Comment on Lawsuit Alleges That WhatsApp Has No End-to-End Encryption

Rusty@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago

• wallabra@lemmy.eco.br ⁨2⁩ ⁨weeks⁩ ago

  Tox also isn’t that great security wise. It’s hard to beat Signal when it comes to security messengers. And Signal is open source so

  source

  • REDACTED@infosec.pub ⁨2⁩ ⁨weeks⁩ ago

    Well, Whatsapp uses signal. Bad timing

    source

    • qyron@sopuli.xyz ⁨2⁩ ⁨weeks⁩ ago

      How?

      source

      • Appoxo@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago

        Unless proof is given, assume troll

        source

        • -> View More Comments
      • HereIAm@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

        WhatsApp is using Signals protocol for communication: signal.org/blog/whatsapp-complete/

        I don’t fully understand what it entails, but from what I understand is that yes, WhatsApp is using the same encryption and message flow that signal uses, but you’re still using Meta’s app, and they can just read the plaintext message from there.

        source

        • -> View More Comments
      • REDACTED@infosec.pub ⁨2⁩ ⁨weeks⁩ ago

        Read more than just the title ffs

        source

        • -> View More Comments
    • Candice_the_elephant@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

      It only uses some of signal’s code. Not necessarily the OOTB key storage and security.

      source
  • Tanoh@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

    And Signal is open source so, if it did anything weird with private keys, everyone would know

    Well, no. At least not by default as you are running a compiled version of it. Someone could inject code you don’t know anything about before compilation that for example leaked your keys.

    One way to be more confident no one has, would be to have predictable builds that you can recreate and then compare the file fingerprints. But I do not think that is possible, at least on android, as google holds they signature keys to apps.

    source

    • pressanykeynow@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

      Signal has reproducible builds and here’s the instruction how to check it on Android github.com/signalapp/Signal-Android/…/README.md

      source

      • Tanoh@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

        If they have, then good. Wasn’t sure it was doable with current google’s signing process. Highly unlikely someone hasn’t tampered with them then (far easier to target the site displaying the “correct” fingerprint).

        However, my original point still stands. Just because it is open source doesn’t in itself mean that a bad actor can’t tamper with it.

        source
    • MaggiWuerze@feddit.org ⁨2⁩ ⁨weeks⁩ ago

      Signal is also on F-Droid, so it should Bd verifiable

      source
• derin@lemmy.beru.co ⁨2⁩ ⁨weeks⁩ ago

  What’s stopping the app from keeping your private key and still not encrypting anything?

  I’m not trying to be difficult here, I just don’t see how anything outside of an application whose source you can check yourself can be trusted.

  All applications hosted by other people require you to react positively to “just trust me bro”.

  source

  • GamingChairModel@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

    Or, if the app has the private key for decryption for the user to be able to see the messages, what’s stopping the app from copying that decrypted text somewhere else?

    The thread model isn’t usually key management, it’s more about the insecure treatment of the decrypted message after decryption.

    source
• Candice_the_elephant@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

  What’s to stop an evil company uploading the keys after you enter them in the App? It certainly wouldn’t stop Meta.

  source
• Pika@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago

  Man, you just brought back memories. I forgot qtox was even a thing. I think I still have my profile saved in my dev folder somewhere for my account

  source