Hacker News new | ask | show | jobs
by seba_dos1 2798 days ago
OMEMO and its implementation in Conversations has been security audited by an independent entity.

Other than that, sure, you have no guarantees, yet it's still desirable for such critical security components to be free, or at least "open source".
2 comments
lvh 2798 days ago
That's all fine but not responsive to my point. GP post said "but what if whatsapp silently hamstrings e2e overnight" -- my point is: what if my XMPP client/server does?

EDIT: I previously said "turns off E2E", which I didn't say in my original referred-to post, and that's more misleading than "hamstrings", which is how the actual attack works.

link
vader1 2798 days ago
The difference of course being that WhatsApp is closed source, and they can push any kind of change without anyone noticing.

If the client is open source, you can verify exactly what it does. Compile the app yourself or download it from F-Droid and you can be sure that the binary you get matches those sources.

Sure you can argue this all the way down to "Trusting Trust", but that doesn't really make sense when comparing two apps/ecosystems that operate in the same real world's constraints.

link
lvh 2798 days ago
As I've mentioned elsewhere: you do not need the source code to verify what something does, that's not generally how you'd audit this. Audits may be source-assisted, but you'd still bang at it from the actual binary. If you're more comfortable reading source and compiling from scratch then fine, do that: but we should not pretend that Conversations on the Play Store is generally more trustworthy than anything else because the source code is publicly available.

The random update bit is real! But also real for Conversations or whatever, and more real for small developers less likely to have their opsec in check. For the vast vast majority of people in this fashion WhatsApp is identical to Conversations and Signal.

link
vader1 2798 days ago
I didn't say that Conversations from the Play Store is significantly more trustworthy in this regard than WhatsApp from the Play Store. I said that an app - such as Conversations - that you can build from source or download from F-Droid is more trustworthy than the Play Store version.

WhatsApp is a proprietary app and as such it's only available on the Play Store. Conversations is open source so you can download it from the Play Store, or from F-Droid, or compile it from source. So if you care, you can be significantly more sure that your version of Conversations "does what it says" than you can be of WhatsApp.

link
seba_dos1 2798 days ago
If your server does, your client will notice. If your client does, the other party's client will notice.
link
lvh 2798 days ago
Neither server nor peer will notice if you perform the serious attack: exfiltrate the plaintexts or key material and keep the OMEMO/Signal dance around as kabuki theater :-)
link
Boulth 2798 days ago
For paranoid users there is also an option of running their own servers and clients (both Prosody and Conversations are open source). XMPP at least provides that option and if you choose it you can still communicate with the rest of the ecosystem.

No such luck for Whatsapp and Signal. And although they may be fair now I think putting all eggs in one company's basket is a bad idea in general (see e.g.: Google).

link
CiPHPerCoder 2798 days ago
> it's still desirable for such critical security components to be free, or at least "open source".

Why the scare quotes?

What about software's source code being available makes it more desirable for your non-technical users who will never modify their software?

link
seba_dos1 2798 days ago
Even though I'm not a "non-technical" user, I don't review crypto of my XMPP client. And that's fine, I know a few people that did and I trust them enough. This way I don't have to trust an entity that may benefit from being able to access my messages.

Also, this is a fallacy. Just because "typical user" won't care or won't be able to do something doesn't mean we shouldn't strive to build and popularize platforms that do right things. Of course it also has to be good at what users actually do care for to have any chance of taking off, but that's not the point.

link
CiPHPerCoder 2798 days ago
> Also, this is a fallacy.

What is a fallacy? I asked a question.

Non-technical users will never modify their software. The act of doing so would recategorize them as "technical". I don't see any fallacy here?

The most likely interpretation of your comment is, you're assuming an argument that I am not making.

> Just because "typical user" won't care or won't be able to do something doesn't mean we shouldn't strive to build and popularize platforms that do right things.

That's a disagreement with an argument I did not make.

> Of course it also has to be good at what users actually do care for to have any chance of taking off, but that's not the point.

What is the point, even?

I just asked how something being "open source" (to borrow the scare quotes) is more desirable to users who do not read/write software code? What is their incentive supposed to be to prioritize open source over proprietary software?

That's not an argument. It's certainly not a fallacious one.

> Even though I'm not a "non-technical" user, I don't review crypto of my XMPP client.

Little bit of background: I'm the sort of person who would review the crypto of an XMPP client.

> And that's fine, I know a few people that did and I trust them enough. This way I don't have to trust an entity that may benefit from being able to access my messages.

Cool, let's ask an trustworthy expert then. I can think of no finer expert to chime in on this discussion than JP Aumasson, one of the co-authors of SipHash and BLAKE2, who wrote the book Serious Cryptography and conducted many cryptography audits in his career.

https://research.kudelskisecurity.com/2018/10/02/open-source...

Oh.

link