SoylentNews is people
SoylentNews
posted by
cmn32480
on Tuesday April 05 2016, @11:17PM
from the what-about-beginning-to-beginning dept.
from the what-about-beginning-to-beginning dept.
The title pretty much says it all. According to the report:
the service will encrypt all messages, phone calls, photos, and videos moving among [the devices].
Moxie Marlinspike is involved, so they have a chance of getting it right, and no one, even WhatsApp, will be able to know what you”re saying, texting, viewing, &c. (Unless, of course, your widget is running malware, or the opposition can get their mitts on it.)-: They claim this is available on nearly a billion devices—this is a really big deal.
takyon: Alternate links with no Wired paywall: TechCrunch, Washington Post, CNET, Reuters.
This discussion has been archived.
No new comments can be posted.
WhatsApp Encrypts End-to-End in Latest Version
|
Log In/Create an Account
| Top
| 52 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
squatcho, n.:
The button at the top of a baseball cap.
-- "Sniglets", Rich Hall & Friends
(Score: 3, Informative) by Pino P on Wednesday April 06 2016, @07:55PM
You mention the Ken Thompson "Trusting Trust" attack involving a backdoored compiler. That's far less of an issue now that we have multiple independent implementations of C++. With more than one compiler, you can bootstrap a free compiler off each of them. This is the "diverse double-compiling" mitigation [dwheeler.com] described by David A. Wheeler.
Phase 1: Start with three independent C++ compilers (call them VC++, IC++, and Clang++) and the C++ source code of a free C++ compiler (call it G++). Then compile G++ with each compiler. The resulting executables (G++/VC++, G++/IC++, and G++/Clang++) will differ due to different optimization approaches, but if none are compromised, all should have the same behavior, namely that of G++. The next phase will show that this is the case.
Phase 2: Now compile G++ with each of these G++/* executables. Because they have the same behavior, they should produce bit-identical executables: G++/G++. If the resulting executables differ (other than in embedded timestamps), then one or more of the compilers is compromised. But if they're the same, there are two possibilities. Either all compilers are clean, or they share the same backdoor. Which is more likely?