Klaus Jónsson Zimmermann (alternative acc)Jan 20, 2017
1. WhatsApp has a backdoor that can be used to decrypt your "end-to-end encrypted" texts.
2. People discover said backdoor (I guess through poking around or reverse engineering, since it's proprietary and code inspection isn't possible) and warn WhatsApp about it.
3. WhatsApp acknowledges existence of backdoor, says it's intentional ("it's not a bug, that's our design!") and they won't bother fixing it.
4. Millions of people continue using communications that can be actively intercepted, because they were told that some "encryption" thing they know nothing about would protect them.

Why am I not surprised here?

https://gnusocial.club/url/40013

Don't use #WhatsApp. Just don't.

!privacy
Show threadunivalence electronJan 20, 2017
@kzimmermann2 @hobbsc the EFF's explanation https://quitter.no/url/841522
Show threadKlaus Jónsson Zimmermann (alternative acc)Jan 20, 2017
@amsomniac @hobbsc yeah, that's the same link I referred to.
Show threadunivalence electronJan 20, 2017
@kzimmermann2 @hobbsc oops, sorry about the duplicate. #WhatsApp is proprietary, #Signal requires Google Cloud Messaging and won't allow #fdroid to distribute. I like #silence.im but everyone I know uses Signal.
Show threadKlaus Jónsson Zimmermann (alternative acc)Jan 20, 2017
@amsomniac No worries! But whoa, everyone you know uses Signal? That's pretty amazing, I thought its adoption rate was more or less that same as XMPP's.

I won't use Signal myself either because of that same problem (and their unwillingless to federate), so I guess the best approach still is plain old XMPP with OTR/OMEMO on top.

@hobbsc
Show threadunivalence electron
@kzimmermann2 @hobbsc *everyone I know who uses encrypted chat, which is only 10 or so people. Conversations is a great #XMPP client!
Jan 20, 2017 at 11:02pmWeb
Show threadKlaus Jónsson Zimmermann (alternative acc)Jan 21, 2017
Agreed, it's a pretty good client indeed, especially for beginners as it mimics the behavior of other popular chat clients (starts on boot, runs on background, no need to sign