Comment on Lawsuit Alleges That WhatsApp Has No End-to-End Encryption

• BoJackHorseman@lemmy.world ⁨1⁩ ⁨day⁩ ago

  Cynical me would say they don’t have to use the code they put up in GitHub in production.

  source

  • phtheven@lemmy.world ⁨1⁩ ⁨day⁩ ago

    By this logic, can we trust any open source software, even if they claim to use some third party encryption? They could say they’re using a super secure encryption, even show it implemented in their open source code base, then just put the other, secret evil backdoor code base in production? Is there a way for any open source project to prove that the code in their open source repo is the code in production?

    source

    • BoJackHorseman@lemmy.world ⁨1⁩ ⁨day⁩ ago

      If you can self host it, yes. Like matrix

      source

      • squidie@feddit.org ⁨1⁩ ⁨day⁩ ago

        But only if you self-host right? Otherwise who ever hosts the matrix instance can tinker with it.

        source

        • -> View More Comments
    • BlueKey@fedia.io ⁨1⁩ ⁨day⁩ ago

      This is called reproducible builds. With this all builds of a version will be binary-identical. So you can build from the repo and the compare it with the appstore binary and see if the owner was honest.

      source

      • phtheven@lemmy.world ⁨21⁩ ⁨hours⁩ ago

        I found this:

        github.com/signalapp/Signal-Desktop/…/README.md

        Looks like they’re working on reproducibility, at least in the desktop app. That’s a little disappointing but i guess I’m happy they’re working on it.

        source
      • phtheven@lemmy.world ⁨22⁩ ⁨hours⁩ ago

        Neat! And can this been done with signal or proton?

        source

        • -> View More Comments
  • kinther@lemmy.world ⁨1⁩ ⁨day⁩ ago

    Yep

    source
• lavander@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

  Unfortunately even the best intentioned and best audited project can be compromised. So that is not a guarantee (sure, much better than closed source but that is a given)

  You may be forced by a rubber hose attack (or legal one) to insert vulnerabilities in your code… and you have the traffic… a single point to attack… signal/proton/etc

  Is it possible with two different vendors? Sure it is but it is way more complicated

  source

  • Quexotic@infosec.pub ⁨1⁩ ⁨day⁩ ago

    That’s a really good point. All we’d need is for signal devs to be compromised in some way and the next update ends security for signal.

    source