News for hackers. Stuff that matters.
Re:If you care about user privacy, don’t use Facebook JavaSc... by StreamBright on Monday November 25, 2019 @08:55AM (#21628111)
I explicitly told everybody that I turned off messenger notifications on every device and uninstalled facebook from my devices years ago. If they want to reach me they can use Signal, Telegram or Keybase. Interestingly enough even my mother (in her 70s, no idea about computers) can use Telegram without a hickup. I guess it is a matter of dedication to push your peers off from Facebook.
Re:If you care about user privacy, don’t use Facebook JavaSc... by taneq on Monday November 25, 2019 @08:59AM (#21628140)
> If they want to reach me they can use Signal, Telegram or Keybase.

Maybe even... gasp SMS. Or "telephone".

Re:If you care about user privacy, don’t use Facebook JavaSc... by iudqnolq on Monday November 25, 2019 @11:28AM (#21629723)
SMS can be intercepted and read by essentially every country in the world and many criminal groups because of how flawed the protocol is. While smaller countries can't do mass ingress and automated analysis, they can still input your number into a system and then see what you text.

https://www.theguardian.com/technology/2016/apr/19/ss7-hack-...

Re:If you care about user privacy, don’t use Facebook JavaSc... by StreamBright on Monday November 25, 2019 @09:02AM (#21628157)
Sure but there are places like Berlin in Germany where network coverage is absolutely broken. Wifi works though. This is why the preference over SMS/GSM call.
Re:If you care about user privacy, don’t use Facebook JavaSc... by iudqnolq on Monday November 25, 2019 @11:16AM (#21629528)
WhatsApp is almost certainly safer and more privacy respecting than Telegram.

Telegram uses highly nonstandard cryptography (the founder hired a bunch of math competition winners and told them to design encryption from first principles), doesn't have E2E by default (unlike Whatsapp), and is owned by a quite sketchy Russian oligarch who started spending on democracy-related causes after a falling out with Putin.

Telegram uses dubious encryption and lies about their business (for ex calling themselves a nonprofit when they aren't), and they retroactively retracted and then narrowed their bug bounty program.

WhatsApp hired the company behind Signal to help them implement Signal's encryption protocol.[1] While it's not as good as Signal because it's not open source and thus can't be independently verified, if Facebook deliberately lied about the security of a product used by governments around the world they would face serious consequences.[2]

See for example previous discussion [3].

For a detailed analysis of the flaws in their protocol, see [4]

1: https://techcrunch.com/2014/11/18/end-to-end-for-everyone/

2: https://www.nytimes.com/2019/10/26/world/asia/afghanistan-wh...

3: https://news.ycombinator.com/item?id=15281788

4: https://www.cryptofails.com/post/70546720222/telegrams-crypt...

Re:If you care about user privacy, don’t use Facebook JavaSc... by StreamBright on Monday November 25, 2019 @01:15PM (#21631037)
WhatsApp calls and messages were used by Facebook. The point is that even Telegram does the same they have much less data about me that they can use. It is a good enough replacement of SMS and GSM calls even with broken crypto. For sensitive communication I would definitely use Signal or Keybase instead. Those are the tools that we use for work related things like software development. Keybase is actually pretty amazing. I think even the crypto backing it is solid.

https://keybase.io/docs/crypto/overview

Re:If you care about user privacy, don’t use Facebook JavaSc... by iudqnolq on Monday November 25, 2019 @04:16PM (#21632904)
> WhatsApp calls and messages were used by Facebook.

If that's true that would be extremely serious, given that Whatsapp promises end-to-end encryption

> WhatsApp end-to-end encryption ensures only you and the person you're communicating with can read what's sent, and nobody in between, not even WhatsApp. Your messages are secured with locks, and only the recipient and you have the special keys needed to unlock and read your messages. For added protection, every message you send has an unique lock and key. All of this happens automatically: No need to turn on settings or set up special secret chats to secure your messages.

> Important: End-to-end encryption is always activated. There's no way to turn off end-to-end encryption.

https://faq.whatsapp.com/general/28030015/

Source please?

Re:If you care about user privacy, don’t use Facebook JavaSc... by StreamBright on Tuesday November 26, 2019 @05:02AM (#21636920)
Re:If you care about user privacy, don’t use Facebook JavaSc... by iudqnolq on Tuesday November 26, 2019 @10:19AM (#21638972)
That's a serious issue I wasn't aware of. Do note however that for this attack to work you have to not notice a user you don't know added to your group chat. Nevertheless, this is much more serious than I knew.
Re:If you care about user privacy, don’t use Facebook JavaSc... by JohnFen on Monday November 25, 2019 @12:58PM (#21630851)
> WhatsApp is almost certainly safer and more privacy respecting than Telegram.

I doubt this because WhatsApp is Facebook.

Re:If you care about user privacy, don’t use Facebook JavaSc... by iudqnolq on Monday November 25, 2019 @01:11PM (#21631002)
FB is bad, but Telegram has managed to be even worse, which is quite the accomplishment. Their crypto is fundamentally unsound, and their business practices dubious and unethical. See the links I posted.
Re:If you care about user privacy, don’t use Facebook JavaSc... by JohnFen on Monday November 25, 2019 @01:17PM (#21631055)
You might be right -- I don't use either of them, so my interest in precisely who's worse is limited. Your argument leads me to think that they both should be avoided. In any case, regardless of whether or not Telegram is OK, nobody should be using Facebook products.