Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp's Signal Protocol integration is now complete

whispersystems.org

Post reply on HN
Print view View original

371–380 of 386 posts

Re: WhatsApp's Signal Protocol integration is now complete

#371

Post by MrMullen »

nahumba wrote: post #311
MrMullen wrote: post #156

Earlier quoted context omitted.

Don't forget that Telegram uses custom in house encryption and they say "trust us", it's good. Telegram encryption can't be verified.

The custom in house encryption is a protocol that if tou have the skill to break, go collect 200,000$ in bitcoins https://telegram.org/crypto_contest

> Telegram backer, Pavel Durov, will give $200,000 in BTC to the first person to break Telegram' encrypted protocol. Starting today, each day Paul (+79112317383) will be sending a message containing a secret email address to Nick (+79218944725). In order to prove that Telegram crypto was indeed deciphered and claim your prize, send an email to the secret email address from Paul’s message.

That is a fairly ridiculous challenge. Your average crypto professional is not going to have access to the communications channels between the two phones. The NSA or CIA or other government group might, but not really anyone else. Putting this up as a challenge is just silly.

Re: WhatsApp's Signal Protocol integration is now complete

#372

Post by seivan »

david-given wrote: post #340
garrettr_ wrote: post #254

Earlier quoted context omitted.

I always liked "Axolotol" because axolotols are a type of salamander with the amazing ability to regenerate parts of their bodies (including their brains!), and the Axolotol protocol, like OTR, is "self-healing", meaning it's capable of recovering from a compromised session key ( https://whispersystems.org/blog/advanced-ratcheting/ ).

Axolotls are also cool because they're not really a species in their own right --- they're actually just the juvenile form of a salamander. But they can breed while in their juvenile form! It's as if tadpoles could lay eggs without having to turn into frogs first. In fact, axolotls only metamorphose into salamanders if triggered by the external environment. If you don't stimulate them in the right way, they stay axol…

Basically like a Pokemon.

Re: WhatsApp's Signal Protocol integration is now complete

#373

Post by smarinov »

ekiru wrote: post #307
derefr wrote: post #274

Earlier quoted context omitted.

Ah, sorry, yes, I meant the verbs. Originally I was going to make a comparison to nouns—nouns in Lojban, which have a -j suffix.

I'm confused and am not sure if you're thinking of something else or if I'm quite misinformed about Lojban. I don't think lojban has suffixes at all (prefixes, on the other hand). For -j specifically, the only words in lojban which are permitted to end in j are names, but there it's not obligatory. Names are required to end in a consonant, but there are at least a few that are more common than j, I think.

FWIW `-j` is the plural suffix for all nouns and adjectives in Esperanto (not in accusative where the full generic form followed by an additional `-n`), but I don't know whether the OP had that in mind or something completely different.

Re: WhatsApp's Signal Protocol integration is now complete

#374

Post by teaneedz »

dave2000 wrote: post #365
teaneedz wrote: post #300

How is the WhatsApp contact list data handled? Is it completely encrypted too or does Facebook have access to it?

Isn't the contact list how whatsapp knows how to encrypt messages and who to send them too?

Yes, but Wickr keeps it encrypted - salted

Re: WhatsApp's Signal Protocol integration is now complete

#375

Post by CiPHPerCoder »

janinge wrote: post #358
CiPHPerCoder wrote: post #232

Earlier quoted context omitted.

No, they still use MTProto and not an AEAD construction.

I was referring to the padding attack. Did they patch this? And are there any property of MTProto that makes it infeasible to replace AES IGE in a later revision of the protocol?

The problem isn't IGE. It's that they're using SHA1 (not HMAC-SHA1) in a "MAC and Encrypt" construction.

Re: WhatsApp's Signal Protocol integration is now complete

#376

Post by colordrops »

Mafana0 wrote: post #314
colordrops wrote: post #308

Earlier quoted context omitted.

A white paper is not an implementation. Whatsapp is owned by Facebook and required to increase their bottom line. They are not a charity.

Assuming Facebook is lying isn't a very good technical argument. There are other ways for them to make profit than doing the shady things you are implicitly accusing them of doing without any base.

They spent billions on WhatsApp. I'm open to suggestions - how would they profit on it if all the data that passed through it was opaque to them? Perhaps they are just catering to a recent strong interest by the public in encryption.

Re: WhatsApp's Signal Protocol integration is now complete

#378

Post by atomic77 »

lauritz wrote: post #229

Okay, first off: This is great. The most popular messaging app finally gets the security it needed. And we've just rolled out E2E to 1b 'monthly active users'. However, I have always wondered one thing about WhatsApp: How does it generate any kind of meaningful revenue? Apparently they've ditched the old $1 subscription model [0], and even that was so loosely enforced that I have never paid a single cent for WhatsApp…

You raise some interesting points.

FB shelled out $15B for Whatsapp, and clearly the contents of these messages was a major factor in that valuation, especially once the subscription fee was phased out.

Now they're voluntarily encrypting. The only explanation I can come up with is that they are realizing that they will not be able to keep the contents of these messages for themselves in the face of motivated nation-state actors, and so they're killing that golden goose rather than share it. This seems pretty extreme and makes me wonder what is really going on behind the scenes.

My assumption is that there is a contingency to monetize metadata (something I'm not seeing discussed here too much) but I can't help but wonder if FB is now looking at the $15B as a huge overpayment.

Re: WhatsApp's Signal Protocol integration is now complete

#379

Post by nxzero »

nickik wrote: post #212
dest wrote: post #180

Earlier quoted context omitted.

As long as the clients are open-source and the encryption is end to end, can't it really be verified? Whatever the server, if the client encryption is reliable, data can't be read on the server side.

Its still their own crypto. Even if you have the code, their could be a mathematical weakness that is unknwon to anybody outside the company. The protocol has not been studied a lot.

Has anyone offer to fund an audit of the code/crypto/workflow? If not, it'd be nice Moxie would spec out a public request for funds via some sort of crowdfunding and means to post public offers to audit the code based on the funds raised.

Re: WhatsApp's Signal Protocol integration is now complete

#380

Post by ComodoHacker »

wglb wrote: post #347
ComodoHacker wrote: post #186

Earlier quoted context omitted.

Could you share some links about Snowden & Cryptocat story you mentioned above?

Here is one reference: https://en.wikipedia.org/wiki/Cryptocat . Additional googling will show more.

Well I asked because googling showed me very little. Basically Greenwald and Snowden used Cryptocat during some online interview.
Post reply on HN