4 ms·
Because the number of people who can actually validate the security of the open source options is vanishingly small and assessments like this provide sufficient
by jensensbutton 5y ago
Because the number of people who can actually validate the security of the open source options is vanishingly small and assessments like this provide sufficient evidence that WhatsApp's claims are not bunk.
- thevardanian 5y agoYou just need one. Vanishingly small or not.
- charcircuit 5y agoOne person can always make a mistake. Also every update can introduce security problems. It's not a one time thing.
- eitland 5y ago> Because the number of people who can actually validate the security of the open source options is vanishingly small The people who can judge if Facebook are to be trusted should be in the millions by now though...
- philliphaydon 5y agoI have no faith as I still get facebook adverts shortly after discussing things in whats app.
- jacquesm 5y ago> and assessments like this provide sufficient evidence that WhatsApp's claims are not bunk. Actually, no that's not sufficient evidence. That's only sufficient evidence for those interactions between the auditors and whatsapp's servers, it doesn't say anything about your interaction with whatsapp's servers. And that's the heart of the problem: using code shipped to a browser for e2e encryption is a flawed model, it would be trivial to target you with a version that has broken e2e encryption but subtle enough that you would never notice.
- jensensbutton 5y agoSure it's not sufficient to formally prove security of the system e2e, but i'd guess it's sufficient for the average user. As for shipping a client with broken encryption... Aren't people using Signal (like the person I originally responded to suggested) at risk of the same thing? Nobody's verifying checksums on every update except for people who aren't using WhatsApp for their comms anyway.