somesay
somesay on Hacker News
Facebook Messenger is the thing where everything is minded and you'll get all the AI bots etc.
WhatsApp instead is their chat app for users how don't like Facebook. WhatsApp has way more users than Facebook Messengers. And now they have the PR and even don't have to deal with wiretapping requests anymore.
Once your number had e2e support0, you can't switch to a phone without e2e. Notifications on key changes are switched off by default, but I hope they still warn you in the chat history. We'll see.
You could backup the key like every other account password, too. Save it in your password manager, print it. Whatever. This isn't really an argument.
When Android backups Wifi passwords, those are encrypted with your Google password that Google has only a hash of. Okay, it's easily interceptable the next time you login and Google has an warrant. But still an option.
No. Actually, I would say fake encryption is even dangerous. WhatsApp might not always run end-to-end encryption for compatibility issues, there isn't even a visual indication for encrypted connections, there is no way to verify keys (if at all, they are verified by WhatsApp servers), so leaving a lot of room for all kind of man-in-the-middle attacks. The encryption itself isn't documented, and at the same time WhatsApp had added an option for (likely insecure) cloud backups. Yes, WhatsApp does fake security. But people believe it's secure. Now more than ever.
But those cases are only saying that companies can't comply to disclosure requests. That doesn't say if the encryption itself is weak or if the user has to completely trust that company. Just like the Apple case, where a 4-6 digit PIN is basically protected by Apple's secret firmware and its signing infrastructure.
There is nothing worse than a messenger that is commonly called secure but actually isn't (like the current implementation at WhatsApp). Cryptocat already had a massive disaster related to this problematic. Known as the chat program for activists in danger, it had a mathematical bug that made it nearly as weak as cleartext. Another one: As long as people aren't always explicitly using Secure Chats, Telegram isn't more secure than WhatsApp and doesn't use any end-to-end encryption. Still hyped for its security. While secure clients can definitely exist, most of the famous everyday solutions are just FUD and bullshit.
In my case using SMS for 2FA only works within their new interface. Whenever an online shop is redirecting to PayPal, it's the old login page (and doesn't notice when already logged in on PayPal), so I basically never receive 2FA codes in that step.
Not sure if just broken or they are using a different SMS gateway that has a problem with my country. It also doesn't really help that 2FA is still only known as hardware tokens within their documentation. It doesn't raise any trust for the PayPal website either.
Also keep in mind they tested all extensions with their default filter lists configuration while it reads like EasyList and EasyPrivacy would be efficient enough. As applying filter rules is basically the main work of those extensions and most extensions can use the same lists, they should have set all to the same lists where possible.
While it's also about liability, there seem to be people deadly allergic to even small amounts of e.g. nuts. Those notices are shown when production machines are also shared used for other products and cleaning is never completely safe.
I like the integrated window control buttons and it has a nicer name than this project. Besides from that both are good wrappers for web.whatsapp.com and have native notifications, notification counter etc.
I wonder why you're excluding StartSSL. It's no matter if you trust them as long as all major OS/browsers trust them.
> Also, since Google Code hosting project is closing down, you can expect more projects being driven to it.
Well, Google Code was never used for private repositories, so that argument is irrelevant for the intended free private repository introduction.
Having ads means you're acting commercially which is a very bad idea if you already in a semi-legal area. Besides from that it's far away from their initially spread ideology to make a lot of money or show porn ads. I mean TPB users always argue with not wanna seeing ads on DVDs and being enforced to anything and then their website is just unusable without ad blocker.
While the effort is remarkable, the web isn't fixed and this isn't responsive. Just wondering what happens if someone hasn't that font installed or the browser rendering is still different and everything is off then. At least the whole website isn't an image file ...
For me it's rather an expression of ignoring that websites are always slightly differently displayed than a good solution.
Hilarious if you see how Amazon still doesn't care about hyphenation on their Kindle platforms. It's an easy job, e.g. the algorithm used by LaTeX is free to use and with Amazon's size they might even build a good database to handle all exceptions. If you consider that this all could be precompiled, it doesn't even matter that a first-gen Kindle has a lousy CPU.
I haven't read the long article but it ends with:
> UPDATE (2014-09-06): As […] was the first to point out, RFC 7217 addresses all of my issues with “privacy” addresses. Let implementation come soon!
So, not backing your message.
What a joke, I hate those biased generalized articles.
> 1. Early-stage startup teams cannot afford to handle the hardware fragmentation that plagues Android.
You have a full stack of iOS devices, too, maybe even more expensive. It's a point if you develop quite near hardware features or want to do pixel-perfect designs without auto-layout, but that's difficult for iOS, too, these days. A messenger app is really not that device specific.
> 2. Study after study demonstrates iOS users are not only growing in key geographies, but are more valuable customers.
If it's about hype and money, you might be right, but if you just need users with a much more social diversity, Android is likely on your side.
> 3. iPhone 5c and future low cost models will likely steal share from Android relative to yesterday.
Dunno. You say "likely", too, so why is that even considered as a top 3 argument?
Nevertheless, the most important point here is: It's a messenger. For teams. You don't want split between iOS and Android devices and Talko itself sees this as negative point:
> (The corporate beta testers I spoke with sighed wistfully when reporting that a couple of team members could not participate because they didn’t use iPhones.) “We can’t build a business on this until we have all of the above,” says Ozzie, who wanted to make sure his engineers aced the iPhone first; [...]
iMessage's strength is its SMS fallback (still, who wants to send expensive text messages these days), but Facebook, WhatsApp etc. are generally much more used.
> Piping programs into each other is okay, but once you start bundling it's all up in the air.
How does bundling mean combining it into an _executable_ file? Sure, this could be the case for an installer, but that one could also just download/copy the files.
So why should they patch it then? Keep in mind that any attack using that bug is quite stealthy.
What's exactly the problem? Could be fixed by either getting the latest package upgrades from you favorite distro or compile an old version yourself with a specific flag set as mentioned in the security report. Or are you behind some third-party SSL proxy that doesn't react that fast?
Looks similar to FireChat (
https://itunes.apple.com/us/app/firechat/id719829352), using mesh network technology (according to news reports, not app description).
While the chat function is maybe more of a tech demo, it could be used in places with bad network coverage or at big events where the network is gone down for whatever reason. Also interesting for geolocated services, because you don't have to send your position to a central entity, so interesting for some privacy concepts.
Also you have to get to an USB port, seems like attackers know for some ATMs where to cut a hole in for that. But the real problem is that the machine isn't isolated well enough through hardware design. Just imagine you could access and replace the HDD. While it may use an XP exploit, that's not the real problem.
Since the life time end of normal XP (not even the embedded version), those "XP will doom our money" news spawn everywhere for no good reason.
TL;DR: It's primary a hardware design issue.
It's definitely not vendor specific since I've seen manuals for various devices.
When successfully started Android, you should be able to access it by long-pressing the power button to get into a popup menu, then long-tapping on the power off text button there. Also different hardware key combinations might work while booting.
Also, just speculative, Android itself might detect a boot loop or crashes while booting and then automatically restart into safe mode.
Well, current Android versions support starting the device in safe mode, not executing any third-party apps then, so that you can remove misbehaving apps. Looks like this is made exactly for such situations. Though I'm not sure if that mode is available on all devices, might depend on OS and boot loader.
That attack is then annoying and might cause device wipes due to not knowing that option, but looks not that blocking then. Google might also filter that attack by looking for that in their Google Play app check routine.
Are you using SPF and DKIM? Those proof that the emails are verified by the DNS of the sender's domain. Maybe IP based blacklists are more likely ignored since providers could rather block based on domains than. Both technologies are at least supported by Google Apps.
I would say, you always have to trust the service provider. While you can manually verify a direct end-to-end connection etc., web apps could always easily change, without user notice. Well, but that's also true for any proprietary app that isn't open source and code-reviewed.
It could be a browser feature in the future to sandbox those webcam data so that it's only transfered to a specific opponent. That has some problems to solve and is just a raw thought.
Well, but everyone could try guessing the names then, something they probably don't want. After all, it's just speculation what they have hidden there.
Apples and oranges. I guess availability (publish time and original language), being able to really download, collect and share a movie, play it without problems (HDCP, Silverlight, smartphone support, ...), not having to get a credit card etc. is way more important to people than you think. Also a flatrate for a specific catalogue is different than buying films, be it positive or negative. Don't forget the people who don't even have the Internet speed to stream high quality, but might download.
Well, differently to (mostly) pirate sites, GitHub hosts a ton of projects, how should they know that this is related to Popcorn Time? If they have any specific clue, they is quite a risk that they publish that and get real problems.
I guess full name credits to prove their participation in case of job interviews while not making it too easy for the lawyers to address them. A timestamped, maybe later revealed proof of knowledge or secret communication doesn't make a lot of sense here.
If they like the public to read it, they would have used a signature instead of an encryption. ;)