Hacker News new | ask | show | jobs
by EGreg 1161 days ago
This is silly. You’re just taking their word for it:

”When they do match this confirms a secure, end-to-end encrypted conversation.” - Says Meta.

This doesn’t matter. Why would we trust the word of a giant corporation that has lied to us repeatedly and abused every single loophole they can, to safeguard our private chats?

Lies and deceit just in the last few years:

WhatsApp messages: https://www.businessinsider.com/facebook-reads-whatsapp-mess...

Audio: https://www.bloomberg.com/news/articles/2019-08-13/facebook-...

Video: https://medium.com/macoclock/apples-ios-14-catches-facebook-...

Metadata: https://www.propublica.org/article/how-facebook-undermines-p...

They could easily ship any version of a client to anyone at any time. The answer is just to opt out of Big Tech and communicate without using clients and infrastructure of giant centralized corporations! Use open source alternatives.

Capitalism and the profit motive will always be pitting them against their own users, trying to extract value from the data for their shareholders.
2 comments
pas 1161 days ago
They are going to start providing public access to the audit log. It's basically Certificate Transparency for WhatsApp keys.

https://news.ycombinator.com/item?id=35555910

link
palata 1161 days ago
You have to trust their clients, since they are not open source. I agree with that.

Still this project in particular seems nice. Why couldn't Signal deploy a similar thing, for instance?

link
Aachen 1161 days ago
Because it's a very marginal improvement. It's Facebook verifying that Facebook's other server is providing you the right key; I'm not holding my breath for Signal to start doing the same. I'd honestly hope they'd instead focus on usernames, message editing, markdown, or any of the other features it's still missing compared to Wire or Element. (In Signal's defense, it's the most stable of the three so that's why I've got my family using Signal, but I wish for Wire's, or even better, Telegram's feature set on a daily basis.)
link
palata 1161 days ago
> It's Facebook verifying that Facebook's other server is providing you the right key

Again, no :-). The third-party audit record is there such that... well... a third-party server can do that verification.

For WhatsApp it may be marginal because the client is proprietary (hence you can't audit it and verify that it actually uses the feature), but the Signal client is open source. So you could actually see that your Signal client checks the keys using third-party servers. That's something, I think.

link
Aachen 1161 days ago
> well... a third-party server can do that verification.

Sure, but your phone isn't asking said third party what the results of their verification are. It's asking Facebook.

It can get hacked. It can lie. If you're looking to protect from a malicious server by protecting the key exchange better, you don't achieve that goal by asking the same party for the same information again via a different protocol and hope it answers differently. It increases attack cost because now the attacker has to fool both systems, but idk by how much honesty. The main cost will be getting into their infrastructure undetected in the first place. Sending discrepant responses to differing IP addresses seems relatively easy beyond that point.

link
palata 1160 days ago
Right.

> It increases attack cost because now the attacker has to fool both systems, but idk by how much honesty.

That's a fair question, but it may be better than you think, right? At least it seems pretty easy to increase that cost later on if they want to (e.g. securing their audit server or by having the clients check third-party servers). The technology is here now.

link