News for hackers. Stuff that matters.
Re:There is no WhatsApp 'backdoor' by usernam on Saturday January 14, 2017 @08:18AM (#13398244)
I was actually perplexed, after reading about signal, that I couldn't just download an APK.

Are play services required for signal? If so, can I even install signal on a cyanogenmod phone? Can you do so by rebuilding it yourself? Does the build match the shipped binary on the play store?

To me, Signal does look exactly in the same boat as whatsapp. The fact that WhisperSystems didn't cooperate harder to ship Signal in F-Droid is also a major let-down.

Is any other app sharing the same protocol?

Re:There is no WhatsApp 'backdoor' by mtreis86 on Saturday January 14, 2017 @08:30AM (#13398285)
Used to be, called LibreSignal. They ran into legal issues.

https://github.com/LibreSignal/LibreSignal

There is a bounty for modifying the signal app source to drop play services.

https://www.bountysource.com/issues/35722527-create-proper-p...

Re:There is no WhatsApp 'backdoor' by lucideer on Saturday January 14, 2017 @08:36AM (#13398298)
Just to clarify on mtreis76's bountysource link, that work has already been completed and submitted by 8bitkid, and we're just waiting for it to be merged into Signal. Discussion on this here: https://github.com/WhisperSystems/Signal-Android/pull/5962
Re:There is no WhatsApp 'backdoor' by lucideer on Saturday January 14, 2017 @03:44PM (#13400442)
Also - I don't think the naming issue with LibreSignal was necessarily a legal one per se. Moxie just expressed his opinion that he didn't like that they were using "Signal" in the name. He didn't specifically ask them to rename it. They offered to rename it, to which he replied that he'd appreciate that. (They didn't rename it since they just discontinued it instead).
Re:There is no WhatsApp 'backdoor' by snowpanda on Saturday January 14, 2017 @11:36AM (#13399148)
They can't use the name LibreSignal because it has the word Signal in it?

Wow, even Microsoft didn't behave that juvenile about LibreOffice.

Re:There is no WhatsApp 'backdoor' by metaobject on Saturday January 14, 2017 @12:24PM (#13399411)
Yeah, they just sued some high school kid because of the domain name he chose:

https://en.m.wikipedia.org/wiki/Microsoft_vs._MikeRoweSoft

Re:There is no WhatsApp 'backdoor' by fapjacks on Saturday January 14, 2017 @02:53PM (#13400223)
I don't know about Canadian trademark law, but at least in the States, if you don't put effort into defending your trademark, you lose it. Completely different country, I know, but perhaps there's something similar in their law.
Re:There is no WhatsApp 'backdoor' by sschueller on Saturday January 14, 2017 @08:22AM (#13398257)
Wire uses the signal protocol. [1] I am not sure if they require google play services but I thought saw something a while back on their github regarding a fallback if google services was not installed and battery consumption.

[1] https://wire.com/download/

Re:There is no WhatsApp 'backdoor' by zedred on Saturday January 14, 2017 @12:10PM (#13399332)
They don't use the signal protocol, they don't even use X3DH or Double Ratchet. That citation of yours is just a download link, not an actual reference to your point.

The project is also kind of a mess. Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext group title, plaintext group avatar).

Check out some of the code. They have broken voice encryption, and leak enough data to reconstruct the audio of your calls. They leak tons of plaintext directly back to themselves, like searches, and rolled their own messaging crypto.

They have been caught lying about what kind of encryption they provide[1], they lied about being open source for years, they lied about being based in switzerland. From what I can tell, the only people promoting Wire are usually on Wire's marketing team.

1: http://www.pcworld.com/article/2855745/new-communications-ap...

Re:There is no WhatsApp 'backdoor' by FabHK on Saturday January 14, 2017 @02:46PM (#13400184)
I'm surprised at your negative take. The article you link is from 2014. They do encrypt chats now, and group chats, and voice, and video, all e2e, as far as I can tell.

My understanding is that the developers sit in Berlin, but the legal entity is in Switzerland.

Their privacy policy [1] states that they retain logs for 72h, and not much else. Only hashed contact info (emails/phone numbers) are uploaded, after opt-in. It all sounds very reasonable.

Your argument seems to be that they're an untrustworthy mess - but I don't see much evidence of that, except for possibly some braggadocio in that old article.

> Check out some of the code.

Yes, it is on github [2], so you can do that, which is nice.

[1] https://medium.com/wire-news/simple-privacy-policy-72-hour-l...

[2] https://github.com/wireapp

Re:There is no WhatsApp 'backdoor' by sschueller on Saturday January 14, 2017 @01:42PM (#13399833)
According to wikipedia "its instant messages with Proteus, a protocol that Wire Swiss developed based on the Signal Protocol" [1] so I guess it is just based on it.

[1] https://en.wikipedia.org/wiki/Wire_Swiss

Re:There is no WhatsApp 'backdoor' by ycmbntrthrwaway on Saturday January 14, 2017 @10:52AM (#13398914)
Wire uses Firebase Cloud Messaging (former Google Cloud Messaging) by default as it is the Google requirement. If you, as a developer, roll out your own solution, you simply get banned on Google Play. Claimed reason is that FCM/GCM delivers all your messages in batch, so it saves your phone power [0]. It is doubtful because your phone may enter Discontinuous Reception (DRX) state, so your cellular operator will deliver messages in batch anyway, but whatever. I think it is Google pushing developers to use their push servers while avoiding antitrust laws.

GitHub message about fallback to WebSocket you are referring to is here: [1]. So you can remove all Google services from your phone and install APK, it will still work, but now Wire server pings your phone whenever it wants. TLDR on the thread is that APK is not uploaded to F-Droid due to dependency (not really) on Google services.

[0] https://developer.android.com/training/monitoring-device-sta...

[1] https://github.com/wireapp/wire-android/issues/5#issuecommen...