News for hackers. Stuff that matters.

A comment on End-to-end encryption does not prevent Facebook from accessing WhatsApp chats. Parent comment

Re:End-to-end encryption does not prevent Facebook from acce... by xxs on Sunday November 18, 2018 @05:39AM (#18479725)
This is a very weak argument, eyeballs do find backdoors. Usually each commit is checked by few people and the introduction of the backdoor is rather obvious.

As for not knowing what has been downloading (if someone tempered with), the best approach is compiling it on your own.

[ Parent | on HN ]
Re:End-to-end encryption does not prevent Facebook from acce... by kasey_junk on Sunday November 18, 2018 @08:35AM (#18480290)
Can you cite any commits for any open source software where a back door was attempted to be introduced & code review found it pre-emptively?

The reason I ask is that this is an oft repeated claim about open source by developers yet when I talk to security people they don’t seem to care about open source nearly as much. To them inspecting binaries is table stakes anyway.

Meanwhile people write backdoors that aren’t obvious for fun. http://underhanded-c.org/

[ Parent | on HN ]
Re:End-to-end encryption does not prevent Facebook from acce... by gaius on Sunday November 18, 2018 @06:17AM (#18479836)
This is a very weak argument, eyeballs do find backdoors

Eventually, maybe. How many eyeballs and how long to find Heartbleed?

[ Parent | on HN ]
Re:End-to-end encryption does not prevent Facebook from acce... by zAy0LfpBZLC8mAC on Sunday November 18, 2018 @06:32AM (#18479876)
The question isn't whether there won't ever be backdoors, but how likely that is, how long they will stay in place undetected, and what the effects on the reputation of the product/project/committer are once they are discovered.

Bringing this up as an argument is a sensible as claiming that transparency and democracy isn't any better than a dictatorship because there is still corruption.

[ Parent | on HN ]
Re:End-to-end encryption does not prevent Facebook from acce... by Coxa on Sunday November 18, 2018 @06:27AM (#18479865)
There's a difference between a potential backdoor and a bug. While a lot of eyeballs might oversee a bug, you have to make an effort to design your backdoor to go unnoticed.
[ Parent | on HN ]
Re:End-to-end encryption does not prevent Facebook from acce... by gaius on Sunday November 18, 2018 @07:11AM (#18479983)
Good backdoors are indistinguishable from bugs, for plausible deniability
[ Parent | on HN ]