News for hackers. Stuff that matters.

A comment on WhatsApp gives users an ultimatum: Share data with Facebook or stop using app. Parent comment

Re:WhatsApp gives users an ultimatum: Share data with Facebo... by h_anna_h on Thursday January 07, 2021 @06:49PM (#25679343)
Afaik, the messages should be deniable as long as they are not signed, not sure how delta chat handles it though. Regarding deniability I personally would consider it as an anti-feature because the one receiving the message can't prove to the wider world that they received it from a certain person and similarly someone who is falsely accused of posting a certain message can't go and say "show the signatures of the messages or you are lying".

By the way, do you know if the one receiving the messages can force messages that are marked as "disappearing" to be kept?

[ Parent | on HN ]
Re:WhatsApp gives users an ultimatum: Share data with Facebo... by dan-robertson on Friday January 08, 2021 @09:24AM (#25684980)
It is true that messages would be deniable if they weren’t authenticated. The design of signal’s protocol is such that messages are authenticated but deniable: it is possible for the recipient to determine that the message was genuine (the information you want to send) but it is not possible for a third party to prove that a message was authentic (the information you don’t want to leak).

See also, this article about doing the same for email: https://blog.cryptographyengineering.com/2020/11/16/ok-googl...

[ Parent | on HN ]
Re:WhatsApp gives users an ultimatum: Share data with Facebo... by h_anna_h on Friday January 08, 2021 @12:34PM (#25687234)
> The design of signal’s protocol is such that messages are authenticated but deniable: it is possible for the recipient to determine that the message was genuine

Via the use of MACs, yes. I never said otherwise. What I said before still holds, as the recipient you can't prove to others that you indeed received a message by a certain someone rather than forged it yourself to incriminate them.

> See also, this article about doing the same for email: https://blog.cryptographyengineering.com/2020/11/16/ok-googl...

The "Marisa" person in the comments is a friend of mine from IRC and I agree 100% with what she said.

[ Parent | on HN ]