4 ms·

I must say, it is unclear to me why this is being downvoted -- it mirrors my exact reaction. The old saying "Actions speak louder than words" has never been mo

I must say, it is unclear to me why this is being downvoted -- it mirrors my exact reaction. The old saying "Actions speak louder than words" has never been more apt. It was just two days ago that Ars & others ran "WhatsApp "end-to-end encrypted" messages aren't that private after all" [1]. Yet, here we are. It's a strong "No thanks" from me. [1] https://arstechnica.com/gadgets/2021/09/whatsapp-end-to-end-encrypted-messages-arent-that-private-after-all/ https://arstechnica.com/gadgets/2021/09/whatsapp-end-to-end-...

FiloSottile 5y ago
I don’t trust Facebook’s intentions, but WhatsApp has demonstrated consistency in bringing encryption to users. The ProPublica article that the ones you saw are based on was flawed, and has been updated. https://twitter.com/propublica/status/1436054877663375372 https://twitter.com/propublica/status/1436054877663375372
- ziddoap 5y ago
  Thanks for linking that, I had not actually seen the update to it. Of course, if one of the parties in E2EE shares the message it doesn't constitute a 'break' in E2EE. However, what I think was important from the Ars article I linked was this statement: >An "end-to-end" encrypted messaging platform could choose to, for example, perform automated AI-based content scanning of all messages on a device, then forward automatically flagged messages to the platform's cloud for further action. Ultimately, privacy-focused users must rely on policies and platform trust as heavily as they do on technological bullet points. Which doesn't break E2EE technically, but it certainly breaks it in spirit. And yes, I understand that really any application could feasibly implement something like this, it's not in many peoples threat models, etc. However, if I had to bet on which company would implement such a feature, it would be FB. It just felt sort of funny, seeing this only a few days after all of those articles were written. Of course there is no way FB weaved the whole system and documentation together in two days, but I can't help but roll my eyes slightly at the timing of their release.
  - fsociety 5y ago
    Your concerns seem reasonable and well-grounded, it’s just odd to insinuate a conspiracy of how these articles were released. It probably was a reaction but it a perfectly reasonable thing to do. WhatsApp is committed to being transparent, and this is apart of it. If you are highly principled about privacy or doing sketchy things yeah… don’t trust any software from for-profit companies.
shawnz 5y ago
Isn't the rollout of this encrypted backup functionality an "action"? And isn't the consistent availability of E2E encryption in WhatsApp an "action"? Whereas it seems to me like the idea that WhatsApp shouldn't be trusted just because of who they answer to is merely "words".
annadane 5y ago
>it is unclear to me why this is being downvoted I would tell you why, but you're not allowed to according to site rules (it rhymes with 'billing')
rocqua 5y ago
That link doesn't show Facebook broke e2e encryption. It shows Facebook build a possibility of the other secure end forwarding your message voluntarily to Facebook for review. E2E is only as secure as the other end.

FiloSottile 5y ago

I don’t trust Facebook’s intentions, but WhatsApp has demonstrated consistency in bringing encryption to users. The ProPublica article that the ones you saw are based on was flawed, and has been updated. https://twitter.com/propublica/status/1436054877663375372 https://twitter.com/propublica/status/1436054877663375372

ziddoap 5y ago
Thanks for linking that, I had not actually seen the update to it. Of course, if one of the parties in E2EE shares the message it doesn't constitute a 'break' in E2EE. However, what I think was important from the Ars article I linked was this statement: >An "end-to-end" encrypted messaging platform could choose to, for example, perform automated AI-based content scanning of all messages on a device, then forward automatically flagged messages to the platform's cloud for further action. Ultimately, privacy-focused users must rely on policies and platform trust as heavily as they do on technological bullet points. Which doesn't break E2EE technically, but it certainly breaks it in spirit. And yes, I understand that really any application could feasibly implement something like this, it's not in many peoples threat models, etc. However, if I had to bet on which company would implement such a feature, it would be FB. It just felt sort of funny, seeing this only a few days after all of those articles were written. Of course there is no way FB weaved the whole system and documentation together in two days, but I can't help but roll my eyes slightly at the timing of their release.
- fsociety 5y ago
  Your concerns seem reasonable and well-grounded, it’s just odd to insinuate a conspiracy of how these articles were released. It probably was a reaction but it a perfectly reasonable thing to do. WhatsApp is committed to being transparent, and this is apart of it. If you are highly principled about privacy or doing sketchy things yeah… don’t trust any software from for-profit companies.

shawnz 5y ago

Isn't the rollout of this encrypted backup functionality an "action"? And isn't the consistent availability of E2E encryption in WhatsApp an "action"? Whereas it seems to me like the idea that WhatsApp shouldn't be trusted just because of who they answer to is merely "words".

annadane 5y ago

>it is unclear to me why this is being downvoted I would tell you why, but you're not allowed to according to site rules (it rhymes with 'billing')

rocqua 5y ago

That link doesn't show Facebook broke e2e encryption. It shows Facebook build a possibility of the other secure end forwarding your message voluntarily to Facebook for review. E2E is only as secure as the other end.