News for hackers. Stuff that matters.
Re:We Chat, They Watch by sandworm101 on Thursday May 07, 2020 @09:02PM (#23110280)
>> WhatsApp is end-to-end encrypted so the service providers themselves can't read the message content, yes, definitely. Although, technically the security guarantees are nil unless you verify safety numbers which I can guarantee almost nobody actually does.

Except that there is no way to prove this. There is no way to prove that it isn't also sending a copy from the client back to the server. Whatsapp could deploy individualized specific clients to target users, perhaps at the behest of governments. The only full answer is totally open-source software with users able to cryptographically verify that they are downloading and running the same software as everyone else.

Re:We Chat, They Watch by zxcmx on Thursday May 07, 2020 @09:24PM (#23110413)
That's still not a full answer, of course, your proprietary operating system or closed chipsets can spy on you.

Absolutism isn't helpful IMHO, there is no true security in this world only degrees of trust and risk. You can always go one step further in securing a product but the first step still matters.

I think there's real value in companies implementing e2e (and it's hard! it's super hard politically to get this done when the business sees little value for the effort and I know this because I've successfully fought to get e2e into a product).

The reality from my point of view is that it takes idealists inside to convince a commercial entity to lock themselves out of value (commercial surveillance) they could capture. I find a company's stance on e2e to be a valuable signal.

Re:We Chat, They Watch by sandworm101 on Thursday May 07, 2020 @10:03PM (#23110631)
Verifying the software one is running is not absolutism. Just because one cannot provide 'perfect' security isn't a reason to give up trying to provide some security by elevating the effort requires to conduct an attack. That locks can be picked isn't an excuse to not bother locking the door.
Re:We Chat, They Watch by zxcmx on Thursday May 07, 2020 @11:27PM (#23111122)
You'll note that logically a company cannot actually solve this problem themselves in a satisfactory way, since you would have the same problem trusting the verification mechanism as you did trusting their app in the first place.

What you want belongs as an operating system or app distribution mechanism concern. A third party OS extension might make sense. Even that's a bit fraught if there is any kind of dynamic code execution (aka code that appears at runtime, say, a web view).

Re:We Chat, They Watch by danielheath on Thursday May 07, 2020 @09:32PM (#23110454)
AFAIR Whatsapp does send a copy of your messages to facebook if the messages flag the apps internal 'sounds-like-criminal-activity' scanner.
Re:We Chat, They Watch by zxcmx on Thursday May 07, 2020 @09:35PM (#23110468)
Do you have a reference for this please? All I can find is this "false alarm": https://www.schneier.com/blog/archives/2019/08/more_on_backd...
Re:We Chat, They Watch by sandworm101 on Thursday May 07, 2020 @11:39PM (#23111183)
"We report all apparent instances of child exploitation appearing on our service from anywhere in the world to the National Center for Missing and Exploited Children (NCMEC),"

https://faq.whatsapp.com/en/general/26000050

Something is being watched. I imagine they are hashing images and comparing them to a database.

Re:We Chat, They Watch by zxcmx on Thursday May 07, 2020 @11:52PM (#23111233)
Re:We Chat, They Watch by monocasa on Thursday May 07, 2020 @09:54PM (#23110582)
The fact that one of the founders of Whatsapp left Facebook in a disagreement, leaving $850M of unvested options on the table, and took what he had earned to found the Signal Foundation is a pretty clear indicator towards something in that direction at least.
Re:We Chat, They Watch by dajohnson89 on Thursday May 07, 2020 @09:51PM (#23110554)
Do you have a source on that?
Re:We Chat, They Watch by Canada on Thursday May 07, 2020 @10:16PM (#23110703)
> Whatsapp could deploy individualized specific clients to target users, perhaps at the behest of governments.

How can Facebook/WhatsApp do this on Android or iPhone?