Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp's Signal Protocol integration is now complete

whispersystems.org

Post reply on HN
Print view View original

121–130 of 386 posts

Re: WhatsApp's Signal Protocol integration is now complete

#121

Post by crazy1van »

jamesdwilson wrote: post #66
tptacek wrote: post #61

Earlier quoted context omitted.

Very angry open source advocate, I understand how frustrating it must be that the current safest mainstream messaging protocol is not open source, but once again: that's not how computer software works. WhatsApp isn't even obfuscated. There are tens of thousands of people who read "closed source" software as a hobby . Later : Also? That's not what the term "side channel" means.

do you know even with source, backdoors can be hidden? open source is a must to even begin to work to verify any claims of security.

> open source is a must to even begin to work to verify any claims of security.

I think this is losing sight of what source code actually is. It's the easier to read and easier to edit way to define what a person wants the computer to do. But, it isn't actually the exact instructions the computer executes.

Re: WhatsApp's Signal Protocol integration is now complete

#122

Post by tptacek »

jamesdwilson wrote: post #117
swombat wrote: post #110

Earlier quoted context omitted.

Just in case you don't know, tptacek is a world-class security/cryptography expert who happens to hang around and share his wisdom here. You appear to be assuming he's someone thinking one or more levels lower than you. I think it would be smarter for you to assume that he fully understands your argument but is thinking one or more levels higher than you.

agreed, i had no idea. i am humbled.

What's worse is that I am nowhere close to the best crypto security person on HN, and (unlike me) the best crypto people here don't brag about it.

Re: WhatsApp's Signal Protocol integration is now complete

#123

Post by msh »

StavrosK wrote: post #65
mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

> 12 words seems so much more friendly, at least to English speakers I have a feeling that English speakers are the minority of WhatsApp users. > if you don't speak a common language with your chat partner then the app is useless anyway They do speak a common language, it's usually just not English.

And the language of the clients might not be the same. I might write in English to a German friend, but my whatsapp is localized to Danish and his to Germany.

How would whatsapp know what language to present the words in?

Re: WhatsApp's Signal Protocol integration is now complete

#126

Post by toupeira »

moxie wrote: post #102
robert_foss wrote: post #28

moxie: Does this mean that both Facebook and Signal servers are unable to see the plaintext? (I would assume so, but I would like to have it confirmed. From someone who actually knows what he's talking about.)

Correct. The only people who can read a message (or hear a voice call) are their intended recipients.

Would it be possible for Facebook to introduce a backdoor later without breaking the Signal protocol, or alternatively "forking" it while keeping compatibility between their clients?

Re: WhatsApp's Signal Protocol integration is now complete

#128

Post by ianmiers »

mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

I'm hoping they deploy some from of key transparency. E.g. CONIKS or CONAME, the version Yahoo and Google are working on for e2e that already has a productionish grade sever and client[0]. Either that or give the community a practical reason why it can't be used as is, and then we can start working on alternatives.

[0] https://github.com/yahoo/conam

Re: WhatsApp's Signal Protocol integration is now complete

#129

Post by slasaus »

tptacek wrote: post #87
pilif wrote: post #59

What the article fails to mention: 1) I would assume Facebook still gets unencrypted access to my address book for use with their shadow profiles 2) We have zero control over what key the client encrypts the messages for. Is it only the other peer's phone? Or is it for the peer's phone plus Facebook for analysis of the messages? Especially 2) is of some concern to me (against 1 I can't protect myself anyways because…

I think this is a reasonable analysis. I would refine it this way (examples are only for illustrative purposes): Tier 1 secure messengers: all possible tradeoffs in favor of security made; use for worst-case adversaries: - Signal/TextSecure - Pond - PGP† - OTR Tier 2 secure messengers: serious secure messaging protocols that make some tradeoffs in favor of adoption and usability; use for normal messages of low sensit…

Don't forget Ricochet†, it only does synchronous communication but it does solve the problem of leaking meta-data. All the other clients except Pond leak meta-data.

† https://ricochet.im/

Re: WhatsApp's Signal Protocol integration is now complete

#130

Post by ianmiers »

moxie wrote: post #20
mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

> They seem to have replaced TLS/SSL between client and server with "Noise Pipes". WhatsApp was already using a custom protocol instead of TLS. We worked with them to transition over to Noise Pipes, which has some advantages over what they were doing before. Also, we've renamed Axolotl to Signal Protocol: https://whispersystems.org/blog/signal-inside-and-out/

Is there any documentation on the old custom protocol?
Post reply on HN