8 ms·
”Signal [pioneered] end-to-end encryption, a feature that WhatsApp turned around and copied from Signal.” It wasn’t copied from Signal — at the protocol level,
by gorgoiler 3y ago
”Signal [pioneered] end-to-end encryption, a feature that WhatsApp turned around and copied from Signal.”
It wasn’t copied from Signal — at the protocol level, it is Signal:
https://signal.org/blog/whatsapp/ https://signal.org/blog/whatsapp/
- wolverine876 3y agoIt's part of Signal.
- gorgoiler 3y agoThanks, I’ve edited my comment to be clearer.
- foo-bar-bat 3y agoNo, WhatsApp is not part of Signal. That's false. The opposite is true: Signal is part of Whats App. The problem is we have no idea what else is.
- anonym29 3y agoI've always laughed at people who insist Whatsapp messages are just as secure as Signal messages. Like, prove to me Facebook isn't logging and storing every single cryptographic key generated in that entire protocol. Oh, you can't because the entire app is closed source? And you just blindly trust that Facebook is doing the right thing and not decrypting every message to scour it for every bit of information possible? lol.
- wolverine876 3y agoCorrect, and that's what I meant. The person to whom I was responding understood me.
- pharmakom 3y agoWhatsApp is a closed source client, however.
- bombolo 3y agoWe have no idea if whatsapp really implements it, and if it does but also adds a bunch of side channels for the NSA.
- kasey_junk 3y agoThis idea seems to rely on the flawed assumption that you can’t security audit closed source software. This is not an assumption I’ve ever seen an actual security researcher make. Quite the opposite, they start with techniques they work on the binary and only use the source (if available) as a helpful reference. Hiding back doors in source has a long and storied history so relying on it to audit security has long been out of favor.
- kaliqt 3y agoWhat are the best ways to test for backdoors though? Phoning home I get. But what about just breaking in because there's a backdoor left in for when "they" single you out for persecu- I mean investigation.
- tptacek 3y agoYou read the compiled artifact. It's not complicated. Source code gives you valuable added context about programmer intent, which is helpful to understand how a program is structured, but you can't trust that intent if you're looking for surreptitious code anyways, and you don't need to to work out what the program is doing.
- nulbyte 3y agoAlso as a slight but important aside, the article mentions end-to-end encryption technology that existed prior to Signal in its opening sentence. It may be that Signal pioneered E2EE chat, but it didn't pioneer E2EE itself. It built upon it in a way that was perhaps more accessible or appealing to a mass audience. That prior technology, by the way, PGP, is not and was never universally hated. Many businesses continue to use PGP today to exchange encrypted communications with suppliers and customers. It's mostly file transfers, but some businesses even support secure email via PGP, and it's been integrated into a modern secure email product from a Swiss company, Proton, targeted at both consumers and businesses.
- enedil 3y ago> It may be that Signal pioneered E2EE chat Also false. XMPP OTR existed long prior.