3 ms·

The static AES key is for local log storage. This is about encrypted communications. They are working together with Open WhisperSystems to bring the e2e-encrypt

by xnyhps 12y ago

The static AES key is for local log storage. This is about encrypted communications. They are working together with Open WhisperSystems to bring the e2e-encrypted TextSecure protocol to Whatsapp: https://whispersystems.org/blog/whatsapp/ https://whispersystems.org/blog/whatsapp/

higherpurpose 12y ago
Let's start being very cautious about that. Because 1) Whatsapp has never said publicly they are doing that 2) Now they might backtrack and say they never intended to add E2E encryption 3) Without a privacy policy change as well, the encryption change may be meaningless, since they'd give themselves permission to modify it whenever they wish.
- blfr 12y ago
  Privacy policy or some other ToS-like document should not matter to properly implemented technical security measures. That's the whole point.
  - higherpurpose 12y ago
    And how would you know they didn't rip out the new system to replace it with the old one in one update? According to Moxie, the Android version already has the TextSecure built into it, yet I see absolutely no difference from the old Whatsapp.
    - nickik 12y ago
      Have you actually listend to the network traffic? It used to be plaintext, so its easy to check, if there is some encryption going on. If there is encryption, then its likly its the one interduced by the TextSecure people. Why should it be diffrent? What did you expect to change? Thats the good thing about good crypto, the user does not even know its there. I mean sure, I would like to be able to validate the other persons fingerprint and discover as soon as we are communicating diffrently, but relasticlly, what whatsapp did is the biggest jump in crypto usage since https.
soperj 12y ago
I don't know why people wouldn't just use TextSecure instead? Then you actually know.
- scott_karana 12y ago
  Lack of an iOS app, just maybe?
  - nickik 12y ago
    If thats the biggest barrior, im happy.
- woah 12y ago
  network effects? UX? Come on, how can you even ask that question?

by xnyhps 12y ago

higherpurpose 12y ago

Let's start being very cautious about that. Because 1) Whatsapp has never said publicly they are doing that 2) Now they might backtrack and say they never intended to add E2E encryption 3) Without a privacy policy change as well, the encryption change may be meaningless, since they'd give themselves permission to modify it whenever they wish.

blfr 12y ago
Privacy policy or some other ToS-like document should not matter to properly implemented technical security measures. That's the whole point.
- higherpurpose 12y ago
  And how would you know they didn't rip out the new system to replace it with the old one in one update? According to Moxie, the Android version already has the TextSecure built into it, yet I see absolutely no difference from the old Whatsapp.
  - nickik 12y ago
    Have you actually listend to the network traffic? It used to be plaintext, so its easy to check, if there is some encryption going on. If there is encryption, then its likly its the one interduced by the TextSecure people. Why should it be diffrent? What did you expect to change? Thats the good thing about good crypto, the user does not even know its there. I mean sure, I would like to be able to validate the other persons fingerprint and discover as soon as we are communicating diffrently, but relasticlly, what whatsapp did is the biggest jump in crypto usage since https.

soperj 12y ago

I don't know why people wouldn't just use TextSecure instead? Then you actually know.

scott_karana 12y ago
Lack of an iOS app, just maybe?
- nickik 12y ago
  If thats the biggest barrior, im happy.
woah 12y ago
network effects? UX? Come on, how can you even ask that question?