<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Good observation Nadim, I'm also curious about the GPL question. Maybe some EFF folks can answer that?<div><br></div><div>On Mike Hearn's point re key verification problem:</div><div><br></div><div><blockquote type="cite">Cracking the usable key verification problem. This move brings WhatsApp to the same level of security as iMessage (or better, given the forward security), but WhatsApp/Facebook could still do a switcheroo on people's keys. TextSecure never really figured this out IMO - it still expects people to manually compare long strings of hex.</blockquote></div><div><br></div><div>I will, as seems to be my role here, recommend the blockchain and a system like DNSChain for solving this problem. :-)</div><div><br></div><div>The Onename folks are subsidizing registrations in Namecoin btw.</div><div><br></div><div>If you want to completely get rid of the possibility of an untrustworthy third-party doing a "switcheroo", then this is the only way to do it (as far as I can tell).</div><div><br></div><div>You can also, with the risk of third-party switcheroo, do a provider-based blockchain approach that I've talked about in previous emails here, which is where, for example, a provider registers gmail.bit (or migrates the .com to the blockchain), and then you query the user's public key from them over a MITM-proof channel that's secured by the public key for the service itself (which is stored in the blockchain).</div><div><br></div><div>Provider based systems, whether they're doing with a blockchain or not, however, will always (I think), have the switcheroo problem.</div><div><br></div><div><blockquote type="cite">Either way, this is historic. I think Moxie's team deserve immense<br>respect for accomplishing this. This is an accomplishment I will look<br>up to for many years to come. Truly inspiring.</blockquote><div><br></div>Hear hear! Congrats to everyone who was involved with this at Open Whisper Systems!</div><div><br></div><div>Cheers,</div><div>Greg</div><div><div><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br><div><div>On Nov 18, 2014, at 10:54 AM, Nadim Kobeissi <<a href="mailto:nadim@nadim.computer">nadim@nadim.computer</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Mike Hearn hits the nail on the head! My only questions were in fact<br>regarding how to handle identity authentication and how to deal with<br>the closed-source nature of WhatsApp damaging potential security<br>guarantees.<br><br>Although, I just noticed something: TextSecure is GPL, and Moxie says<br>that WhatsApp is using the same code as TextSecure. Doesn't that mean<br>that WhatsApp is now obligated to send a copy of its source code to<br>whoever demands it? :-) That would be amazing if true.<br><br>Either way, this is historic. I think Moxie's team deserve immense<br>respect for accomplishing this. This is an accomplishment I will look<br>up to for many years to come. Truly inspiring.<br><br>NK<br><br>-----Original Message-----<br>From: Messaging [<a href="mailto:messaging-bounces@moderncrypto.org">mailto:messaging-bounces@moderncrypto.org</a>] On Behalf<br>Of Joseph Bonneau<br>Sent: November 18, 2014 1:16 PM<br>To: Mike Hearn<br>Cc: messaging<br>Subject: Re: [messaging] WhatsApp & OWS team up<br><br><br>On Tue, Nov 18, 2014 at 11:23 AM, Mike Hearn <<a href="mailto:mike@plan99.net">mike@plan99.net</a><br><<a href="mailto:mike@plan99.net">mailto:mike@plan99.net</a>> > wrote:<br><br><br><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://whispersystems.org/blog/whatsapp/">https://whispersystems.org/blog/whatsapp/</a><br><br><span class="Apple-tab-span" style="white-space:pre"> </span>Huge, massive congratulations to Moxie and the team - this sort of<br>mainstream success is inspiring. I'd been hoping for a long time that<br>once TextSecure showed you could build a secure messenger with<br>production quality usability, Facebook / WhatsApp might pick it up,<br>and today my dream came true :)<br><br><br>I echo the major congratulations! One of our main goals with the EFF<br>Scorecard was to push big providers to take steps like this, hopefully<br>many more will follow suit.<br><br><br><span class="Apple-tab-span" style="white-space:pre"> </span>I can see a couple of directions to go now:<br><br><br>I would add<br><br>3) Design an efficient, auditable, privacy-friendly public key<br>directory. WhatsApp/TextSecure still largely rely on a centralized<br>public key directory. Cracking usable key verification would be great,<br>but I'd also like these key directories to be able to convincingly<br>prove to me that they've only signed for a certain set of keys for my<br>username over a given time period. Some work is underway on this at<br>Princeton and hopefully elsewhere...<br><br><br><span class="Apple-tab-span" style="white-space:pre"> </span>It will be interesting to see what the political ramifications of<br>this are. WhatsApp should now be pretty close to intercept-proof for<br>all governments bar the USA. Given its ubiquity and complete<br>centralisation inside California, I suspect this will result in all<br>kinds of interesting jockying as different countries try to get lawful<br>intercept capabilities to it (by switching keys, I guess).<br><br><br>Presumably Apple has already been in this position for over a year<br>with iMessage, although it might be more interesting because WhatsApp<br>doesn't have the political clout<br>_______________________________________________<br>Messaging mailing list<br>Messaging@moderncrypto.org<br>https://moderncrypto.org/mailman/listinfo/messaging<br></blockquote></div><br></div></div></body></html>