3 ms·
> The problem is, of course, that “there's nothing we can do” isn't true. The service provider could develop and ship a backdoored version of the client softwar
by zzzeek 3y ago
> The problem is, of course, that “there's nothing we can do” isn't true. The service provider could develop and ship a backdoored version of the client software. The actual gambit the service provider is counting on here is a particular legal theory: “we could change the software so as to be able to process this warrant, but you can't make us do so”.
> You could perhaps call this cryptography theatre. The purpose of cryptography theatre is not to deliver actual security from a cryptographic perspective but act as a kind of magic spell which (the user believes) gives them a magic opt out from the obligations conferred by warrants and subpoenas. Thus, cryptography theatre must fundamentally be understood not as a cryptographic technology but as a legal one.
dude drinks too much coffee. Of course I wouldn't trust WhatsApp to not give away my conversations to the NSA. But if I'm using WhatsApp in a Starbucks on their wifi, some script idiot next to me can't read my conversations. Not like I use WhatsApp (or talk to people, really) but the security here is on a spectrum.
- chrismorgan 3y agoThe subject here is end-to-end encryption (where content is encrypted all the way from one client device to another client device), which makes big promises of inviolability. But in order to avoid the Starbucks snooper, you only need transport encryption (where content is encrypted from your client device to the WhatsApp or whatever server, normally with TLS in the form of HTTPS).
- zzzeek 3y agoYes, good clarification. Generally if you're looking for government-proof conversations, id never use a Facebook or Google product or anything like that at all. Seems like the best idea would be dedicated devices you prepare with your co-conspirators up front using only open source components that you've audited and certs you've set up yourselves.