Live data from Hacker News

WhatsApp Just Switched on Encryption for a Billion People

wired.com

31–40 of 65 posts

Re: WhatsApp Just Switched on Encryption for a Billion People

#31
post #28

Earlier quoted context omitted.

Why are people downvoting this? While the "public key" is not "WhatsApp's" it is served from their server hence in theory they can provide you with any public key they want, decrypt the message, store it, and re-encrypt it with the "correct" private key and send it off to the user. With PKI the ability of the user to verify that they received and used the correct public key is critical and while I have to admit that…

That's true, but they provide means to verify the fingerprint of the other party, so you can verify that your app is encrypting messages using legitimate public key and that there's no MITM going on.

Yeah but again there are quite a few questions here (not an WA user).

How foolproof is the verification system, how susceptible is it to downgrade attacks (while E2EE isn't not universally deployed) is there are 3d party verification of signatures, is there a community trust signing, can whats app disable E2EE in it's application without a noticeable UX change to either party, how does this work with multi user messages, how does this work with multiple devices, how does this work with historic messages that were encrypted using different keys etc.

I would say that there are sufficient "unknowns" at this point to take the security of this entire solution with some skepticism especially if you remotely planning to use this for anything that could put your life at any risk.

Re: WhatsApp Just Switched on Encryption for a Billion People

#33
post #22

Bravo to moxie, and the WhatsApp guys actually sound really cool. So, assuming you're using WhatsApp Web, does that mean you have end-to-end encryption there too? I recall the web version used your phone somehow.

Apparently it does. I just opened whatsapp web and it greeted me with a message that any messages and calls through it are now encrypted.

Re: WhatsApp Just Switched on Encryption for a Billion People

#35
post #6

Earlier quoted context omitted.

Watch the traffic go by with a packet sniffer? Verifying that it is done securely is a lot harder, but you can at least verify that things are not being sent as plain text/data.

Yeah but that just shows its https.

Can't you MITM yourself fairly easily to decrypt the https and see what's being passed? Assuming you have full control of your device.

Re: WhatsApp Just Switched on Encryption for a Billion People

#37
post #11

The article says: "With end-to-end encryption in place, not even WhatsApp’s employees can read the data that’s sent across its network." But according to the diagram: http://www.wired.com/wp-content/uploads/2016/04/Whatsapp_Enc... ... A's message is encrypted with Whatsapp's public key, which means that Whatsapp's private key can (and has to) decrypt it on the server side to encrypt it in turn with B's public key. If…

Why are people downvoting this? While the "public key" is not "WhatsApp's" it is served from their server hence in theory they can provide you with any public key they want, decrypt the message, store it, and re-encrypt it with the "correct" private key and send it off to the user. With PKI the ability of the user to verify that they received and used the correct public key is critical and while I have to admit that…

I see your concern, but I think the issue they're trying to prevent is authorities coming with a court order wanting to decrypt messages after the fact.

If WhatsApp decides to act malicious, yes, this method would make it very easy for them.

Re: WhatsApp Just Switched on Encryption for a Billion People

#38
post #5

Looks great, but I find it a bit weird that there's no Whatsapp announcement - I also wonder if it'll slow down the ability to have the same whatsapp account on multiple devices.

https://blog.whatsapp.com/10000618/End-to-end-encryption

Re: WhatsApp Just Switched on Encryption for a Billion People

#39
So now WhatsApp is finally on par with iMessage and Signal, and shares the same weakness: public key distribution. Key distribution is controlled by a centralized server that could, for malicious or other reasons, send you new fake keys for people you communicate with. For iMessage, this is explained in this 2015 post by Matthew Green:

http://blog.cryptographyengineering.com/2015/09/lets-talk-ab...

At least with Signal you can compile your own client (though that doesn't help if the server is going to send you fake public keys!).

Re: WhatsApp Just Switched on Encryption for a Billion People

#40
post #39

So now WhatsApp is finally on par with iMessage and Signal, and shares the same weakness: public key distribution. Key distribution is controlled by a centralized server that could, for malicious or other reasons, send you new fake keys for people you communicate with. For iMessage, this is explained in this 2015 post by Matthew Green: http://blog.cryptographyengineering.com/2015/09/lets-talk-ab... At least with Sign…

Is there no UI notifying you that a user's keys have changed in Signal? If so, the central server would need to send compromised keys on day 1, which would be detectable when you check the key signature.
Post reply on HN