4 ms·

If the client is closed source, and developed by an untrustworthy company, e2ee doesn't matter.

londons_explore 4y ago
I disagree. Even a closed source client soon has opensource 'compatible' clients. To build those, you need to reverse engineer/understand the crypto. In the process of doing that, you will likely uncover any systemic flaw that reveals every conversation to a passive attacker. That effectively leaves the 'send a secret message to leak the key' type backdoors that the client could have. However, if this functionality existed and was used on every chat, then it is quickly discovered by anyone debugging the unofficial client. So the only remaining 'loophole' is that there is a backdoor in the official client, but that it is only used very rarely or on request. That in turn means that facebook can't go do large scale data mining on the private chats. Thats a win.
- Y_Y 4y ago
  When had anyone reverse engineered their way to a compatible client for FB Messenger or WhatsApp? To my knowledge there are only hacky bridges that involve running the official client under the hood.
  - londons_explore 4y ago
    [1] is that for whatsapp. It implements everything from scratch, including the crypto and all the many layers of message encapsulation. I believe there are a few other clients too. It even implements the API's to create a new account, so you don't even need to touch their client code at all. FB messenger doesn't yet have e2e encryption, so there hasn't yet been any need. [1]: https://github.com/tgalal/yowsup https://github.com/tgalal/yowsup
    - deleted 4y ago
      [deleted]
    - btdmaster 4y ago
      It looks like they're getting users banned [0] for using alternative clients. [0] https://github.com/tgalal/yowsup/issues?q=is%3Aissue+is%3Aopen+ban https://github.com/tgalal/yowsup/issues?q=is%3Aissue+is%3Aop...
      - saurik 4y ago
        That doesn't mean it didn't work; in fact, quite the opposite!
masterof0 4y ago
Taking into account that they are known to work closely with the FBI. So what they call e2ee cryptography is ridiculous. Their business is built off violating users privacy, why would anyone trust them? They've got your keys. Signal exists for this very reason.
- f38zf5vdt 4y ago
  Technically we also trust Signal not to push a signed update to their software that exfiltrates our keys. Whether or not Meta is doing E2EE should be clear from snooping their protocol or reverse engineering the software.
  - _Algernon_ 4y ago
    Nothing is stopping you from auditing the code and building the client software yourself: https://github.com/signalapp https://github.com/signalapp You don't even have that option with closed source software.
- onlyrealcuzzo 4y ago
  I think some users might be happy that the average FB engineer can't just see all their messages. That the FBI can is a concern to absolutists, but I don't think the masses.
  - masterof0 4y ago
    > I think some users might be happy that the average FB engineer can't just see all their messages. Maybe not the regular L4 SDE, but the people who are supposed to see it, can and will see it.
- deleted 4y ago
  [deleted]
- baby 4y ago
  > Taking into account that they are known to work closely with the FBI This is basically true for any sizable company in the US. And this is also true with small companies. If the FBI wants to work with you, you don't really have a choice. And if you're not in the US, you're working with whoever is the FBI in that country.
AdrenalinMd 4y ago
An open source client gives a false sense of security as the APK you're downloading is compiled. In the end you still need to decompile the APK to know what it is really doing. Open source client doesn't matter in mobile world, as you never compile the app yourself. This is only misleading to the non-tech users who don't get how the whole thing works. That's why Telegram's claim of security is total garbage because while their client is "open source", the backend is that has all the messages is not. Something they don't clearly state on their website. So the Telegram's admins can read all the messages in plain text on the backend. So "open source" client means absolutely nothing for the security.
- sebzim4500 4y ago
  IIRC you can encrypt direct messages on Telegram, so there is some security there. I'd still rather use Signal though.
- quyleanh 4y ago
  True. And the Telegram founder still proud for their privacy. Lol
- NayamAmarshe 4y ago
  > An open source client gives a false sense of security as the APK you're downloading is compiled. In the end you still need to decompile the APK to know what it is really doing. Okay, so we're ignoring verifiable builds exist? > Open source client doesn't matter in mobile world, as you never compile the app yourself. That's a really weird take. Nobody ever checks files for corruption or modification but hashes still exist. Just because most people do not check something does not mean it's non-existent or pointless. > So the Telegram's admins can read all the messages in plain text on the backend. They can't. The messages are encrypted on the servers and their keys are split between multiple jurisdictions. No engineer can decrypt messages.
  - AdrenalinMd 4y ago
    >They can't. The messages are encrypted on the servers and their keys are split between multiple jurisdictions. No engineer can decrypt messages. You really don't get why E2E encryption is necessary, do you?
deleted 4y ago
[deleted]
rainsford 4y ago
I wish this type of comment wouldn't inevitably come up in these discussions. Not only is it fundamentally wrong but it's actively harmful to improving security and privacy by scaring people away from things that may be just fine and that are probably better than a lot of the insecure alternatives they'll actually use instead. To the extent open source matters at all when looking at E2E encryption, it theoretically makes it easier to see whether the source code implements a secure protocol. This sounds much more useful than it actually is. For one thing, almost nobody is compiling the source code themselves, so you're ultimately going to have to evaluate the security of compiled code anyways. Also there is an incredibly vast gap between the promise and reality of the open source promise in terms of finding security problems. Accidental or deliberate weaknesses can be subtle and hard to find whether or not you have the code. The extensive history of serious cryptographic problems living in open source code for years before they were found and people regularly being able to find problems in software despite it being closed source suggests open source as a security panacea should be taken with a large grain of salt.
- ggm 4y ago
  I think your analysis is harsh, and over-stated. At worst people have ignored the potential to find problems from source code review. At best people have discovered security holes in closed-source cryptography code. They are not equal to effect and motivations of either user or finder. I would like to understand if you consider signal (for example, as a very large community of use e2ee with open source) has substantive problems due to people "not looking hard enough"
- NayamAmarshe 4y ago
  I can't believe we're really debating that using E2EE and closed source in the same sentence is not that great. E2EE without verifiable builds is as good as a cheeto lock. Even with all the E2EE claims, Facebook could still do anything with the data and you could never hold them accountable because the binary code is obfuscated in the first place so all you would really have is half-reverse engineered stuff that also breaks WhatsApp's terms of use policy. Please stop defending FB, everytime someone does it, they prove all of you wrong again.

I disagree. Even a closed source client soon has opensource 'compatible' clients. To build those, you need to reverse engineer/understand the crypto. In the process of doing that, you will likely uncover any systemic flaw that reveals every conversation to a passive attacker. That effectively leaves the 'send a secret message to leak the key' type backdoors that the client could have. However, if this functionality existed and was used on every chat, then it is quickly discovered by anyone debugging the unofficial client. So the only remaining 'loophole' is that there is a backdoor in the official client, but that it is only used very rarely or on request. That in turn means that facebook can't go do large scale data mining on the private chats. Thats a win.

Y_Y 4y ago
When had anyone reverse engineered their way to a compatible client for FB Messenger or WhatsApp? To my knowledge there are only hacky bridges that involve running the official client under the hood.
- londons_explore 4y ago
  [1] is that for whatsapp. It implements everything from scratch, including the crypto and all the many layers of message encapsulation. I believe there are a few other clients too. It even implements the API's to create a new account, so you don't even need to touch their client code at all. FB messenger doesn't yet have e2e encryption, so there hasn't yet been any need. [1]: https://github.com/tgalal/yowsup https://github.com/tgalal/yowsup
  - deleted 4y ago
    [deleted]
  - btdmaster 4y ago
    It looks like they're getting users banned [0] for using alternative clients. [0] https://github.com/tgalal/yowsup/issues?q=is%3Aissue+is%3Aopen+ban https://github.com/tgalal/yowsup/issues?q=is%3Aissue+is%3Aop...
    - saurik 4y ago
      That doesn't mean it didn't work; in fact, quite the opposite!

masterof0 4y ago

Taking into account that they are known to work closely with the FBI. So what they call e2ee cryptography is ridiculous. Their business is built off violating users privacy, why would anyone trust them? They've got your keys. Signal exists for this very reason.

f38zf5vdt 4y ago
Technically we also trust Signal not to push a signed update to their software that exfiltrates our keys. Whether or not Meta is doing E2EE should be clear from snooping their protocol or reverse engineering the software.
- _Algernon_ 4y ago
  Nothing is stopping you from auditing the code and building the client software yourself: https://github.com/signalapp https://github.com/signalapp You don't even have that option with closed source software.
onlyrealcuzzo 4y ago
I think some users might be happy that the average FB engineer can't just see all their messages. That the FBI can is a concern to absolutists, but I don't think the masses.
- masterof0 4y ago
  > I think some users might be happy that the average FB engineer can't just see all their messages. Maybe not the regular L4 SDE, but the people who are supposed to see it, can and will see it.
deleted 4y ago
[deleted]
baby 4y ago
> Taking into account that they are known to work closely with the FBI This is basically true for any sizable company in the US. And this is also true with small companies. If the FBI wants to work with you, you don't really have a choice. And if you're not in the US, you're working with whoever is the FBI in that country.

AdrenalinMd 4y ago

An open source client gives a false sense of security as the APK you're downloading is compiled. In the end you still need to decompile the APK to know what it is really doing. Open source client doesn't matter in mobile world, as you never compile the app yourself. This is only misleading to the non-tech users who don't get how the whole thing works. That's why Telegram's claim of security is total garbage because while their client is "open source", the backend is that has all the messages is not. Something they don't clearly state on their website. So the Telegram's admins can read all the messages in plain text on the backend. So "open source" client means absolutely nothing for the security.

sebzim4500 4y ago
IIRC you can encrypt direct messages on Telegram, so there is some security there. I'd still rather use Signal though.
quyleanh 4y ago
True. And the Telegram founder still proud for their privacy. Lol
NayamAmarshe 4y ago
> An open source client gives a false sense of security as the APK you're downloading is compiled. In the end you still need to decompile the APK to know what it is really doing. Okay, so we're ignoring verifiable builds exist? > Open source client doesn't matter in mobile world, as you never compile the app yourself. That's a really weird take. Nobody ever checks files for corruption or modification but hashes still exist. Just because most people do not check something does not mean it's non-existent or pointless. > So the Telegram's admins can read all the messages in plain text on the backend. They can't. The messages are encrypted on the servers and their keys are split between multiple jurisdictions. No engineer can decrypt messages.
- AdrenalinMd 4y ago
  >They can't. The messages are encrypted on the servers and their keys are split between multiple jurisdictions. No engineer can decrypt messages. You really don't get why E2E encryption is necessary, do you?

deleted 4y ago

[deleted]

rainsford 4y ago

I wish this type of comment wouldn't inevitably come up in these discussions. Not only is it fundamentally wrong but it's actively harmful to improving security and privacy by scaring people away from things that may be just fine and that are probably better than a lot of the insecure alternatives they'll actually use instead. To the extent open source matters at all when looking at E2E encryption, it theoretically makes it easier to see whether the source code implements a secure protocol. This sounds much more useful than it actually is. For one thing, almost nobody is compiling the source code themselves, so you're ultimately going to have to evaluate the security of compiled code anyways. Also there is an incredibly vast gap between the promise and reality of the open source promise in terms of finding security problems. Accidental or deliberate weaknesses can be subtle and hard to find whether or not you have the code. The extensive history of serious cryptographic problems living in open source code for years before they were found and people regularly being able to find problems in software despite it being closed source suggests open source as a security panacea should be taken with a large grain of salt.

ggm 4y ago
I think your analysis is harsh, and over-stated. At worst people have ignored the potential to find problems from source code review. At best people have discovered security holes in closed-source cryptography code. They are not equal to effect and motivations of either user or finder. I would like to understand if you consider signal (for example, as a very large community of use e2ee with open source) has substantive problems due to people "not looking hard enough"
NayamAmarshe 4y ago
I can't believe we're really debating that using E2EE and closed source in the same sentence is not that great. E2EE without verifiable builds is as good as a cheeto lock. Even with all the E2EE claims, Facebook could still do anything with the data and you could never hold them accountable because the binary code is obfuscated in the first place so all you would really have is half-reverse engineered stuff that also breaks WhatsApp's terms of use policy. Please stop defending FB, everytime someone does it, they prove all of you wrong again.