Re:WhatsApp's Signal Protocol integration is now complete
by jamesdwilson on Tuesday April 05, 2016 @12:46PM
(#11431976)
no proof without open source
[ Parent
| on HN ]
Re:WhatsApp's Signal Protocol integration is now complete
by bad_user on Tuesday April 05, 2016 @04:01PM
(#11433856)
The open-source alternative is the Signal app made by Whisper Systems, the same people helping with WhatsApp from TFA, available for Android and iOS: https://whispersystems.org/
Don't know what kind of funding they've been having, but for an open-source app, it's pretty polished.
Re:WhatsApp's Signal Protocol integration is now complete
by zanny on Tuesday April 05, 2016 @02:08PM
(#11432831)
Matrix uses the Signal protocol for encryption as well, if you want a fully free implementation of the same tech.
Re:WhatsApp's Signal Protocol integration is now complete
by jamesdwilson on Tuesday April 05, 2016 @02:29PM
(#11433033)
thanks! could i use it to connect to WhatsApp?
Re:WhatsApp's Signal Protocol integration is now complete
by zanny on Tuesday April 05, 2016 @03:44PM
(#11433697)
WhatsApp uses a proprietary (fork of XMPP) messaging protocol and does not interoperate with anyone else (intentionally), like Hangouts and Skype, and unlike Matrix which is federated, and has gateways for IRC and XMPP already available.
Re:WhatsApp's Signal Protocol integration is now complete
by kmch on Tuesday April 05, 2016 @01:17PM
(#11432303)
You could inspect the packets yourself to see that they are encrypted.
Re:WhatsApp's Signal Protocol integration is now complete
by jamesdwilson on Tuesday April 05, 2016 @01:24PM
(#11432365)
skype is encrypted too, and backdoored. don't forget whatsapp is owned by facebook.
Re:WhatsApp's Signal Protocol integration is now complete
by jamesdwilson on Tuesday April 05, 2016 @01:23PM
(#11432363)
how do i know they aren't sending the chat log in a side channel, encrypted?
Re:WhatsApp's Signal Protocol integration is now complete
by koide on Wednesday April 06, 2016 @07:36AM
(#11438048)
It's worse to use an encrypted but potentially compromised channel than a plain text one only when you assume the encryption is not in fact compromised, which you shouldn't do.
So I fail to see the problem. It still likely protects you from nosy neighbors or nasty non tech savvy competitors, even if it doesn't protect you from state level actors or from Facebook itself.
The above, in addition to the fact that open source is neither required for auditing, nor guarantees proper auditing occurring (see OpenSSL having vulnerabilities for years before anybody released them to the public)