4 ms·

I think there are a bunch of different levels of expected privacy, and I think the problem is that text messaging has a very high level of expected privacy and

by macrael 14y ago

I think there are a bunch of different levels of expected privacy, and I think the problem is that text messaging has a very high level of expected privacy and what's app does not live up to that. Text messaging is one of the most personal forms of communication we have, it's instant, it's directly from one person to another person, we expect people to read and respond to texts quite frequently, and it requires knowing someone's cell number (which is much more carefully handed out than, say, email addresses). Especially because of the one on one aspect, furthered by the fact that people read texts directly off their phones so there is very little over the shoulder reading done (this is something where having iMessage on the desktop has actually bothered me, I could be working on something with someone and have a personal text show up on the screen) texting can be very intimate and private. Moreover, it's digital, so most people don't really understand how any of it works and there is a much larger attack vector than the inherent physical locality required by stealing someone's mail. What's app should be secure.

saurik 14y ago
The reason I provided the response that I did is that the implication of mxxx sighing at his sister asking "oh, should I care?" is that "of course you should care: this is insecure!", when it is not at all clear that any individual person should care. In practice, WhatsApp is actually much more secure than most of the things that people trust with their privacy, and this is certainly true for the people against whom most people are specifically attempting to protect their private things from being taken by. As an example: let's say that an ex-girlfriend of mine decided to stalk me. She can either 1) use a pair of pliers and steal my physical mail, 2) guess a poorly-chosen four-digit PIN number and access my voicemail, or 3) guess my 14-digit IMEI (Android; alternatively, 160-bit UDID on iPhone) and access my WhatsApp account. In actuality, then, WhatsApp is one of the most secure things I might currently be using to protect my privacy from these kinds of other users. I can easily see someone saying "so, should I care?" about this particular vulnerability. Of course, for someone else, that might not be the case: if you use WhatsApp for something much more sensitive than I might, or you are attempting to protect yourself from a much more sophisticated attacker than most people are (example: most people really and honestly don't care that a large faceless corporation knows you hated your sister's cheesecake), then you probably do (and certainly should) care.

by macrael 14y ago

saurik 14y ago

The reason I provided the response that I did is that the implication of mxxx sighing at his sister asking "oh, should I care?" is that "of course you should care: this is insecure!", when it is not at all clear that any individual person should care. In practice, WhatsApp is actually much more secure than most of the things that people trust with their privacy, and this is certainly true for the people against whom most people are specifically attempting to protect their private things from being taken by. As an example: let's say that an ex-girlfriend of mine decided to stalk me. She can either 1) use a pair of pliers and steal my physical mail, 2) guess a poorly-chosen four-digit PIN number and access my voicemail, or 3) guess my 14-digit IMEI (Android; alternatively, 160-bit UDID on iPhone) and access my WhatsApp account. In actuality, then, WhatsApp is one of the most secure things I might currently be using to protect my privacy from these kinds of other users. I can easily see someone saying "so, should I care?" about this particular vulnerability. Of course, for someone else, that might not be the case: if you use WhatsApp for something much more sensitive than I might, or you are attempting to protect yourself from a much more sophisticated attacker than most people are (example: most people really and honestly don't care that a large faceless corporation knows you hated your sister's cheesecake), then you probably do (and certainly should) care.