←back to thread

Should We Chat, Too? Security Analysis of WeChat's Mmtls Encryption Protocol

(citizenlab.ca)
157 points lladnar | 1 comments | 16 Oct 24 20:06 UTC | HN request time: 0.001s | source
Show context
spacebanana7 ◴[16 Oct 24 21:35 UTC] No.41864071[source]▶
I wonder whether WeChat is one of the safest messaging apps because it has the strength to say no to western agencies.

Signal and Matrix can be pressured with a rubber hose if there’s enough desire. And I imagine bureaucratic equivalents exits for iMessage and WhatsApp. But the CCP can offer genuine protection to WeChat executives.

replies(2): >>41864172 #>>41864215 #
palata ◴[16 Oct 24 21:53 UTC] No.41864215[source]▶
> I wonder whether WeChat is one of the safest messaging apps because it has the strength to say no to western agencies.

That is not how cryptography works.

If you use proper end-to-end encryption (e.g. the Signal protocol), and assuming that you use it properly, then the server does not have access to the content of the encrypted messages. So the server cannot be pressured, period. So the Signal protocol is strictly better than a protocol that is audited and found wanting (TFA talking about the WeChat protocol here).

replies(1): >>41864312 #
vbezhenar ◴[16 Oct 24 22:04 UTC] No.41864312[source]▶
Until next update will send your keys. Do you disassemble every update? I doubt it. In the end it's all about developer trust, because no popular messaging has thriving multi-client ecosystem after Jabber was abandoned. They all have "official" blessed client and some even fight third-party clients.

Not even talking about server side, things are just grim there.

replies(2): >>41864885 #>>41869842 #
1. hackernudes ◴[16 Oct 24 23:18 UTC] No.41864885{3}[source]▶
Signal does a far better job than most. They have open source clients. They sign their builds. The android build is reproducible (you can build it yourself and it will match exactly what they publish, see https://github.com/signalapp/Signal-Android/blob/main/reprod...). Presumably some people in the world do it.

Now of course I personally don't check the app shipped to me from the Google Play Store, but at least I could!

It's not that I disagree with your point at all. There are still many places for world powers to compel companies to spy on users (in both hardware and software). Just want to call out that Signal is doing pretty much the best they can.