Comment

Comment on Lawsuit Alleges That WhatsApp Has No End-to-End Encryption

superglue@lemmy.dbzer0.com ⁨11⁩ ⁨hours⁩ ago

No. Signal encrypts every message on the device itself before sending to Signal servers. You can even confirm this yourself by looking at their github.

Whats app claims they do this but its impossible to confirm. Its extrenemly likely that either they dont encrypt at all or they have the decryption keys.

source

Sort:hotnew top

RIotingPacifist@lemmy.world ⁨11⁩ ⁨hours⁩ ago
In The method described, it doesn’t matter if Signal encrypt the message before it leaves your phone, the plaintext is still in the app and gets sent to Meta while also being encrypted.

It’s basically impossible to know this isn’t happening based on reading source code, because the code to load widgets doesn’t have to be remotely close to the messaging code, you’d have to read the entire signal code based.

There is way to know that the code you read on GitHub is the code Google/Apple install on your phone.
source
- just_another_person@lemmy.world ⁨10⁩ ⁨hours⁩ ago
  🤣🤣🤣😂
  
  Bruv, before Signal launched they posted an entire whitepaper detailing their protocol, the working mechanisms of the system, and source code. So to reply to your 3 points:
  
  No, this is stupid and easily verified by watching network traffic from any device. Signal is secretly sending plaintext messages anywhere.
  
  No, it’s not impossible to tell this at all. That’s what source code is. The executable code. Not only have NUMEROUS security audits been done on Signal by everyone from Academia, to for-profit security researchers and governments, you can easily verify that what you’re running on your phone is the same source code as what is published publicly because the fingerprint hashes for builds are also published. This means the same fingerprint you’d get building it yourself from source should also be the same as what is publicly published.
  
  See my point above, but also when two users exchange keys on Signal (or in any other cryptographic sense), these keys are constantly verified. If changed, the session becomes invalid. Verifying these keys between two users is a feature of Signal, but moreover, the basics of cryptography functioning can, and have been proven, during the independent audits of Signal. Go read any of the numerous papers dating back to 2016.
  
  If you don’t understand how any of this works, it’s just best not to comment.
  
  source
  - RIotingPacifist@lemmy.world ⁨10⁩ ⁨hours⁩ ago
    
    Why would any message be plaintext?
    
    Fair you could have just said they have reproducible builds or linked to the docs: github.com/signalapp/Signal-Android/…/README.md
    
    Again you are missing the point of the attack
    
    If you don’t understand how any of this works, it’s just best not to comment.
    
    Back at you, even if you are right that signal is secure, the attack is not what you think it is.
    
    source
    just_another_person@lemmy.world ⁨10⁩ ⁨hours⁩ ago
    What in the world are you talking about here, bud? Your comments are making zero sense.
    
    Look, seriously, if my comment is being upvoted, it’s because I responded to yours, and people understand what I am saying in response.
    
    You, unfortunately, clearly do not understand what I’m saying because you do not grasp how any of this works.
    
    source
    -> View More Comments
- EisFrei@lemmy.world ⁨10⁩ ⁨hours⁩ ago
  Why would meta have access to signal’s memory?
  
  That’s why code audits have been done multiple times.
  
  Reproducible builds. Signal has those since 2016
  
  source
  - protogen420@lemmy.blahaj.zone ⁨10⁩ ⁨hours⁩ ago
    about the 3rd, is the end apk file downloaded by a useer on the playstore reproducible? could google add stuff to the apk before the user downloading it? do users ever bother checking if the apk hash matches the one from the reproducible build?
    
    source
    9bananas@feddit.org ⁨7⁩ ⁨hours⁩ ago
    no, that’s why it’s called fingerprinting:
    
    it’s a kind of mathematical function that takes the entire code as input and outputs a unique result.
    
    the result is just some string of symbols (which really just represent a unique string of 1’s and 0’s).
    
    this unique string of characters is, as mentioned, unique for any given input.
    
    this string can then be compared to any arbitrary other string, and if they match, then you know it’s the same code.
    
    so in the case of signal anybody can download the source, compile it, and verify that it matches the fingerprint of the compiled code on their own device.
    
    that’s why it can’t be faked: you compare the already compiled code.
    
    if even a single digit of the code is out of place, it’s not going to result in the same string, and thus immediately get flagged as a mismatch.
    
    it’s mathematically impossible to fake.
    
    source
    -> View More Comments