4 ms·

The only take away from this article is that somehow they could read the change logs. Doesn't that fly in the face of metas own claims to not be able to? BI s

The only take away from this article is that somehow they could read the change logs. Doesn't that fly in the face of metas own claims to not be able to? BI seems to be implying that abortion shouldn't be treated as a crime in places where it is a crime.

unmole 4y ago
WhatsApp is supposedly end to end encrypted. Does Meta claim anything similar about its other platforms?
- mulmen 4y ago
  Is it really? I always assumed it was like Zoom end to end encryption where one of the “ends” is a Facebook data center. How can a user prove the claim of end to end encryption?
  - caf 4y ago
    There was a bit of a song and dance when Whatsapp adopted the Signal protocol. Certainly if you choose not to back up your Whatsapp messages, your old messages aren't available when you switch phones. If they're not end-to-end encrypted, they're engaging in a lot of deception to indicate that they are.
    - jeroenhd 4y ago
      They are if you enable encryption (with your own key, of course). The default backups are insecure, though.
      - mulmen 4y ago
        Except you provide the key to the app and the app is controlled by FB. There’s really no way to prove the key stays on your device. Or that your messages aren’t just forwarded without encryption to a FB datacenter.
    - mulmen 4y ago
      Thanks, I don’t have much experience with WhatsApp. I don’t have a lot of faith in Facebook. Especially post-Snowden. If you think you need E2EE you can really only achieve that on an open system you control and have intimate knowledge of. You can’t trust precompiled binaries. Something something trusting trust. This isn’t a problem technology can solve. Women shouldn’t need to be information security experts just to ask questions about their own bodies.
      - unmole 4y ago
        > Especially post-Snowden. What does Snowden have to do with Facebook? I'm asking in good faith.
        mulmen 4y ago
        Facebook was wrapped up in PRISM. [1]: https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM
        unmole 4y ago
        What exactly do you mean by wrapped up in PRISM? My understanding is FB like everyone else is legally obligated to comply with FISA demands?
  - jeroenhd 4y ago
    Almost all of WhatsApp has been E2EE for years, based on the same protocol Signal uses. This goes for text messages (personal and groups) and calls. Cloud backups are not encrypted by default, but encryption can be enabled. WhatsApp doesn't have an open source client so verification is difficult. However, if someone were able to break the encryption, I'm sure it'd be in the headlines of most newspapers. One exception is WhatsApp business: I don't know the details, but Facebook offers a service where they will do some chat automation for your business which means they must receive the keys. In terms of security: key changes are automatically accepted. They are hidden by default, but by toggling a setting every time a user updates their keys, a message will be introduced into the chat. QR code key validation has been in the app for years now, though I doubt many users are using the feature.
    - mulmen 4y ago
      How do you tell the difference between true E2EE and Zoom E2EE where FB decrypts the message in the middle? Or otherwise backdoors the exchange, perhaps outside the Signal protocol? Ultimately you are trusting Facebook to tell the truth here.
      - salawat 4y ago
        You read the bloody code, and you run the infrastructure. Not your hardware, not your system. There is no alternative.
  - ccouzens 4y ago
    > how can a user (without deep technical knowledge and skills) prove the claim of end to end encryption? Checking to see if investigations include evidence from messages on these platforms excepting: Messages sent by the user to someone who distributes them further Or investigators getting control of the phone. --- WhatsApp stands up to that test.
    - salawat 4y ago
      Except, parallel construction is a thing; jealously guarded by law enforcement as well.
- timbit42 4y ago
  E2E encrypted doesn't mean they don't know who is messaging whom. If there is suspicious contact, can they request who contacted a pharmacy? Then they can ask the pharmacy why so-and-so contacted them. A better option would be something like Briar which hides IPs via Tor.
lapcat 4y ago
> BI seems to be implying that abortion shouldn't be treated as a crime in places where it is a crime. Abortion was explicitly legally protected for 50 years and only became a crime in some localities last year. There aren't many "crimes" like that.
- decremental 4y ago
  Slavery was once legal everywhere until it wasn't. It became illegal in some parts of the country but eventually it became illegal everywhere. Now we can look back and think how obvious it is that slavery is wrong. Murdering the unborn was once legal everywhere until it wasn't. It became illegal in some parts of the country and will eventually become illegal everywhere. One day we will look back and think how obvious it is that murdering the unborn is wrong.
  - lapcat 4y ago
    You're missing the point. The transition from legal slavery to illegal slavery was not a smooth one. Consensus did not magically arise. People did not simply relent to legal authorities. There was a massively bloody Civil War fought over it. Regardless of what you think about how "One day we will look back" (and note how Confederate pride is still a thing today), you can't expect this to be like an ordinary legal issue. The transition is extremely divisive, and there will be resistance. Nobody could be neutral during the Civil War, and it's going to be difficult for corporations to remain neutral now, when they want pro-choice people to use their services. Abortion is legal in the headquarter state of the big tech companies, and those companies employ many pro-choice workers.
- MacsHeadroom 4y ago
  Technically it was illegal the whole time in many places and the supreme court only last year recognized that they never had the power to prevent states from enforcing their own laws on the matter. In states where it was illegal it may not even be ex-post-facto for them to prosecute for events that took place prior to last year's supreme court ruling. Anyway, the real takeaway should be that businesses should not be collecting this kind of data in the first place. If they don't collect it, then they have nothing to turn over.

unmole 4y ago

WhatsApp is supposedly end to end encrypted. Does Meta claim anything similar about its other platforms?

mulmen 4y ago
Is it really? I always assumed it was like Zoom end to end encryption where one of the “ends” is a Facebook data center. How can a user prove the claim of end to end encryption?
- caf 4y ago
  There was a bit of a song and dance when Whatsapp adopted the Signal protocol. Certainly if you choose not to back up your Whatsapp messages, your old messages aren't available when you switch phones. If they're not end-to-end encrypted, they're engaging in a lot of deception to indicate that they are.
  - jeroenhd 4y ago
    They are if you enable encryption (with your own key, of course). The default backups are insecure, though.
    - mulmen 4y ago
      Except you provide the key to the app and the app is controlled by FB. There’s really no way to prove the key stays on your device. Or that your messages aren’t just forwarded without encryption to a FB datacenter.
  - mulmen 4y ago
    Thanks, I don’t have much experience with WhatsApp. I don’t have a lot of faith in Facebook. Especially post-Snowden. If you think you need E2EE you can really only achieve that on an open system you control and have intimate knowledge of. You can’t trust precompiled binaries. Something something trusting trust. This isn’t a problem technology can solve. Women shouldn’t need to be information security experts just to ask questions about their own bodies.
    - unmole 4y ago
      > Especially post-Snowden. What does Snowden have to do with Facebook? I'm asking in good faith.
      - mulmen 4y ago
        Facebook was wrapped up in PRISM. [1]: https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM
        unmole 4y ago
        What exactly do you mean by wrapped up in PRISM? My understanding is FB like everyone else is legally obligated to comply with FISA demands?
- jeroenhd 4y ago
  Almost all of WhatsApp has been E2EE for years, based on the same protocol Signal uses. This goes for text messages (personal and groups) and calls. Cloud backups are not encrypted by default, but encryption can be enabled. WhatsApp doesn't have an open source client so verification is difficult. However, if someone were able to break the encryption, I'm sure it'd be in the headlines of most newspapers. One exception is WhatsApp business: I don't know the details, but Facebook offers a service where they will do some chat automation for your business which means they must receive the keys. In terms of security: key changes are automatically accepted. They are hidden by default, but by toggling a setting every time a user updates their keys, a message will be introduced into the chat. QR code key validation has been in the app for years now, though I doubt many users are using the feature.
  - mulmen 4y ago
    How do you tell the difference between true E2EE and Zoom E2EE where FB decrypts the message in the middle? Or otherwise backdoors the exchange, perhaps outside the Signal protocol? Ultimately you are trusting Facebook to tell the truth here.
    - salawat 4y ago
      You read the bloody code, and you run the infrastructure. Not your hardware, not your system. There is no alternative.
- ccouzens 4y ago
  > how can a user (without deep technical knowledge and skills) prove the claim of end to end encryption? Checking to see if investigations include evidence from messages on these platforms excepting: Messages sent by the user to someone who distributes them further Or investigators getting control of the phone. --- WhatsApp stands up to that test.
  - salawat 4y ago
    Except, parallel construction is a thing; jealously guarded by law enforcement as well.
timbit42 4y ago
E2E encrypted doesn't mean they don't know who is messaging whom. If there is suspicious contact, can they request who contacted a pharmacy? Then they can ask the pharmacy why so-and-so contacted them. A better option would be something like Briar which hides IPs via Tor.

lapcat 4y ago

> BI seems to be implying that abortion shouldn't be treated as a crime in places where it is a crime. Abortion was explicitly legally protected for 50 years and only became a crime in some localities last year. There aren't many "crimes" like that.

decremental 4y ago
Slavery was once legal everywhere until it wasn't. It became illegal in some parts of the country but eventually it became illegal everywhere. Now we can look back and think how obvious it is that slavery is wrong. Murdering the unborn was once legal everywhere until it wasn't. It became illegal in some parts of the country and will eventually become illegal everywhere. One day we will look back and think how obvious it is that murdering the unborn is wrong.
- lapcat 4y ago
  You're missing the point. The transition from legal slavery to illegal slavery was not a smooth one. Consensus did not magically arise. People did not simply relent to legal authorities. There was a massively bloody Civil War fought over it. Regardless of what you think about how "One day we will look back" (and note how Confederate pride is still a thing today), you can't expect this to be like an ordinary legal issue. The transition is extremely divisive, and there will be resistance. Nobody could be neutral during the Civil War, and it's going to be difficult for corporations to remain neutral now, when they want pro-choice people to use their services. Abortion is legal in the headquarter state of the big tech companies, and those companies employ many pro-choice workers.
MacsHeadroom 4y ago
Technically it was illegal the whole time in many places and the supreme court only last year recognized that they never had the power to prevent states from enforcing their own laws on the matter. In states where it was illegal it may not even be ex-post-facto for them to prosecute for events that took place prior to last year's supreme court ruling. Anyway, the real takeaway should be that businesses should not be collecting this kind of data in the first place. If they don't collect it, then they have nothing to turn over.