yes you can verity that it is secure by reverse engineering, just like someone can read the code, someone can reverse engineer it.
No, you can’t, at least not reliably. Reverse engineering is nowhere near as simple as “just like someone can read the code”.
It DOESN’T, they literally state that they don’t have encrypt metadata and can share it with other meta services
I don’t keep up with whatever WhatsApp is doing, so nice to know that it’s already worse than I thought, but it doesn’t really change my point.
which honestly as long as the messages themselves are encrypted is sadly still a much better option than sms
If I could be certain that the messages are in fact encrypted as claimed, I’d agree.
thanks for proving you don’t know, even the signal server doesn’t know ur contacts…
They do, just not in the way you probably think. Unique identifiers (which phone numbers typically are) can always be used to track users, even if they’re just stored as a hash value on a server. They don’t immediately reveal the identity of a person like clear text phone numbers could do, but there’s still information that can be extracted through metadata analysis. Though to be fair, this discussion is more relevant to anonymity than to privacy.
because it’d be above everything else and could see everything, no matter the sw ur using… so it’d be pointless anyways
Why would it be pointless? If some random person broke into your home, would you just open all the doors because apparently doors are pointless? Having one entity spy on you is a weird excuse to let another one do the same. I mean… you do you, but I think it’s a weird mentality to have.
Just like with whatsapp…
Not really, as any unwanted traffic to WhatsApp’s servers would just get drowned within wanted traffic, making it effectively unnoticeable to the user. The same can’t be said for hardware that tries to connect somewhere despite no software on that device being allowed to connect to the internet.
No, you can’t, at least not reliably. Reverse engineering is nowhere near as simple as “just like someone can read the code”.
sure, but someone would find out if WhatsApp didn’t e2ee their messages, which is the most important thing
If I could be certain that the messages are in fact encrypted as claimed, I’d agree.
Well you literally can be, because if it was not someone would find out instantly, it’d be a huge thing and meta would suffer greatly if they lied about e2ee
They do, just not in the way you probably think. Unique identifiers (which phone numbers typically are) can always be used to track users, even if they’re just stored as a hash value on a server. They don’t immediately reveal the identity of a person like clear text phone numbers could do, but there’s still information that can be extracted through metadata analysis. Though to be fair, this discussion is more relevant to anonymity than to privacy.
Sealed sender…, also signal is private, not anonymous, if you want both, simplex is ur friend
Why would it be pointless? If some random person broke into your home, would you just open all the doors because apparently doors are pointless?
well that’s not the same situation the robber wouldn’t see everything, the hw component would… also other doors have the function of keeping heat inside, not keeping robbers away
Not really, as any unwanted traffic to WhatsApp’s servers would just get drowned within wanted traffic, making it effectively unnoticeable to the user. The same can’t be said for hardware that tries to connect somewhere despite no software on that device being allowed to connect to the internet.
Well again if it did something like that, we would know thanks ro reverse engineering
sure, but someone would find out if WhatsApp didn’t e2ee their messages, which is the most important thing
Not necessarily. Code can be obfuscated.
Well you literally can be, because if it was not someone would find out instantly, it’d be a huge thing and meta would suffer greatly if they lied about e2ee
“Instantly”, yeah, sure… WhatsApp isn’t really used for secure communication (I wonder why), but by normies who don’t know any better. I doubt most users would care if something like this came to light.
Sealed sender…, also signal is private, not anonymous, if you want both, simplex is ur friend
Sealed sender has nothing to do with this, as it applies to messages. You can still build a profile of users based on which users submit which hashes for contact discovery, without the need for them to send any message to those contacts at all.
well that’s not the same situation the robber wouldn’t see everything, the hw component would… also other doors have the function of keeping heat inside, not keeping robbers aw
Not necessarily true, and also not really relevant to the analogy. If a hardware component would spy on basically everything, I’d find it weird to just say “Hey Intel, you already have all my data any way, so I’m just going to freely give it to Meta as well.”
Well again if it did something like that, we would know thanks ro reverse engineering
You’re putting too much blind trust in reverse engineering. And since you seem to be insistent on naively trusting Meta and proprietary applications, I won’t try to convince you otherwise. Have fun, I guess.
Sure, but someone would still find out. We can be 100% sure of that, so it’s still better than SMS period.
Instantly", yeah, sure… WhatsApp isn’t really used for secure communication (I wonder why), but by normies who don’t know any better. I doubt most users would care if something like this came to light
You have no idea how many businesses use WhatsApp and have their trade secrets on there even. And it is used for secure communication in the real world, in a lot of cases.
Sealed sender has nothing to do with this, as it applies to messages. You can still build a profile of users based on which users submit which hashes for contact discovery, without the need for them to send any message to those contacts at all.
That assumes the server can see which hashes belong to which account. Signal’s contact discovery is designed to match contacts inside a protected enclave, so the server doesn’t get a readable list of them. It may see that a lookup happened, but that alone doesn’t show it can build a contact profile
Not necessarily true, and also not really relevant to the analogy. If a hardware component would spy on basically everything, I’d find it weird to just say “Hey Intel, you already have all my data any way, so I’m just going to freely give it to Meta as well.”
Well, have you ever heard of Prism? But I do agree that the less companies you give your data, the better. But still… I don’t really think in this scenario it would make any difference.
You’re putting too much blind trust in reverse engineering. And since you seem to be insistent on naively trusting Meta and proprietary applications, I won’t try to convince you otherwise. Have fun, I guess.
No, I’m not. You’re putting way too much trust into open source software, since I’m sure you don’t read all the lines of code that there are. You’re basically doing the same thing as me.
No, you can’t, at least not reliably. Reverse engineering is nowhere near as simple as “just like someone can read the code”.
I don’t keep up with whatever WhatsApp is doing, so nice to know that it’s already worse than I thought, but it doesn’t really change my point.
If I could be certain that the messages are in fact encrypted as claimed, I’d agree.
They do, just not in the way you probably think. Unique identifiers (which phone numbers typically are) can always be used to track users, even if they’re just stored as a hash value on a server. They don’t immediately reveal the identity of a person like clear text phone numbers could do, but there’s still information that can be extracted through metadata analysis. Though to be fair, this discussion is more relevant to anonymity than to privacy.
Why would it be pointless? If some random person broke into your home, would you just open all the doors because apparently doors are pointless? Having one entity spy on you is a weird excuse to let another one do the same. I mean… you do you, but I think it’s a weird mentality to have.
Not really, as any unwanted traffic to WhatsApp’s servers would just get drowned within wanted traffic, making it effectively unnoticeable to the user. The same can’t be said for hardware that tries to connect somewhere despite no software on that device being allowed to connect to the internet.
sure, but someone would find out if WhatsApp didn’t e2ee their messages, which is the most important thing
Well you literally can be, because if it was not someone would find out instantly, it’d be a huge thing and meta would suffer greatly if they lied about e2ee
Sealed sender…, also signal is private, not anonymous, if you want both, simplex is ur friend
well that’s not the same situation the robber wouldn’t see everything, the hw component would… also other doors have the function of keeping heat inside, not keeping robbers away
Well again if it did something like that, we would know thanks ro reverse engineering
Not necessarily. Code can be obfuscated.
“Instantly”, yeah, sure… WhatsApp isn’t really used for secure communication (I wonder why), but by normies who don’t know any better. I doubt most users would care if something like this came to light.
Sealed sender has nothing to do with this, as it applies to messages. You can still build a profile of users based on which users submit which hashes for contact discovery, without the need for them to send any message to those contacts at all.
Not necessarily true, and also not really relevant to the analogy. If a hardware component would spy on basically everything, I’d find it weird to just say “Hey Intel, you already have all my data any way, so I’m just going to freely give it to Meta as well.”
You’re putting too much blind trust in reverse engineering. And since you seem to be insistent on naively trusting Meta and proprietary applications, I won’t try to convince you otherwise. Have fun, I guess.
Sure, but someone would still find out. We can be 100% sure of that, so it’s still better than SMS period.
You have no idea how many businesses use WhatsApp and have their trade secrets on there even. And it is used for secure communication in the real world, in a lot of cases.
That assumes the server can see which hashes belong to which account. Signal’s contact discovery is designed to match contacts inside a protected enclave, so the server doesn’t get a readable list of them. It may see that a lookup happened, but that alone doesn’t show it can build a contact profile
Well, have you ever heard of Prism? But I do agree that the less companies you give your data, the better. But still… I don’t really think in this scenario it would make any difference.
No, I’m not. You’re putting way too much trust into open source software, since I’m sure you don’t read all the lines of code that there are. You’re basically doing the same thing as me.