WhatsApp's Signal Protocol integration is now complete • Hacker News Board

Re: WhatsApp's Signal Protocol integration is now complete

#71

Post by tptacek » Tue, Apr 05, 2016, 5:12 PM UTC

jamesdwilson wrote: post #66

tptacek wrote: post #61

Earlier quoted context omitted.

Very angry open source advocate, I understand how frustrating it must be that the current safest mainstream messaging protocol is not open source, but once again: that's not how computer software works. WhatsApp isn't even obfuscated. There are tens of thousands of people who read "closed source" software as a hobby . Later : Also? That's not what the term "side channel" means.

do you know even with source, backdoors can be hidden? open source is a must to even begin to work to verify any claims of security.

Your comment here is incoherent. I agree: source can easily lie. How does that make it the gold standard for verification? The reverse-engineering of the actual shipped binary (for instance, the ARM code lifted to LLVM) seems like a safer analysis target. But, what do I know.

Re: WhatsApp's Signal Protocol integration is now complete

#72

Post by schlowmo » Tue, Apr 05, 2016, 5:12 PM UTC

blackoil wrote: post #54

schlowmo wrote: post #33

Earlier quoted context omitted.

Point taken. If I talk to "normal" people, I wouldn't use the word "protocol" neither (or at least not as conversation starter). Normal-people-rephrased it's more like "When whatsapp take the fundamental core from signal..."

can Signal be used to contact people on Whatsapp?

As far as I know: no. Whatsapp just implemented the (open source) signal protocol formerly known as Axolotl with the help of Open Whisper Systems. The rest of the IM "ecosystem" (like push notifications, contact recognition, server infrastructure etc.) is left untouched.

Re: WhatsApp's Signal Protocol integration is now complete

#73

Post by tptacek » Tue, Apr 05, 2016, 5:12 PM UTC

dest wrote: post #64

tptacek wrote: post #37

Earlier quoted context omitted.

Closed source software isn't impenetrable. The idea that you need source code to evaluate security claims is mostly a meme from the 1990s.

Taking the example of Skype, the hardening/on-the-fly decryption techniques used in the binary made the reverse engineering very difficult [0]. Difficult to reliably audit such software. Don't know about Whatsapp though. [0] http://www.oklabs.net/skype-reverse-engineering-the-long-jou...

That was true in the case of Skype (which was eventually reversed), but it is not true here.

Re: WhatsApp's Signal Protocol integration is now complete

#74

Post by subliminalpanda » Tue, Apr 05, 2016, 5:13 PM UTC

motdiem wrote: post #13

rguldener wrote: post #2

I am not seeing the information about encryption they mention in any of my chat details on the iOS client. Is this part Android only or did simply non of my contacts upgrade yet? I have version 2.16.1 edit: After a while it now shows up with certain contacts for me

I got a message in my stream right after I sent a message saying 'the messages in this conversation are now protected by end to end encryption' clicking on it takes you to this page https://www.whatsapp.com/security/?l=en - I'm using 2.16.1

Still not seeing it myself. I wonder if this is being rolled out in chunks.

Re: WhatsApp's Signal Protocol integration is now complete

#75

Post by skybrian » Tue, Apr 05, 2016, 5:14 PM UTC

zeveb wrote: post #39

mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

Noise is really interesting. I'd hoped from the name that it might incorporate some of the ideas behind Dust[1], which attempts to hide even that there is a Dust session going on, and what the public and private keys of the recipients are. No such luck — still, it looks very interesting. [1] http://freehaven.net/anonbib/cache/wileydust.pdf

What's interesting about Noise?

Re: WhatsApp's Signal Protocol integration is now complete

#76

Post by humanrebar » Tue, Apr 05, 2016, 5:16 PM UTC

mike_hearn wrote: post #27

humanrebar wrote: post #24

Earlier quoted context omitted.

> What's the next step? Is there any work on encrypting group chat sessions?

Please read the articles. It already says that those are encrypted, as well as voice calls. Apparently once everyone is upgraded, nothing will be unencrypted. Their white paper also describes the protocols used in quite a lot of detail.

I was asking because I have a notification today in one of my chats saying that e2ee was enabled. I didn't see the same notification in any group chats. Outside of that notification, it's not clear to me when things are encrypted.

Maybe the next step is a more obvious indicator.

Re: WhatsApp's Signal Protocol integration is now complete

#77

Post by pfg » Tue, Apr 05, 2016, 5:16 PM UTC

cft wrote: post #50

Looks like they feel threatened by Telegram growth, which means Telegram is doing quite well.

Telegram doesn't do end-to-end crypto by default, and uses home-baked crypto which has many weaknesses[1]. I like it as a platform (for their Bot API, Channels and Groups), but I don't like their security mentality.

[1]: https://eprint.iacr.org/2015/1177.pdf

Re: WhatsApp's Signal Protocol integration is now complete

#78

Post by kmch » Tue, Apr 05, 2016, 5:17 PM UTC

jamesdwilson wrote: post #44

mike_hearn wrote: post #27

Earlier quoted context omitted.

Please read the articles. It already says that those are encrypted, as well as voice calls. Apparently once everyone is upgraded, nothing will be unencrypted. Their white paper also describes the protocols used in quite a lot of detail.

no proof without open source

You could inspect the packets yourself to see that they are encrypted.

Re: WhatsApp's Signal Protocol integration is now complete

#79

Post by zxexz » Tue, Apr 05, 2016, 5:17 PM UTC

jamesdwilson wrote: post #51

absolutely no proof it is e2e encrypted without the source.

That's not necessarily true. I haven't spent much time analyzing it yet, but your assertion seems seems. Please correct me if I'm mistaken, but can't you verify end-to-end encryption without viewing the source of the program?

They're using the Signal protocol, which has been well-vetted.

What I've seen so far in Wireshark looks good, but I am not a crypto expert. I'm in the process of reading and trying to understand the whitepaper[0] now.

I doubt OpenWhisperSystems would condone the use of WhatsApp without verifying the app uses e2e.

[0] https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...

EDIT: Spelling.

Re: WhatsApp's Signal Protocol integration is now complete

#80

Post by jamesdwilson » Tue, Apr 05, 2016, 5:18 PM UTC

zxexz wrote: post #79

jamesdwilson wrote: post #51

absolutely no proof it is e2e encrypted without the source.

That's not necessarily true. I haven't spent much time analyzing it yet, but your assertion seems seems. Please correct me if I'm mistaken, but can't you verify end-to-end encryption without viewing the source of the program? They're using the Signal protocol, which has been well-vetted. What I've seen so far in Wireshark looks good, but I am not a crypto expert. I'm in the process of reading and trying to understand…

without the source, it is not verifiable. it could be making a copy and sending it in an encrypted side-channel for example to their overlords.