←back to thread

157 points lladnar | 1 comments | | HN request time: 0s | source
Show context
spacebanana7 ◴[] No.41864071[source]
I wonder whether WeChat is one of the safest messaging apps because it has the strength to say no to western agencies.

Signal and Matrix can be pressured with a rubber hose if there’s enough desire. And I imagine bureaucratic equivalents exits for iMessage and WhatsApp. But the CCP can offer genuine protection to WeChat executives.

replies(2): >>41864172 #>>41864215 #
palata ◴[] No.41864215[source]
> I wonder whether WeChat is one of the safest messaging apps because it has the strength to say no to western agencies.

That is not how cryptography works.

If you use proper end-to-end encryption (e.g. the Signal protocol), and assuming that you use it properly, then the server does not have access to the content of the encrypted messages. So the server cannot be pressured, period. So the Signal protocol is strictly better than a protocol that is audited and found wanting (TFA talking about the WeChat protocol here).

replies(1): >>41864312 #
vbezhenar ◴[] No.41864312[source]
Until next update will send your keys. Do you disassemble every update? I doubt it. In the end it's all about developer trust, because no popular messaging has thriving multi-client ecosystem after Jabber was abandoned. They all have "official" blessed client and some even fight third-party clients.

Not even talking about server side, things are just grim there.

replies(2): >>41864885 #>>41869842 #
1. palata ◴[] No.41869842[source]
> Until next update will send your keys. Do you disassemble every update?

This is actually a big problem with all the web-based stuff where you re-download your client everytime you use it.

Now for an open source mobile app, you can actually compile it from source without having to disassemble. But of course it's not practical to audit it yourself. However, if the same binary is distributed to millions of people, you only need one of them to see the exploit.

If Signal updated the app to send the key, it would do it for millions of people through the Play Store. That's risky. Unless Signal convinced Google to send a specific binary to a specific user of course, but that's harder.