AWS acquires Wickr
aws.amazon.com
aws.amazon.com
Now that it will have a corporate implementation people should remember that corporately administered clients (e.g. Teams) save and record a copy of everything you say and do and AWS Wickr is likely to be no different.
As Signal is mentioned in this comment thread, I don't see the hit on Signal about the phone number piece as being a big downside. The app is about privacy not anonymity and a phone number is a pretty unique UID. I never installed Signal to talk to anonymous strangers, everyone on my list is someone I know because of the phone number UID. True, I don't know everyone's phone number but I'm probably also not talking to them often or ever.
It's very hard to get people to try a different messenger. People are very wedded to the Facebook corporation (FB, Instagram, Whatsapp). It bothers me when I talk about something and then see ads for it shortly after. Obviously not only is it bot-mined for ad purposes, but rather, I don't believe FB ever deletes the data. They are the administrator and likely keep it forever. This is why I personally think Google is better, they mine it with bots, but unlike FB they don't sell data to third parties.
Signal is probably at the current time the last non-corporate messenger that is secure and is easy enough to setup and use (other suggestions like Matrix have a barrier to entry that is too high because it requires both technical knowledge and the ability to find your correspondents). It can't be acquired due to it being a non-profit foundation so it's likely to be around for a long time to come.
Why Wickr, I don't know. It's not to protect the buyers because the police does not care about them.
Threema exists does e2ee, does not require a phone number (but in practice it is much easier to use it), is fairly easy to setup and has been around for 9 years now.
The only downside compared to Signal is that backups are slightly more cumbersome because the password is required to be 9 characters instead of four digits as in Signal. But I don't trust Intel SGX so that is a win in my book.
Since Signal currently seems to live off of the loan from Brian Acton, I wouldn't assume the future to be quite as rosy as you paint it to be. Group video calls and everything Intel SGX must be quite expensive.
I don't think many people noticed at the time, that BillG took being prosecuted by the government very hard indeed. William H Gates III "Trey"to his oldest friends, is American establishment : daddy was Nixon's attorney and mom sat on the board of IBM.
Neither do I remember many people who ostensibly cared a great deal about the Microsoft anti trust case, following the actual litigation when it was happening. I read every word and watched as much as I could of the trial. Gates was a disaster on the witness box but nothing least because the allegations - charges and basis of charges - were so universally preposterous in their formation. The New Old Thing blog basically tells you what Justice should have found out in their discovery process and consequently narrowed the case to something other than a massive spite bomb. Reportedly Gates underwent a nervous breakdown of some serious nature midway through his epic examination on the stand. Microsoft were the last I looked the only major not to have backed away from a agreement to enforce the minimum of legality requirements for LEO access to personal information and accounts and Microsoft was spending close to one billion dollars annually merely to reject ludicrous illicit and unfounded demands for access to accounts. I don't know any other cloud computing company who will let me hold the only hardware key to my infrastructure across their cloud and using the same infrastructure and integrations (Thales, a major French defence contractor is the supplier and the solutions pretty good in my experience). At least I'm not surprised that few hail Microsoft for their efforts - advertising flipping fingers at the most self righteous authority establishment for generations isn't probably the best idea.
Here's the pdf description of Skype Private Conversations:
https://az705183.vo.msecnd.net/onlinesupportmedia/onlinesupp...
There are tons of legal situations where confidentiality is absolutely necessary, for example when dealing with medical or legal records. I imagine Amazon's GovCloud might incorporate this as a potential cloud hosted chatting solution.
With telemedicine and remote legal proceedings becoming more and more common, secure chatting while complying with HIPAA and confidentiality rules is going to be an important market.
Signal illustrates swinging far in the "confidentiality" direction - most messaging services don't forget anything you say, while Signal makes it rather hard for you to retain your messages, and also offers ways to delete them automatically. I find it unfortunate there are no secure, open messaging platforms that offer similar integrity/availability guarantees to services like Slack.
It's particularly challenging at the edges of your engineering org where people tend to use tools that abstract the technical details.
Yeah, that tends to be where you run into issues...
Technical controls are the easy part. I've often dreamed of some type of way to streamline the policy --> process --> documentation pipeline.
Edit: For those that have never heard of it, its their own IM, that while publicly available, is mostly used internally for company communications, similar to Slack or Skype for Business.
[1] https://www.theverge.com/2020/6/4/21280829/slack-amazon-aws-...
[1] https://www.theverge.com/2020/6/4/21280829/slack-amazon-aws-...
Kind of sad as video is a extra paid feature!. It is very limited in functionality, no screen share or view on mobile, no easy way to do audio/phone bridge.
The connections or bad that my org disabled audio/video calling on slack and encourage users to use Teams only.
Our AWS account manager pushed us hard to use it for our checkins.
My guess would be that this could augment Chime, and position it to be a useful part of GovCloud offering from Amazon.
that's a pretty bold claim.
If “the industry” is one that currently uses POTS then it is the most secure, yes- because they sell enterprise software to various industries.
The thing is: they use different protocols on their consumer apps than their enterprise ones; only the enterprise ones have an open (or, released) protocol specification.
The big sell for enterprises is actually what probably invalidates the statement you highlighted. Compliance, administrative controls, and audit almost always are significant threat surfaces that are exposed deliberately. Ideally to only the right people, but it's basically the equivalent of a cryptographic back door. It's less secure by design, but for a purpose.
He is the Chief Information Security Officer (CISO)
You get purchased by Amazon after securing a military contract, not by being an awesome way for online drug vendors to chat with customers. Though perhaps that's what got them the US Air Force contract to begin with...
> Prior to AWS, he had an extensive career at the Federal Bureau of Investigation, where he served as a senior executive and section chief.
I reads a bit differently as "ex-FBI brass pleased to announce his new employer acquired your drug dealer's favorite encrypted chat app".
> With Wickr, customers and partners benefit from advanced security features not available with traditional communications services – across messaging, voice and video calling, file sharing, and collaboration. This gives security conscious enterprises and government agencies the ability to implement important governance and security controls to help them meet their compliance requirements.
Wickr is going to be intertwined with AWS products so Amazon can sell them to "security conscious enterprises and government agencies."
Wickr has a large contract already with the US military so I guess this closes a gap they needed closed.
Isn't it closed source? What is known about their tech?
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
This is a bit interesting: https://news.ycombinator.com/threads?id=jwsec
Wickr's focus was never on the HN audience. Their "bullseye" was the audience of DEF CON attendees who have some ties to capital "e" Enterprise and/or US public sector.
Where there were overlapping users, great, but traction on HN was unlikely to lead to organization wide enterprise license agreements.
[1] https://www.reddit.com/r/antipornography/comments/ekefao/rjo...
... but Amazon's stock would be 1/4 the price if it were valued like Lockheed Martin.
Focusing on the US Government, they’re jumping right in to the deep end of the pool.
Increasingly, end-to-end cryptography is what customers expect. We also use end-to-end cryptography in other Amazon systems, most recently including Ring doorbells - https://support.ring.com/hc/en-us/articles/360054941511-Unde...
Amazon has zero recourse in this situation, neither would they risk their gov contracts fighting it.
Amazon has plenty of recourse, and they've been fighting gag orders for years now. Ex: https://arstechnica.com/tech-policy/2016/09/microsoft-amazon...
The company leading that charge: Microsoft. The company that got the huge JEDI DoD cloud contract: Microsoft. Weird, huh?
Also, metadata.
To be fair, this is the fairy-tale that's told on every acquisition. I'm pretty certain this same narrative was spun even when facebook acquired occulus.
Not saying this will be similar, but just hearing those words is not assuring by itself.
Regardless of any promise, professed dismay, warranty, or other statement by Amazon, this product is no longer a trustworthy interface for private communications. The mere presence of the company brings such high probability of capitulation to government or corporate eavesdroppers that it's basically a useless asset to own IMPO.
You can make it weaker without getting rid of it. Whatsapp also has E2EE on the message contents, does it stop Facebook from sharing all your contacts, call metadata, message times etc with the authorities? Very unlikely.
The beauty of Wickr is it provided disposable identities and relatively strong anonymity, and fended off bulk interception using an end to end security protocol. The market for it was smaller because while everyone says they want security, I found that the risk/reward of anonymity is too risky for most people. The people I knew who did use Wickr were political staffers and operatives/activists on campaigns, law enforcement, and other fields where they had official recourse to protection.
The reason for AMZN to buy Wickr is that it is a trustworthy secure messenger product with a valuable and influential user base, and an evolution of the product without anonymity is probably the case for growth.
I don't see it being backdoored so much as just adapted to leverage its existing user base to fill out a feature need in a suite of AWS collaboration tools that will compete against Teams/Github, Zoom, Atlassian, etc.
Or, rather, the reason is they turned all that into a platform:
I can't trust AWS will be truthful about their crypto systems and lack of backdoors.
[0] - https://twitter.com/matthew_d_green/status/13571435600055091...
Invite a bad actor into the building in order to keep bad actors out.
Invite bad actor into the building?
Hmm, maybe not.
[0] https://sockpuppet.org/blog/2015/08/04/is-extended-random-ma...
[1] https://www.theguardian.com/commentisfree/2021/may/18/amazon...
The government contracts don’t give me confidence in their technology, it gives me the impression they sell snake oil to “security conscious” organizations just like that article says. Its like worded specifically to avoid any liability in the eventual lawsuit where people complain that it didn't offer what they expected.
The AWS acquisition gives me even less confidence.
The standard for less skepticism for me is distributed end to end encryption where handshakes are done between the specific parties communicating
This is common (but often ignored) knowledge on darknet forums and markets, where Wickr also doesnt have a good client for darknet operating systems - further pointing to it having an intended purpose of not offering privacy by not prioritizing it for Whonix and Tails
Most of the literature about this trepidation and solutions are not on clearnet but you can get a glimpse of sentiment in comment replies here:
https://www.reddit.com/r/tails/comments/4z182s/does_tails_wi...
The rest of the literature would be on Tor onion services like Dread, or forums in existing or defunct darknet marketplaces
Wickr as of 10/2020 "has created a federal advisory board that includes Matt Olsen, chief trust and security officer, Uber (former director of the National Counterterrorism Center); Vince Stewart, chief innovation and business intelligence officer of Ankura (a former deputy commander of U.S. Cyber Command and former Defense Intelligence Agency Director); Jan Tighe, former deputy chief of naval operations for information warfare and director of naval intelligence; and Joanne Isham, former deputy director of the National Geospatial Intelligence Agency."
https://www.defenseone.com/business/2020/10/global-business-...
As every other is getting sold. With current level of browser support, assuming that might not take too much time.
I can't beleive govt is not interested in spying on Wickr convos.
My understanding is that their intended audience is the general public, not crypto-security geeks, and as part of that they wanted integration with existing address books. With a small team, developing all the security and usability was more important than eliminating the phone number piece.
They apparently don't retain any data but the phone number, and I think the registration date and last logon date.
App Security #users ease Functio- Price
& privacy Germany of use nality
Element o - - o Free
Signal + o + + Free
Telegram - + ++ ++ Free
Threema + o o o $3-$4
Whatsapp o ++ + + Free
Wire + o - - Free
++ very good + good o good enough - badhttps://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHal...
You think a company enabling the police state through Ring doorbells gives a rats ass about privacy?
Signal: telephone number as ID