Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Viber adds end-to-end encryption

techcrunch.com

Post reply on HN
Print view View original

91–100 of 114 posts

Re: Viber adds end-to-end encryption

#91

Post by ascorbic »

ecesena wrote: post #71
dchest wrote: post #59

Earlier quoted context omitted.

It's not TLS.

Ugh. Should we be scared then?

TLS would normally be used between the client and server. Viber may use TLS for that too, though WhatsApp and Signal use Noise pipes for that purpose. The point of end to end encryption is that they're also encrypting the messages so that they can't be read on the server. Don't know what Viber is using, but moxie posted a link to the details about WhatsApp's implementation. https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...

Re: Viber adds end-to-end encryption

#92

Post by moxie »

danjoc wrote: post #84
tptacek wrote: post #58

Earlier quoted context omitted.

WhatsApp's "E2E" code is from Signal, which is open source. This zealous belief that all secure cryptography must be open source is something I hear a lot from open source advocates, but not so much from cryptography engineers.

You keep saying this, but how do we know they are actually using the code from Signal without access to source and reproducible builds? Last time you told me it was easy and legal to reverse engineer the code. I then asked you what tools you use to do that and you ignored the question.

If you want to look at the Android APK, you can use apktool to get back Java source. Hacked clients like WhatsApp+ even build new derivative products using that output, and spammers do it to get code they can use to inject messages onto the network without having to write their own software.

I think it's great when people further verify WhatsApp's client security, please share your analysis!

Re: Viber adds end-to-end encryption

#93

Post by CiPHPerCoder »

ecesena wrote: post #71
dchest wrote: post #59

Earlier quoted context omitted.

It's not TLS.

Ugh. Should we be scared then?

TLS is Transport Layer Security.

When we're talking about End-to-End Encryption, we usually mean:

    * Application Layer Security (between users)
    * Transport Layer Security (between each user and the server)
And here, Security should mean public key authenticated encryption (e.g. crypto_box() from NaCl)

Re: Viber adds end-to-end encryption

#95

Post by russell_h »

AJ007 wrote: post #78
tptacek wrote: post #58

Earlier quoted context omitted.

WhatsApp's "E2E" code is from Signal, which is open source. This zealous belief that all secure cryptography must be open source is something I hear a lot from open source advocates, but not so much from cryptography engineers.

The value is not just the public display of the source code for auditing, but the validation that what you are running was indeed compiled from that code.

Simply open sourcing the code doesn't give that validation.

Re: Viber adds end-to-end encryption

#96

Post by giancarlostoro »

I always enjoyed using Viber, but I never liked that it featured no encryption. It is an alternative for Skype for me, I could video call from my phone, laptop, tablet, etc and do audio calls. Skype became insecure, it leaks your IP address and it's got terrible synchronization issues, and now chatting is really buggy, messages show up in the wrong place for me, as well as the Linux client for it sucks. Viber has a good all around client for every OS I've used it in (including Linux).

This is fantastic news, as others have said, maybe they should really open source the portions of code that have to deal with E2E encryption so it may be audited.

Re: Viber adds end-to-end encryption

#97

Post by nialo »

tptacek wrote: post #90
danjoc wrote: post #84

Earlier quoted context omitted.

You keep saying this, but how do we know they are actually using the code from Signal without access to source and reproducible builds? Last time you told me it was easy and legal to reverse engineer the code. I then asked you what tools you use to do that and you ignored the question.

To reverse engineer code? For big projects, I used IDA, like everyone else does. For smaller projects, I used Hopper, or, for architectures that IDA and Hopper didn't support, I'd postprocess binutils output. For an example of a more sophisticated approach, look at: https://sourcedna.com/ Remember, in this case, it's especially easy to reverse, because you have the source code ; all you're doing is matching the contr…

Do you know if there exist tools that take a binary and a source code file and attempt to automatically compare the control flow graphs?

I imagine I won't ever get to it, but that sounds like an interesting problem to try to work on.

Re: Viber adds end-to-end encryption

#98

Post by tptacek »

nialo wrote: post #97
tptacek wrote: post #90

Earlier quoted context omitted.

To reverse engineer code? For big projects, I used IDA, like everyone else does. For smaller projects, I used Hopper, or, for architectures that IDA and Hopper didn't support, I'd postprocess binutils output. For an example of a more sophisticated approach, look at: https://sourcedna.com/ Remember, in this case, it's especially easy to reverse, because you have the source code ; all you're doing is matching the contr…

Do you know if there exist tools that take a binary and a source code file and attempt to automatically compare the control flow graphs? I imagine I won't ever get to it, but that sounds like an interesting problem to try to work on.

Yes, there are. SourceDNA does a bunch of this.

Re: Viber adds end-to-end encryption

#99

Post by skrowl »

giancarlostoro wrote: post #96

I always enjoyed using Viber, but I never liked that it featured no encryption. It is an alternative for Skype for me, I could video call from my phone, laptop, tablet, etc and do audio calls. Skype became insecure, it leaks your IP address and it's got terrible synchronization issues, and now chatting is really buggy, messages show up in the wrong place for me, as well as the Linux client for it sucks. Viber has a g…

Skype stopped leaking your IP address earlier this year. It existed before that, but is now the default behavior. http://blogs.skype.com/2016/01/21/to-our-gamers-ip-will-now-...
Post reply on HN