Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Viber adds end-to-end encryption

techcrunch.com

Post reply on HN
Print view View original

81–90 of 114 posts

Re: Viber adds end-to-end encryption

#81

Post by lotso »

ikeboy wrote: post #73
lotso wrote: post #70

Earlier quoted context omitted.

I think this is a valuable feature for users of the product. Some users like this feature. If you don't, just use another product. Not everything needs to be a philosophical debate.

I don't think the feature is well known. What percent of Viber users could tell you that messages can be deleted without their consent?

I think that's irrelevant. It's part of the product, is an intentional feature that has value, and is not even an uncommon feature (exists on Instagram DMs.

Re: Viber adds end-to-end encryption

#82

Post by ryanlol »

ikeboy wrote: post #69
CiPHPerCoder wrote: post #51

Earlier quoted context omitted.

> I don't think I get your complaint > Without open-sourcing the crypto, they could be just doing rot16($message) for all we know. There are two things you can do: 1. Watch the outbound traffic and attempt known-plaintext attacks 2. Reverse engineer the app Neither is particularly difficult. Most Android apps are trivial to break apart using Lobotomy. A large swath of software security folks specialize in binary audi…

Has anyone done that and produced a fully open source app to connect to whatsapp?

Lots of people.

https://github.com/tgalal/yowsup for example

Re: Viber adds end-to-end encryption

#83

Post by ianmiers »

CiPHPerCoder wrote: post #56
goodplay wrote: post #54

Earlier quoted context omitted.

Is it cryptographicly broken or not? Can I read the plain text of the traffic I capture?

https://tonyarcieri.com/all-the-crypto-code-youve-ever-writt... The word "broken" means susceptible to practical attack, and attacks aren't always of the "cryptanalyze the ciphertext and read the plaintext because you're a clever mathematician" variety. For example: Padding Oracle Attacks. This is the most accessible explanation on-hand: https://twitter.com/SoatokDhole/status/720435675401744385 A padding oracle attac…

To add, Telegram's crypto is completely and totally off the walls crazy in terms of design. Add to that the fact that there are cryptographic breaks (though not we can read your ciphertext breaks), and you should be careful.

iMessage would have been reasonably secure had they used AEC-GCM or a MAC. The design at least made sense: compose a scheme out of known primitives. They just missed (very important) details. Telegram is just turtles all the way down.

Re: Viber adds end-to-end encryption

#84

Post by danjoc »

tptacek wrote: post #58
nxzero wrote: post #7

End-to-end (E2E) code needs to be open source and venders that don't agree to an audit should be considered insecure; holds true for What's App, which declined to allow their E2E code to be audited. Also, message metadata is still being leaked by all of these E2E implementations and needs to be fixed.

WhatsApp's "E2E" code is from Signal, which is open source. This zealous belief that all secure cryptography must be open source is something I hear a lot from open source advocates, but not so much from cryptography engineers.

You keep saying this, but how do we know they are actually using the code from Signal without access to source and reproducible builds? Last time you told me it was easy and legal to reverse engineer the code. I then asked you what tools you use to do that and you ignored the question.

Re: Viber adds end-to-end encryption

#85

Post by ikeboy »

losvedir wrote: post #80
ikeboy wrote: post #12

>The enhanced delete feature, meanwhile, has been in the app for a while, but is part of the company’s is a way for users to wipe a conversation not just on their end, but on that of the recipient’s phone. You can think of this as Viber’s answer to ephemeral messaging, but with a more manual approach. Does anyone else think this is a violation of users' rights? If I've been sent a message, it shouldn't be possible fo…

> Does anyone else think this is a violation of users' rights? Not at all, and it's kind of strange to me that you do. It's just... how the app works. Slack lets you do it, for example, and I've used it occasionally. Heck, reddit (and I think HN?) let you delete comments, even if they were previously, uh, transmitted to a reader's browser. The Gmail example is irrelevant because that's not how email works. If a new c…

>If a new company / protocol came about which wanted to try their hand at a different way of sending online letters, that let you delete them later then I'd have no problem with that.

I don't think this is a particularly well-advertised feature of Viber.

Neither reddit nor hn are meant to be a means of private comunication. Generally you can't view them offline, and so on. I'm not sure about slack

>that's not how email works

And I think the average user's expectation is that a messaging app will work the same.

By the way, reddit won't let you delete PMs you've sent to another user.

Re: Viber adds end-to-end encryption

#87

Post by nxzero »

venomsnake wrote: post #33
mtgx wrote: post #17

Earlier quoted context omitted.

Would open sourcing the Whatsapp client hurt Whatsapp in any significant way? I mean, sure, there could be "Whatsapp clones" (aren't there already?!), but wouldn't Whatsapp still benefit from the phone number user base it has, thus maintaining a certain lock-in on its users from which it already benefits?

Wireshark,xposed + some creativity and you have your own E2E encrypted solution with OOB keys. For any messenger. It is not done, because there is no demand.

Would it be possible to explain the reasoning of the workflow/toolchain you're suggesting?

Re: Viber adds end-to-end encryption

#88

Post by ikeboy »

ryanlol wrote: post #82
ikeboy wrote: post #69

Earlier quoted context omitted.

Has anyone done that and produced a fully open source app to connect to whatsapp?

Lots of people. https://github.com/tgalal/yowsup for example

Looks like WhatsApp isn't so happy about that ...

https://gigaom.com/2015/01/20/whatsapp-cracks-down-on-people...

Do you know if the clients work with the new encryption?

Re: Viber adds end-to-end encryption

#89

Post by ryanlol »

ikeboy wrote: post #88
ryanlol wrote: post #82

Earlier quoted context omitted.

Lots of people. https://github.com/tgalal/yowsup for example

Looks like WhatsApp isn't so happy about that ... https://gigaom.com/2015/01/20/whatsapp-cracks-down-on-people... Do you know if the clients work with the new encryption?

Yes, axolotl is open source. (However I can't comment on how much it's been modified for the official client)

Re: Viber adds end-to-end encryption

#90

Post by tptacek »

danjoc wrote: post #84
tptacek wrote: post #58

Earlier quoted context omitted.

WhatsApp's "E2E" code is from Signal, which is open source. This zealous belief that all secure cryptography must be open source is something I hear a lot from open source advocates, but not so much from cryptography engineers.

You keep saying this, but how do we know they are actually using the code from Signal without access to source and reproducible builds? Last time you told me it was easy and legal to reverse engineer the code. I then asked you what tools you use to do that and you ignored the question.

To reverse engineer code? For big projects, I used IDA, like everyone else does. For smaller projects, I used Hopper, or, for architectures that IDA and Hopper didn't support, I'd postprocess binutils output.

For an example of a more sophisticated approach, look at:

https://sourcedna.com/

Remember, in this case, it's especially easy to reverse, because you have the source code; all you're doing is matching the control flow graph to the original source.

Post reply on HN