Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Viber adds end-to-end encryption

techcrunch.com

Post reply on HN
Print view View original

101–110 of 114 posts

Re: Viber adds end-to-end encryption

#101

Post by venomsnake »

nxzero wrote: post #87
venomsnake wrote: post #33

Earlier quoted context omitted.

Wireshark,xposed + some creativity and you have your own E2E encrypted solution with OOB keys. For any messenger. It is not done, because there is no demand.

Would it be possible to explain the reasoning of the workflow/toolchain you're suggesting?

wireshark to reverse the protocol. xposed to rewrite the classes required on android.

you replace Whatsapp.sendMessage(string,Jonny) with WhatsApps.sendMessage(EncryptString(string,Jonny),Jonny)

And EncryptString taps into your keystore to find jonny's key.

Re: Viber adds end-to-end encryption

#102

Post by secfirstmd »

I highly recommend following the updates from Frederic Jacobs on his Twitter. He has already found a number of significant flaws with Viber encryption...

"Wow, Viber disables crypto based on geo-location? Export controls related?" https://twitter.com/FredericJacobs/status/722511416381480961

"Viber’s encryption appears to be a custom C++ implementation. Super reassuring they use MD5 for attachments." pic.twitter.com/wi6lB30KjY

https://twitter.com/FredericJacobs/status/722489499779858432

Re: Viber adds end-to-end encryption

#104

Post by AckSyn »

russell_h wrote: post #95
AJ007 wrote: post #78

Earlier quoted context omitted.

The value is not just the public display of the source code for auditing, but the validation that what you are running was indeed compiled from that code.

Simply open sourcing the code doesn't give that validation.

Not completely but I can certainly look at it, compile, and then side-load it onto my device knowing it's what it said it was.

Re: Viber adds end-to-end encryption

#105

Post by brianacton »

AJ007 wrote: post #78
tptacek wrote: post #58

Earlier quoted context omitted.

WhatsApp's "E2E" code is from Signal, which is open source. This zealous belief that all secure cryptography must be open source is something I hear a lot from open source advocates, but not so much from cryptography engineers.

The value is not just the public display of the source code for auditing, but the validation that what you are running was indeed compiled from that code.

This is literally an impossibility. Java apps are typically obfuscated with randomization of symbol names. Each build is unique and not reproducible.

You are better off verifying the actual compiled and distributed apk files than verifying the source.

Re: Viber adds end-to-end encryption

#106

Post by emdd »

andrey_utkin wrote: post #19
mtgx wrote: post #17

Earlier quoted context omitted.

Would open sourcing the Whatsapp client hurt Whatsapp in any significant way? I mean, sure, there could be "Whatsapp clones" (aren't there already?!), but wouldn't Whatsapp still benefit from the phone number user base it has, thus maintaining a certain lock-in on its users from which it already benefits?

> I mean, sure, there could be "Whatsapp clones" (aren't there already?!) Sounds funny if you consider that Whatsapp itself is just a branded deployment of FOSS XMPP server Ejabberd, with feature of federation taken away. Plus a client app implementation, of course.

And, I've been using Viber longer than I knew WhatsApp existed. Just saying...

Re: Viber adds end-to-end encryption

#107

Post by danjoc »

brianacton wrote: post #105
AJ007 wrote: post #78

Earlier quoted context omitted.

The value is not just the public display of the source code for auditing, but the validation that what you are running was indeed compiled from that code.

This is literally an impossibility. Java apps are typically obfuscated with randomization of symbol names. Each build is unique and not reproducible. You are better off verifying the actual compiled and distributed apk files than verifying the source.

It's impossible?

https://whispersystems.org/blog/reproducible-android/

Re: Viber adds end-to-end encryption

#108

Post by danjoc »

tptacek wrote: post #90
danjoc wrote: post #84

Earlier quoted context omitted.

You keep saying this, but how do we know they are actually using the code from Signal without access to source and reproducible builds? Last time you told me it was easy and legal to reverse engineer the code. I then asked you what tools you use to do that and you ignored the question.

To reverse engineer code? For big projects, I used IDA, like everyone else does. For smaller projects, I used Hopper, or, for architectures that IDA and Hopper didn't support, I'd postprocess binutils output. For an example of a more sophisticated approach, look at: https://sourcedna.com/ Remember, in this case, it's especially easy to reverse, because you have the source code ; all you're doing is matching the contr…

Thanks for making this response. Genuinely interested.

[To whomever down voted... I guess I get down voted for not showing gratitude immediately after he posted a reply? This is why I don't post here often. Quite mean people here.]

Re: Viber adds end-to-end encryption

#109

Post by danjoc »

moxie wrote: post #92
danjoc wrote: post #84

Earlier quoted context omitted.

You keep saying this, but how do we know they are actually using the code from Signal without access to source and reproducible builds? Last time you told me it was easy and legal to reverse engineer the code. I then asked you what tools you use to do that and you ignored the question.

If you want to look at the Android APK, you can use apktool to get back Java source. Hacked clients like WhatsApp+ even build new derivative products using that output, and spammers do it to get code they can use to inject messages onto the network without having to write their own software. I think it's great when people further verify WhatsApp's client security, please share your analysis!

Thank you for your tip and contributions to open signal. I appreciate that you want to get encryption into as many hands as possible, even if circumstances may not be ideal.

My primary concern here is a long con. Everything is probably okay now, but after a while, people will stop looking and verifying. With WhatsApp keeping source closed, it makes that period of time shorter, I think. I will try to work your suggestion into my job :) If I'm paid to do it, I can keep doing it indefinitely, even working on tools to automate it.

Re: Viber adds end-to-end encryption

#110

Post by giancarlostoro »

skrowl wrote: post #99
giancarlostoro wrote: post #96

I always enjoyed using Viber, but I never liked that it featured no encryption. It is an alternative for Skype for me, I could video call from my phone, laptop, tablet, etc and do audio calls. Skype became insecure, it leaks your IP address and it's got terrible synchronization issues, and now chatting is really buggy, messages show up in the wrong place for me, as well as the Linux client for it sucks. Viber has a g…

Skype stopped leaking your IP address earlier this year. It existed before that, but is now the default behavior. http://blogs.skype.com/2016/01/21/to-our-gamers-ip-will-now-...

It says "by default" implying it could still be leaked, their "fix" is a Skype setting that masks your IP until you're in a call with somebody.
Post reply on HN