8 ms·
Given how WhatsApp is the de-facto way to communicate outside of the West and China, these security/data-handling "weaknesses" are most likely a feature, not a
by lordofgibbons 1y ago
Given how WhatsApp is the de-facto way to communicate outside of the West and China, these security/data-handling "weaknesses" are most likely a feature, not a bug. An absolute bonanza for the certain intelligence services.
Remember, kids: End to end encryption is useless if the "ends" are fully controlled by an (untrustworthy) third party.
- crypto_throwa 1y agoWithout open source, end to end encryption is useless. It's not hard to hide a piece of code that defeats the encryption in closed source code.
- another_twist 1y agoCurious, is there a poc somewhere demonstrating an attack like this ?
- joaomacp 1y agoSure: plain_msg = decrypt(encrypted_msg) send_to_nsa(plain_msg)
- __spooky__ 1y agoiMessage is end to end encrypted. Although Apple says it secure and the courts and FBI seem to not be able to get it in, it is still closed source.
- rpdillon 1y agoJust don't back it up to iCloud!
- yamazakiwi 1y agoNot able to get into it legally or without consequence, it is not infallible.
- bigiain 1y agoI can't tell if I'm being paranoid or just realistic, when I suspect that FBI/Apple fights over decrypting/unlocking iPhones or iMessage are just part of Apple's security theater. If I were Evil-Tim-Cook, I'd have a deal with the FBI (and other agencies) where I'd hand over some user's data, in return for them keeping that secret and occasionally very publicly taking Apple to court demanding they expose a specific user and intentionally losing - to bolster Apple's privacy reputation.
- throw0101a 1y ago> If I were Evil-Tim-Cook, I'd have a deal with the FBI (and other agencies) where I'd hand over some user's data, in return for them keeping that secret and occasionally very publicly taking Apple to court demanding they expose a specific user and intentionally losing - to bolster Apple's privacy reputation. The FBI wants its investigations to go to court and lead to convictions. Any evidence gained in this way would be exposed as coming form Apple; notwithstanding parallel construction: * https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction As for other agencies, I'm sure many have exploits to attack these devices and get spyware on them, and so may not need Apple's assistance.
- 14 1y agoI imagine if you have the information parallel construction becomes trivial.
- worthless-trash 1y agoThe killers app for ai.
- MangoToupe 1y agoMaybe. I think they'd have a hard time keeping that under wraps—governments aren't typically very careful (and the FBI is about as careful as a bull in a china shop) about not showing their hand when it comes to charging people. If you're strict about keeping certain info on certain channels, smart observers would notice if someone were snooping. For instance, if someone shared something incriminating in a group chat and got arrested, and that info was only shared in the group chat, they'd have to silence everyone in that group chat to ensure that the channel still seemed secure. I don't think at least our government is that competent or careful. But also, people wayyyy overhype how much apple tries to come off as privacy-forward. They sell ads and don't even allow you to deny apps access to the internet, and for the most part their phone security seems more focused on denying you control over your own phone rather than denying a third party access to it. I think they just don't want the hassle of complying with warrants. Stuff like pegasus would only be so easy to sell if you couldn't lean on the company to gain access, and I think it'd be difficult for hundreds of countries to conspire to obscure legal pressure. Finally Apple generally has little to gain from reading your data, unlike other tech giants with perverse incentives. Of course this is all speculation, but I do trust imessages much more than I trust anything coming out of meta, and most of what comes out of google.
- paulryanrogers 1y agoiMessage backups in the cloud are subject to warrants. Even if you don't use iCloud backups, can you be sure everyone you communicate with also abstains?
- stingraycharles 1y agoAren’t those encrypted with a key that lives on your device only?
- ants_everywhere 1y agohow would you restore if you lost your device?
- bri3d 1y agoBackups with Advanced Data Protection also enroll: * Recovery Keys * Recovery Contact (someone who holds your recovery key in key escrow)
- ants_everywhere 1y agoright, the ability to recover implies keys exist outside the device. even if they gossip keys to other devices you control, there are lots of people with only a single apple device.
- bri3d 1y agoOnly if you enable Advanced Data Protection, but in that case, yes, absolutely
- saagarjha 1y agoIt is actually quite difficult.
- cataflam 1y ago> outside of the West you probably mean outside of the USA, it's huge in Europe/UK (which doesn't contradict your main point)
- kwanbix 1y agoIt is huge in Latin America. USA is special because it is the (only?) country where iPhone has more users than Android.
- brazukadev 1y agoIt's crazy how an US company dominates the world's messaging market but not in the US
- oarla 1y agoIt’s not uncommon. Orkut back in the day was wildly popular in Latin America and India. WhatsApp is the same. I think users in NA have a lot of high quality options as against those in Asia and LatAm who don’t have much reliable options other than ones developed in NA.
- SoftTalker 1y agoYou can get an android phone for about one tenth of what a new iPhone costs. That’s why android dominates lower income markets. Apple decided they just don’t want to be there.
- unethical_ban 1y agoInstagram and iMessage are also US owned services.
- somenameforme 1y agoIt's definitely not the world's messaging market. For instance in Japan and many places in SEA, Line is the standard messenger - one many people probably haven't even heard of. Though it does have a nice play on words - are you on Line?
- thewebguyd 1y agoMakes you wonder if Meta got one or more of those secret national security letters, or foreign equivalents. Also makes me wonder about Google's change wrt android security patches - under the guise of "making it easier for OEMs" by moving to quarterly is actually just so that Paragon and other nation state spyware has access to the vulnerabilities for at least 4 months before they get patched.
- deleted 1y ago[deleted]
- saagarjha 1y agoOk, what do you suggest instead?
- dijit 1y ago> End to end encryption is useless if the "ends" are fully controlled by a (..) third party. YES!
- sulandor 1y agoalthough e2ee does raise the cost for an attacker, the perceived gain in trustworthiness of the system is unjustified
- tgsovlerkhgsel 1y agoE2EE is likely the reason why this supposedly includes "contact information, IP addresses and profile photos" and not message content.
- achrono 1y agoFrom the article: > According to the 115-page complaint, Baig discovered through > internal security testing that WhatsApp engineers could “move > or steal user data” including contact information, IP addresses > and profile photos “without detection or audit trail”. That isn't really the breach you're making it out to be. Profile photos, unless made private/contacts only, are already publicly visible, and so is "contact information". Of course these are useful to intelligence services, but this doesn't mean that Baig found they don't have true end-to-end encryption.