Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by MrMullen | Hacker News Reader

Parent Full thread

MrMullen·

Whatapp's uses the Signal Protocol Java, which is open source.

https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...

https://github.com/WhisperSystems/libsignal-protocol-java

View on HN

Oh ffs, here we go again.

Yes, the signal protocol and signal's implementation are both open source, but you have no way to actually verify that WA has actually implemented the protocol correctly and securely. Sure you could do some basic packet analysis but this wouldn't tell you about the presence of any remotely triggered backdoors.

The only way for you as a user to actually verify the security is by reading the source and compiling the software yourself, or reading the source and verifying the signature via reproducible builds.

I really don't understand the business decision process here. If they just copied Signal with OSS/FOSS code and reproducible builds they would just win outright and tech people wouldn't have anything to complain about. The value of the service is the network anyway -- why care so much about the client?

There are many ways that both WA and Telegram can be subverted/backdoored/messed up. What it really comes down to, is who do you trust? Do you trust WA or Telegram? Personally, I trust WA a lot more than Telegram since WA has Moxie on their team and Telegram says, "Trust us" and a very unreasonable security challenge. I naturally don't trust people that say "Trust us" and put up unreasonable security challenges.

WhatsApp are owned by a company that is known to cooperate with PRISM. For that reason, I can't trust them.

This.

You can just decompile the program. Binaries aren't a magic black box. Given how much FB stands to lose by lying, is imminent l unlikely they think they can get away with hiding stuff in an Android app. As much as I despise FB, this isn't one of the reasons. (Using WhatsApp still gives them metadata and contact info.)

Reply on news.ycombinator.com