Re:We Chat, They Watch
by sandworm101 on Thursday May 07, 2020 @10:03PM
(#23110631)
Verifying the software one is running is not absolutism. Just because one cannot provide 'perfect' security isn't a reason to give up trying to provide some security by elevating the effort requires to conduct an attack. That locks can be picked isn't an excuse to not bother locking the door.
You'll note that logically a company cannot actually solve this problem themselves in a satisfactory way, since you would have the same problem trusting the verification mechanism as you did trusting their app in the first place.
What you want belongs as an operating system or app distribution mechanism concern. A third party OS extension might make sense. Even that's a bit fraught if there is any kind of dynamic code execution (aka code that appears at runtime, say, a web view).
Re:We Chat, They Watch
by danielheath on Thursday May 07, 2020 @09:32PM
(#23110454)
AFAIR Whatsapp does send a copy of your messages to facebook if the messages flag the apps internal 'sounds-like-criminal-activity' scanner.
Do you have a reference for this please? All I can find is this "false alarm": https://www.schneier.com/blog/archives/2019/08/more_on_backd...
Re:We Chat, They Watch
by sandworm101 on Thursday May 07, 2020 @11:39PM
(#23111183)
"We report all apparent instances of child exploitation appearing on our service from anywhere in the world to the National Center for Missing and Exploited Children (NCMEC),"
https://faq.whatsapp.com/en/general/26000050
Something is being watched. I imagine they are hashing images and comparing them to a database.
Interesting, yep: https://faq.whatsapp.com/en/165022051727702/
Thank you.
The fact that one of the founders of Whatsapp left Facebook in a disagreement, leaving $850M of unvested options on the table, and took what he had earned to found the Signal Foundation is a pretty clear indicator towards something in that direction at least.
Re:We Chat, They Watch
by dajohnson89 on Thursday May 07, 2020 @09:51PM
(#23110554)
Do you have a source on that?
Absolutism isn't helpful IMHO, there is no true security in this world only degrees of trust and risk. You can always go one step further in securing a product but the first step still matters.
I think there's real value in companies implementing e2e (and it's hard! it's super hard politically to get this done when the business sees little value for the effort and I know this because I've successfully fought to get e2e into a product).
The reality from my point of view is that it takes idealists inside to convince a commercial entity to lock themselves out of value (commercial surveillance) they could capture. I find a company's stance on e2e to be a valuable signal.