News for hackers. Stuff that matters.
Re:WhatsApp has removed answer to “how do I choose not to sh... by zaptheimpaler on Sunday December 05, 2021 @08:21PM (#29455126)
I sometimes wonder whether there is any purpose to it in the long term. If/when Signal becomes big enough to be used by a lot of people, they will want to monetize too and the governments will become interested in monitoring messages there too.

It just feels futile. As long as companies need to turn a profit and governments can surreptitiously surveil their citizens there's no long-term solution. We can move to the next platform until that becomes popular (and hence worth monetizing and surveilling), then the next, repeat.

Its a technical solution to a political problem.

Re:WhatsApp has removed answer to “how do I choose not to sh... by BLKNSLVR on Sunday December 05, 2021 @09:01PM (#29455370)
A decentralised, trustless future perhaps?

I'm semi-conspiratorial, semi-fatalistic about society's ability to change politics politically / non-technically. There are too many who are too apathetic (and I might even be one of them by already being semi-fatalistic) that anchor the current system in perpetuity. My conspiratorial side says this is by design, whilst my fatalistic side says it's human nature (essentially Hanlon's razor).

Revolutionary change is often a case of "it" getting (a lot) worse before it gets better, but with the inevitability of returning to the previous status quo just with different bums on the same seats. (I've previously stated my desire to write a novel based on this concept in order to try and explore the inevitability, or otherwise, of this 'revolution for nothing' and the changing priorities of individuals as their levels of power increase from zero to monarch and how that may just be a limitation of civilisation).

Re:WhatsApp has removed answer to “how do I choose not to sh... by EMM_386 on Monday December 06, 2021 @05:22AM (#29458051)
> There are too many who are too apathetic. Revolutionary change is often a case of "it" getting (a lot) worse before it gets better, but with the inevitability of returning to the previous status quo just with different bums on the same seats.

The problem with this is that you have far too many keyboard warriors who read clickbait headlines and decide they want to change the system.

The people actually working in that system have decades of knowledge about how it works. That isn't always a bad thing. They may understand how to navigate a complex system to get the real change you want, to actually happen.

Imagine if people in this "decentralized, trustless future" saw a YouTube video of an aircraft landing and came to the conclusion that they didn't use enough rudder on landing, without understanding the nature of a 25 knot crosswind.

They'd vote, the pilots would be fired, and aviation safety would drop another notch because the people voting didn't understand the scope of what they were voting on, because they weren't trained pilots.

Re:WhatsApp has removed answer to “how do I choose not to sh... by BLKNSLVR on Monday December 06, 2021 @06:10AM (#29458283)
I was referring to a potential way that messaging could avoid the ongoing pendulum between small, independent and as-yet un-tainted by snooping platforms and the large, popular, privacy invasions they eventually turn into because of their centralised control.

I wholeheartedly do not believe in making aircraft safety a democratic process.

Horses for courses.

Winston Churchill's quote: “…democracy is the worst form of Government except for all those other forms that have been tried from time to time…”

Re:WhatsApp has removed answer to “how do I choose not to sh... by EMM_386 on Monday December 06, 2021 @08:49AM (#29459669)
> I wholeheartedly do not believe in making aircraft safety a democratic process.

But if I read you correctly ("society's ability to change politics") ... this is how the US got things like January 6th.

It's completely destabilizing for a functioning democracy when relatively small groups of like-minded people can coordinate over private channels and rally themselves into something crazy.

The reason politics "works" (and I use that term lightly these days) in this country are because things are all done out in the open.

If you don't like "snooping" and would prefer our politics be done in the dark ... that isn't freedom, that's back-channel politics. We don't want that, I don't care if the left or the right is doing it.

I am actually in favor of E2E encrypted chats and the like. But we need to keep politics out in the light of day. If you want to change the system, run for office.

Re:WhatsApp has removed answer to “how do I choose not to sh... by BLKNSLVR on Monday December 06, 2021 @07:53PM (#29467886)
> I am actually in favor of E2E encrypted chats and the like. But we need to keep politics out in the light of day.

That aligns with my position. I fundamentally believe in the necessity of transparency in politics. What I don't believe in is the the necessity of government / law enforcement snooping on E2E encrypted chats.

I don't want back-channel politics, I want back-channel private conversations amongst the citizenry. If this enables some back-channel politics then that's a price I believe is worth paying partially due to the fact that the end results of political decisions and actions are, by necessity, public.

Politicians should, by policy, have their political communications recorded (not made public, but archived "just in case") since they're working for the public. Those who avoid such scrutiny should be named and shamed if it can be proven. Utopian, I'm aware.

Re:WhatsApp has removed answer to “how do I choose not to sh... by _carbyau_ on Sunday December 05, 2021 @11:51PM (#29456289)
"A decentralised, trustless future perhaps?"

I think we need a DNS-like service that simply hold small encrypted blobs, just big enough to contain an IPv6 address.

When you "add" someone to your list of contacts, you are giving them the key to decrypt the blob that you update with your IP.(Complications ahoy here but this is the basic idea.)

That way, people can message your phone/computer-of-choice direct with whatever E2E protocol you want. No middleman.

Then you need an app layer built on that to manage messaging, video calls, group chats etc. But that app layer could be open and free. People often like some XML based protocol from the 2000s, but as long as it is secure - whatever.

Re:WhatsApp has removed answer to “how do I choose not to sh... by GekkePrutser on Monday December 06, 2021 @12:13AM (#29456407)
There's so many issues with this. The biggest being the need to be online at the same time.

But other issues: using it from multiple devices? Using it from different locations?

Maybe it'll work with a tor hidden service or something because at least that stays the same (I think some chat apps already so that)

Re:WhatsApp has removed answer to “how do I choose not to sh... by _carbyau_ on Monday December 06, 2021 @06:07PM (#29466940)
The part here is a "DNS for all" approach.

Once you have that, everyone can run their own hosting. Everyone could have their own Matrix server, or whatever flavour of messaging you want.

Re:WhatsApp has removed answer to “how do I choose not to sh... by sul_tasto on Monday December 06, 2021 @01:28AM (#29456821)
You may be interested then in The True Story of Ah Q by Lu Xun.[0] There is also an adaptation by Christoph Hein that is quite good.[1]

[0] https://en.wikipedia.org/wiki/The_True_Story_of_Ah_Q

[1] https://de.m.wikipedia.org/wiki/Die_wahre_Geschichte_des_Ah_...

Re:WhatsApp has removed answer to “how do I choose not to sh... by mukundesh on Sunday December 05, 2021 @08:40PM (#29455258)
Signal is developed by a non-profit and is open source, they have a higher chance of staying independent. With the cost of cloud services dropping hopefully there is less of the back-pressure to monetise
Re:WhatsApp has removed answer to “how do I choose not to sh... by TaylorAlexander on Sunday December 05, 2021 @11:02PM (#29455989)
I’ve always assumed signal was a honeypot. They publish some source code but obviously we can’t verify the actual code running on iOS or (I assume) Android devices am I right? It seems like publishing open source could be a smoke screen. When they push code to devices they could link in alternate libraries that do whatever they want. They may even be able to push special code to targeted phones, avoiding detection by security researchers.
Re:WhatsApp has removed answer to “how do I choose not to sh... by indigo945 on Monday December 06, 2021 @12:11AM (#29456396)
If this is your threat model, you can sideload the app instead of installing from the app store. This way, you can verify that you have the same app as everyone else and have not fallen victim to a supply chain attack.

Ensuring you received an unmodified phone without a nefarious operating system or baseband is probably harder.

Re:WhatsApp has removed answer to “how do I choose not to sh... by TaylorAlexander on Monday December 06, 2021 @06:33AM (#29458450)
> If this is your threat model, you can sideload the app instead of installing from the app store.

Not on iOS.

Re:WhatsApp has removed answer to “how do I choose not to sh... by GekkePrutser on Monday December 06, 2021 @12:15AM (#29456426)
If they'd care to publish it on F-Droid they'd have reproducible builds. But alas they don't.
Re:WhatsApp has removed answer to “how do I choose not to sh... by hiq on Monday December 06, 2021 @04:04AM (#29457688)
> They publish some source code but obviously we can’t verify the actual code running on iOS or (I assume) Android devices am I right?

No, they have reproducible builds.

Everything else you said apply even more to other apps, not sure why you think Signal is more suspicious in that regard. But with reproducible builds and the .apk they have on their website, you can check that the source matches it every time you update, which is not something you can do with most other apps.

Re:WhatsApp has removed answer to “how do I choose not to sh... by TaylorAlexander on Monday December 06, 2021 @06:39AM (#29458506)
> they have reproducible builds.

Ah, I see on Android they do. Not iOS according to an open github issue since 2015.

I am suspicious of signal because everyone says "use Signal it is secure" and it is popularly known for this. Because of this reputation for security, users will get comfortable and talk about their illicit activity, which makes it an attractive target for power brokers the world over. Every app could have this problem, but Signal is the one everyone keeps saying is secure, so it's the place people will spill their secrets.

Reproducible builds on android look cool, but I wonder if there are other threat models on Android than dishonest builds of the program itself.

Re:WhatsApp has removed answer to “how do I choose not to sh... by javajosh on Sunday December 05, 2021 @08:47PM (#29455293)
BTW I just learned that you can setup Amazon Smile to pay Signal - .5% of your purchases goes to them as a donation. https://smile.amazon.com/ch/82-4506840
Re:WhatsApp has removed answer to “how do I choose not to sh... by perl4ever on Sunday December 05, 2021 @10:58PM (#29455970)
>If/when Signal becomes big enough to be used by a lot of people

I think people (including the government) noticed it a long time ago.

From 2015:

'According to CNN, "[t]he same technology that keeps a conversation private between you and a family member also gives a safe haven to a terrorist in Syria and the person in the United States he's trying to recruit to commit an act of mass murder."'

https://en.wikipedia.org/wiki/Signal_(software)

Re:WhatsApp has removed answer to “how do I choose not to sh... by DarylZero on Monday December 06, 2021 @09:15AM (#29459940)