|
|
|
|
|
|
by Amir6
3542 days ago
|
|
|
1) Again I'm not talking about verification of whoever is on the other side of the conversation, its about hijacking the account (whether by breaking into the Tel-Co system or having access to it using a court order). There are other means to verify the person you are talking to (signing a message in the beginning of conversation using another app or software) but if all that it takes for someone to have access to my account is to get a copy of that text (containing authentication code) I'm not sure if anyone can call this secure. IMO this security flaw is far more important than having E2E. I hope I was able to differentiate between authentication and verification. 2) If you are using this app, you are forced to give up a copy of all you contacts and also the app is scanning for new contacts several times every hour! If this was an opt in option, I wouldn't have any issues with it. Some people might favor convenience over security as is their right but forcing a social graph of all your friends (almost in all cases without even a simple warning) out of you because you simply want to use the service is frankly disturbing. 3) Unluckily, there are no apps that have such strong E2E standard while implementing the points I raised. What I'm more concerned about is EFF's bar to endorse a platform with such bug flaws. |
|
|
What do you imagine happens when someone hijacks "the account"? They don't get access to your past conversations, they don't get access to your contacts. All that happens is that they can impersonate you, which your friends will notice when they are notified that the key changed.
> If you are using this app, you are forced to give up a copy of all you contacts and also the app is scanning for new contacts several times every hour!
I'm pretty sure it asks you and you have to give it permission. And again, most people WANT to find their contacts. What's the point of having a messenger and no one to send your messages to?
> If this was an opt in option
It is opt-in, no one is forcing you to use WhatsApp. It's not like people don't know that they will be able to contact their friends through WhatsApp and are shocked and dismayed when they find out that's the case. You do realize not every app in existence has to follow your requirements right? You're free to use something that does, but the reason the majority use WhatsApp is that it doesn't. That's not a bug, it's a design choice that you happen to disagree with.