Article states that the is no technical proof
Comment on Lawsuit Alleges That WhatsApp Has No End-to-End Encryption
sexy_peach@feddit.org 11 hours agoThis shows that you don’t understand e2e encryption. Watch a video about how comparing the keys can verify that no man in the middle attack is happening.
goatinspace@feddit.org 10 hours ago
RIotingPacifist@lemmy.world 11 hours ago
This shows you don’t understand the exploit being used.
Go hang out with Alice & Bob all you want, they aren’t breaking encryption.
I guess c/technology is the same as r/technology, full Smug fools that don’t read articles or understand real world security, but think they are 1337 hax0rm3n
theherk@lemmy.world 11 hours ago
Sorry but you’ll need to hold the L on this one. If I encrypt a message with public key material for which the only private key material that can decrypt the message is in only my possession, it doesn’t matter if the message passes centralized servers.
I’m not trying to be rude, that’s just how it works.
RIotingPacifist@lemmy.world 10 hours ago
People not understanding how security threats actually work is why everything is so broken these days.
If you do it by hand sure.
If you put the message into an app then the app is trusted to not leak the message. What is described in the article is that Whatsapp can instruct clients to send a copies of the message from the app to their server.
There is nothing stopping any messaging app doing this, having decentralized servers and 3rd party clients wouldn’t stop this but it would make it much easier to protect yourself from the attack.
floofloof@lemmy.ca 10 hours ago
Your threat model seems to be an app whose published source code doesn’t match the published app, and whose published version uses a side channel not in the source code to leak messages in plaintext to a server. If that’s what we’re worried about then decentralization of the app’s main messaging channel makes no difference. The sneaky side channel could still be there in any app, centralised or decentralized.
That’s a theoretical worry to be mitigated through integrity checks on published open-source apps. The worry with Meta and WhatsApp is much more immediate: a known bad actor with a closed-source app, many domains they could use to leak keys or unencrypted messages, and a fawning relationship with the fascist and surveillance-hungry US Government. I’d still put significantly more trust in Signal even though it is centralised.
clean_anion@programming.dev 9 hours ago
Even in an “insecure” app without air-gapped systems or manual encryption, creating a backdoor to access plaintext messages is still very difficult if the app is well audited, open source, and encrypts messages with the recipient’s public key or a symmetric key before sending ciphertext to a third-party server.
If you trust the client-side implementation and the mathematics behind the symmetric and asymmetric algorithms, messages remains secure even if the centralized server is compromised. The client-side implementation can be verified by inspecting the source code if the app is open source and the device is trusted (for example, there is no ring-zero vulnerability).
The key exchange itself remains somewhat vulnerable if there is no other secure channel to verify that the correct public keys were exchanged. However, once the public keys have been correctly exchanged, the communication is secure.
theherk@lemmy.world 10 hours ago
I’m not following. In the WhatsApp case, yes, because we can’t see how those keys are managed. In the Signal case, we can. So the centralized server has zero impact on the privacy of the message. If we trust the keys are possessed only by the generating device, then how does the encrypted message become compromised?
I’m not talking about anonymity, only message privacy. No different than any of the other proxies or routers along the way. If they don’t have the key, the message is not readable.
just_another_person@lemmy.world 10 hours ago
Dude…your comments here clearly display that you do not have a single clue as to how cryptography works. You should just pack it up in this thread and head on down the road.
RIotingPacifist@lemmy.world 10 hours ago
Dude, your comments clearly display that you do not have a single clue as to how security works. You should just pack it up in this thread and head on down the road.
WhatsApp’s cryptography isn’t broken, the app is.
just_another_person@lemmy.world 10 hours ago
🤣🤣🤣
You need a juice and a nap, Ke-mo sah-bee.
wonderingwanderer@sopuli.xyz 10 hours ago
The “exploit being used” is closed-source, proprietary code sending data where it says it doesn’t.
People have already explained to you how signal’s open-source, auditable, and reproducible code prevents the possibility of a similar exploit.
You’re the smug fool who doesn’t understand cybersecurity. How much is zuck paying you to say “signal’s just as bad as whatapp”?
RIotingPacifist@lemmy.world 9 hours ago
Nobody is saying signal is just as bad, simply that it’s not invulnerable to this kind of attack, even with reproducible builds, especially as we don’t know how the attack works.
When is the last time you checked the linked-devices tab in signal?