5 ms·

> Without that it's just a slightly more private WhatsApp. They are not even comparable. WhatsApp does not encrypt metadata at all, which is the most interesti

by nicce 3y ago

> Without that it's just a slightly more private WhatsApp. They are not even comparable. WhatsApp does not encrypt metadata at all, which is the most interesting information you can leak.

medstrom 3y ago
Also WhatsApp is closed-source, so you can only take their word for whether the E2E is really E2E -- and it's owned by Facebook.
- Erratic6576 3y ago
  Why wouldn’t you trust Zuck’s word? He seems like an honourable
- binary132 3y ago
  There’s really nothing stopping someone from publishing an instrumented / modded binary to a mobile App Store unless there’s a user-verifiable build chain, even if it is open-source. Even if the backend IS e2ee, the UI can be extended to keylog / etc. The App Store provider can be in on it too. DNS can be filtered to provide some degree of control and traffic inspection, but there’s always DNS over HTTPS, tunneling, and so on and so forth. I’d be surprised if Signal was doing it, since getting caught at it would totally destroy their reputation, but I’d honestly be surprised if WhatsApp didn’t have at least a backdoor for it.
  - nicce 3y ago
    For Signal, open source since 2016 https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ Unless you espcially meant by ”App Store”, by Apples App store, it is Apple to blame in that case because it is not possible due to the encryption of app binaries.
    - binary132 3y ago
      I wasn't speaking specifically about Signal nor about a particular storefront. I'm glad Signal has at least a reproducible build on one platform. That doesn't change my main point: "it's open source" is NOT a guarantor of this AT ALL without usable build verification.
      - nicce 3y ago
        That is very true; many incorrectly think that open-source alone brings some privacy guarantees, while it might bring some security ones.
fmajid 3y ago
Neither does Signal, or any mainstream secure messenger. For that you’d have to look at MIT’s Vuvuzela/Alpenhorn.
- nicce 3y ago
  Based on what? Look at the source code.

by nicce 3y ago

> Without that it's just a slightly more private WhatsApp. They are not even comparable. WhatsApp does not encrypt metadata at all, which is the most interesting information you can leak.

medstrom 3y ago

Also WhatsApp is closed-source, so you can only take their word for whether the E2E is really E2E -- and it's owned by Facebook.

Erratic6576 3y ago
Why wouldn’t you trust Zuck’s word? He seems like an honourable
binary132 3y ago
There’s really nothing stopping someone from publishing an instrumented / modded binary to a mobile App Store unless there’s a user-verifiable build chain, even if it is open-source. Even if the backend IS e2ee, the UI can be extended to keylog / etc. The App Store provider can be in on it too. DNS can be filtered to provide some degree of control and traffic inspection, but there’s always DNS over HTTPS, tunneling, and so on and so forth. I’d be surprised if Signal was doing it, since getting caught at it would totally destroy their reputation, but I’d honestly be surprised if WhatsApp didn’t have at least a backdoor for it.
- nicce 3y ago
  For Signal, open source since 2016 https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ Unless you espcially meant by ”App Store”, by Apples App store, it is Apple to blame in that case because it is not possible due to the encryption of app binaries.
  - binary132 3y ago
    I wasn't speaking specifically about Signal nor about a particular storefront. I'm glad Signal has at least a reproducible build on one platform. That doesn't change my main point: "it's open source" is NOT a guarantor of this AT ALL without usable build verification.
    - nicce 3y ago
      That is very true; many incorrectly think that open-source alone brings some privacy guarantees, while it might bring some security ones.

fmajid 3y ago

Neither does Signal, or any mainstream secure messenger. For that you’d have to look at MIT’s Vuvuzela/Alpenhorn.

nicce 3y ago
Based on what? Look at the source code.