WhatsApp being banned under these plans would be doubly hilarious, since its encryption is a joke. There's a single hard-coded AES key for everyone. I'm sure SnapChat isn't much better.
The static AES key is for local log storage. This is about encrypted communications. They are working together with Open WhisperSystems to bring the e2e-encrypted TextSecure protocol to Whatsapp: https://whispersystems.org/blog/whatsapp/
Let's start being very cautious about that. Because
1) Whatsapp has never said publicly they are doing that
2) Now they might backtrack and say they never intended to add E2E encryption
3) Without a privacy policy change as well, the encryption change may be meaningless, since they'd give themselves permission to modify it whenever they wish.
And how would you know they didn't rip out the new system to replace it with the old one in one update? According to Moxie, the Android version already has the TextSecure built into it, yet I see absolutely no difference from the old Whatsapp.
Have you actually listend to the network traffic? It used to be plaintext, so its easy to check, if there is some encryption going on. If there is encryption, then its likly its the one interduced by the TextSecure people.
Why should it be diffrent? What did you expect to change? Thats the good thing about good crypto, the user does not even know its there.
I mean sure, I would like to be able to validate the other persons fingerprint and discover as soon as we are communicating diffrently, but relasticlly, what whatsapp did is the biggest jump in crypto usage since https.
Comments
WhatsApp being banned under these plans would be doubly hilarious, since its encryption is a joke. There's a single hard-coded AES key for everyone. I'm sure SnapChat isn't much better.
The static AES key is for local log storage. This is about encrypted communications. They are working together with Open WhisperSystems to bring the e2e-encrypted TextSecure protocol to Whatsapp: https://whispersystems.org/blog/whatsapp/
I don't know why people wouldn't just use TextSecure instead? Then you actually know.
Lack of an iOS app, just maybe?
If thats the biggest barrior, im happy.
network effects? UX? Come on, how can you even ask that question?
Let's start being very cautious about that. Because
1) Whatsapp has never said publicly they are doing that
2) Now they might backtrack and say they never intended to add E2E encryption
3) Without a privacy policy change as well, the encryption change may be meaningless, since they'd give themselves permission to modify it whenever they wish.
Privacy policy or some other ToS-like document should not matter to properly implemented technical security measures. That's the whole point.
And how would you know they didn't rip out the new system to replace it with the old one in one update? According to Moxie, the Android version already has the TextSecure built into it, yet I see absolutely no difference from the old Whatsapp.
Have you actually listend to the network traffic? It used to be plaintext, so its easy to check, if there is some encryption going on. If there is encryption, then its likly its the one interduced by the TextSecure people.
Why should it be diffrent? What did you expect to change? Thats the good thing about good crypto, the user does not even know its there.
I mean sure, I would like to be able to validate the other persons fingerprint and discover as soon as we are communicating diffrently, but relasticlly, what whatsapp did is the biggest jump in crypto usage since https.