1

Open Whisper Systems claims that its TextSecure messaging is end-to-end encrypted, but at the same time there are now some rather serious allegations of how it might be betraying its users.

If I understand it correctly, it seems they use a central server (or something similar) and therefore might store (and pass on if required by law) metadata about communications between its users (which of course is dependent on its own definition of "metadata", such as geolocation, which IMHO wouldn't be necessary for a simple messaging app to operate).

But then the Wikipedia entry also alleges that

Whisper participated in a DOD project about suicide prevention by sharing aggregate mentions of certain words on military bases.

This suggests that they also have access to the message content, which seems to collide with Open Whisper System's "end-to-end" claim.

How trustworthy are these allegations? Has anyone checked the client/server code who can shed some light on this?

  • Whisper has nothing to do with Open Whisper Systems / TextSecure. It's just a similar name. – CodesInChaos Nov 4 '14 at 10:27
4

You're confusing two different companies and products:

  • WhisperText LLC which develops the Whisper App

    They're the geolocating datasharing company that drew the criticism you linked.

  • Open Whisper Systems which develops TextSecure, RedPhone, Signal

    These are various end to end encrypted products. I have seen no reason to distrust them.

    But obviously even with end-to-end encryption, the server learns some metadata. It can promise not to retain it, but that's unverifiable. Some metadata could be avoided by routing through Tor, but that comes with its own share of issues.

  • Thanks for clearing that up, I guess that is good news then. – FriendFX Nov 4 '14 at 23:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.