4 ms·

> WhatsApp can't inspect your messages That's what I've always believed too, signal & moxie did their encryption. How do we know that it is true? You can make

by harry8 4y ago

> WhatsApp can't inspect your messages That's what I've always believed too, signal & moxie did their encryption. How do we know that it is true? You can make a pretty strong case with reproduce-able builds, md5 sums on a published client codebase with signal, right? Is that the same for WhatsApp? Sure we might trust Moxie to a certain extent, why not? But even if that's good enough (?) how would we know if whatsapp changed things since? Everyone with commit access will be known to the CIA, NSA, Mossad, Saudi Intelligence, the GRU, MI6 and all the rest including organized crime with a view to compromising things to their advantage somehow.

bedast 4y ago
What they can see are reported messages. The reporter would be responsible for sending the cleartext message being reported. The encryption isn't being broken in this process, but rather the decrypted result is being sent somewhere else. The same problem exists if you screenshot it or copy the text and paste it elsewhere. Not advocating for WhatsApp or anything, but it's useful to understand what's actually going on to make informed decisions on what apps you use and how they can be used or abused against you. So in this case, WhatsApp is less of a threat actor, and it's more about who you trust with your communications. Personally, I prefer Signal.
- harry8 4y ago
  This is pretty obvious to everyone that you can photograph and publish something private and it no longer is private. This fact has absolutely nothing at all to say about the question raised about how do we know whatsapp encryption is still e2e and trustworthy. But it's the only response. Sadface.
  - bedast 4y ago
    We can't really know if they broke their implementation of the Signal protocol because it's not open source and the code cannot be reviewed by the public. However, they have openly explained how reporting messages exposes the contents of messages and why it doesn't break the E2EE. All we can do is trust their explanation. Or, don't. And don't use it. I don't.

by harry8 4y ago

bedast 4y ago

What they can see are reported messages. The reporter would be responsible for sending the cleartext message being reported. The encryption isn't being broken in this process, but rather the decrypted result is being sent somewhere else. The same problem exists if you screenshot it or copy the text and paste it elsewhere. Not advocating for WhatsApp or anything, but it's useful to understand what's actually going on to make informed decisions on what apps you use and how they can be used or abused against you. So in this case, WhatsApp is less of a threat actor, and it's more about who you trust with your communications. Personally, I prefer Signal.

harry8 4y ago
This is pretty obvious to everyone that you can photograph and publish something private and it no longer is private. This fact has absolutely nothing at all to say about the question raised about how do we know whatsapp encryption is still e2e and trustworthy. But it's the only response. Sadface.
- bedast 4y ago
  We can't really know if they broke their implementation of the Signal protocol because it's not open source and the code cannot be reviewed by the public. However, they have openly explained how reporting messages exposes the contents of messages and why it doesn't break the E2EE. All we can do is trust their explanation. Or, don't. And don't use it. I don't.