Re:Facebook to integrate the infrastructure for WhatsApp, In...
by feanaro on Friday January 25, 2019 @01:08PM
(#19000565)
Decentralization/federation and the existence of third-party brokers don't really come into play here. What is required is
[ Parent
| on HN ]
Re:Facebook to integrate the infrastructure for WhatsApp, In...
by ummonk on Friday January 25, 2019 @03:09PM
(#19002018)
Open source client doesn't really get you much, since you would need to audit the entire source code, then build it yourself, which you probably won't do. If you aren't doing that, you're implicitly trusting others to have audited the source code, and to provide builds that actually correspond to the source code. Now there are reasons to trust the open source community like this (lots of eyeballs, and people who care about security and privacy can inspect the source code and third party builds), but there is also one advantage to commercial software (including closed source) over open source: you're more likely to have someone to sue if they lie or mess up.
Re:Facebook to integrate the infrastructure for WhatsApp, In...
by throwawaymath on Friday January 25, 2019 @02:53PM
(#19001826)
An open source client is not required for end-to-end encryption.
Do you see what I'm getting at? We're quibbling about a technically precise definition instead of what you'd like to see in a secure messaging application.
Re:Facebook to integrate the infrastructure for WhatsApp, In...
by JetSpiegel on Friday January 25, 2019 @03:45PM
(#19002325)
If it's not open source, the e2e is merely a claim, instead of a verifiable property.
Re:Facebook to integrate the infrastructure for WhatsApp, In...
by feanaro on Friday January 25, 2019 @04:53PM
(#19002889)
Yes, this is what I meant. Unless we think of some magical way to verify that e2e is really happening (enter quantum voodoo or something similarly wild), the only way to verify is by actually inspecting the source code. Even this may not be enough, but it is a necessary precondition for now.