is stored right next to the data.
    - eitland 5y ago
      > Saying the database is encrypted when the database key has to sit in the RAM of the server First you are replying to something I didn't say. Secondly, going down that path and applying it as strictly to everything you'll find that nothing is encrypted: not your communication with the bank, certainly not WhatsApp as it stores temporary databases unencrypted (not only with a password stored in ram) and probably not much else either. In fact I guess if we apply your criteria to Signal clients they are not encrypted either.
maqp 5y ago
>forgot that WhatsApp uploaded backups unencrypted to Google and/or iCloud. This might finally get fixed: https://www.theverge.com/2021/7/16/22580800/icloud-google-drive-encrypted-whatsapp-cloud-backup https://www.theverge.com/2021/7/16/22580800/icloud-google-dr... Great news because it disproves Durov's BS that claims you can't have backups without giving the vendor the access.
- eitland 5y ago
  Did he claim that? I'm fairly sure his claim was that it was easier to do it this way.
  - maqp 5y ago
    "Secret chats are e2e-encrypted chats that never under any circumstances get backed up. Cloud chats are encrypted in the same way, but also have a built-in cloud backup. " https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by-Default-08-14 https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by... Of course he's not dumb enough to walk into the mine of saying it directly. But he justifies the need to split chats in the context of backups, which gives any reader an impression you can't do client-side encrypted cloud backups on secret chats. He never even tries to explain why he doesn't try to bridge the feature gap.