Flagged for misleading headline; if keys are verified WhatsApp is secure against this attack. If you don't have out of band comms or a pre-shared key, mitm attacks are provably impossible to prevent.
WhatsApp encryption is useless
11–20 of 23 posts
Re: WhatsApp encryption is useless
#12Why are crypto geeks always so black and white? Is there really only "perfect" or "useless" with nothing in-between? Notably, a noted goal of WhatsApp encryption was to stop mass surveillance. I'm no expert but I dont see how these objections make mass surveillance of messages remotely as easy as it was when WhatsApp was entirely unencrypted
This is a great example of security nihilism. "This tool can't protect against every possible attack from every possible adversary, therefore it is useless."
Building safe, secure products at scale for real populations is a process of balancing multiple equities and addressing the most pressing and realistic threat scenarios. This always means building security protections that have theoretical failure modes. The real art is in trying to make those failures as graceful as possible while educating your huge, diverse set of users on the security properties of the product and in what situations they can rely upon it.
Doing this well is still something the entire industry needs to work on, but giving it a shot and building practical protections for real people is always a better option than throwing up your hands and giving up.
Re: WhatsApp encryption is useless
#13Why are crypto geeks always so black and white? Is there really only "perfect" or "useless" with nothing in-between? Notably, a noted goal of WhatsApp encryption was to stop mass surveillance. I'm no expert but I dont see how these objections make mass surveillance of messages remotely as easy as it was when WhatsApp was entirely unencrypted
> Is there really only "perfect" or "useless" with nothing in-between?
Are you suggesting that the ability to completely circumvent a system doesn't make that system broken?
If the goal of WhatsApp encryption is to protect against surveillance, and there's a way to surveil users using WhatsApp, then it's broken, full stop. Are you going to place your trust in a home security system that works pretty well, but only against unskilled burglars? Or what about an authentication system to a server holding sensitive customer information? Or your banking information? Or information that might put your life at risk as a dissident in a repressive state?
Re: WhatsApp encryption is useless
#14Can we have weekly whining threads about WhatsApp now? Just make it like an automated thing; maybe a sticky!
Re: WhatsApp encryption is useless
#15Why are crypto geeks always so black and white? Is there really only "perfect" or "useless" with nothing in-between? Notably, a noted goal of WhatsApp encryption was to stop mass surveillance. I'm no expert but I dont see how these objections make mass surveillance of messages remotely as easy as it was when WhatsApp was entirely unencrypted
This is a great example of security nihilism. "This tool can't protect against every possible attack from every possible adversary, therefore it is useless." Building safe, secure products at scale for real populations is a process of balancing multiple equities and addressing the most pressing and realistic threat scenarios. This always means building security protections that have theoretical failure modes. The rea…
I agree. Every encryption can be cracked given either infinite resources or time. The goal of encryption is to make it (much) harder to eavesdrop on communications, often to a point that it's not feasible to do so anymore. Even if SS7 can be exploited in such a way that actually breaks encryption, it adds layers and layers of complexity that makes large scale spying hard or nearly impossible. These kind of attacks require individual approach, which is harder than, for example, logging all plaintext traffic.
Re: WhatsApp encryption is useless
#16Why are crypto geeks always so black and white? Is there really only "perfect" or "useless" with nothing in-between? Notably, a noted goal of WhatsApp encryption was to stop mass surveillance. I'm no expert but I dont see how these objections make mass surveillance of messages remotely as easy as it was when WhatsApp was entirely unencrypted
They tend to be black and white b/c, unlike most other areas of engineering, a flaw of any severity in a crypto system can lead to its total compromise. Those systems are also subject to active opposition, and breaches tend to be both catastrophic and not known till after the damage is done.
By way of comparison, when Boeing builds a jumbo jet, its "threat model" is gravity and drag and other laws of nature, and if the in-flight entertainment system breaks they don't have to worry about the plane falling out of the sky.
Also compare to the "move fast, break things" web/app dev community for even more stark contrast.
Those differences tend to lead to crypto folks being more black and white on average.
Re: WhatsApp encryption is useless
#17Why are crypto geeks always so black and white? Is there really only "perfect" or "useless" with nothing in-between? Notably, a noted goal of WhatsApp encryption was to stop mass surveillance. I'm no expert but I dont see how these objections make mass surveillance of messages remotely as easy as it was when WhatsApp was entirely unencrypted
> Is there really only "perfect" or "useless" with nothing in-between? Are you suggesting that the ability to completely circumvent a system doesn't make that system broken? If the goal of WhatsApp encryption is to protect against surveillance, and there's a way to surveil users using WhatsApp, then it's broken, full stop. Are you going to place your trust in a home security system that works pretty well, but only ag…
> Are you suggesting that the ability to completely circumvent a system doesn't make that system broken?
A system can be broken without being useless.
>If the goal of WhatsApp encryption is to protect against surveillance
You skipped an import word from the post you replied to: "mass". Even with a hole in SS7, it makes it impractical to collect messages from everyone, even if it's practical to collect messages from specific targets.
Re: WhatsApp encryption is useless
#18Why are crypto geeks always so black and white? Is there really only "perfect" or "useless" with nothing in-between? Notably, a noted goal of WhatsApp encryption was to stop mass surveillance. I'm no expert but I dont see how these objections make mass surveillance of messages remotely as easy as it was when WhatsApp was entirely unencrypted
> Is there really only "perfect" or "useless" with nothing in-between? Are you suggesting that the ability to completely circumvent a system doesn't make that system broken? If the goal of WhatsApp encryption is to protect against surveillance, and there's a way to surveil users using WhatsApp, then it's broken, full stop. Are you going to place your trust in a home security system that works pretty well, but only ag…
Yes, to all your questions except the last one. That's the whole point. If I intend to overthrow president Trump, I won't use WhatsApp. Most other purposes, seems pretty fine now.
Re: WhatsApp encryption is useless
#19Earlier quoted context omitted.
> Is there really only "perfect" or "useless" with nothing in-between? Are you suggesting that the ability to completely circumvent a system doesn't make that system broken? If the goal of WhatsApp encryption is to protect against surveillance, and there's a way to surveil users using WhatsApp, then it's broken, full stop. Are you going to place your trust in a home security system that works pretty well, but only ag…
> Are you suggesting that the ability to completely circumvent a system doesn't make that system broken? A system can be broken without being useless. >If the goal of WhatsApp encryption is to protect against surveillance You skipped an import word from the post you replied to: "mass". Even with a hole in SS7, it makes it impractical to collect messages from everyone, even if it's practical to collect messages from s…
> A system can be broken without being useless.
Sure, just as a completely insecure system can be useful. I'm not arguing that.
But not useful for the purpose of protecting users against surveillance.
> You skipped an import word from the post you replied to: "mass".
skrebbel made a blanket statement, which I was replying to.
Re: WhatsApp encryption is useless
#20Why are crypto geeks always so black and white? Is there really only "perfect" or "useless" with nothing in-between? Notably, a noted goal of WhatsApp encryption was to stop mass surveillance. I'm no expert but I dont see how these objections make mass surveillance of messages remotely as easy as it was when WhatsApp was entirely unencrypted
> Is there really only "perfect" or "useless" with nothing in-between? Are you suggesting that the ability to completely circumvent a system doesn't make that system broken? If the goal of WhatsApp encryption is to protect against surveillance, and there's a way to surveil users using WhatsApp, then it's broken, full stop. Are you going to place your trust in a home security system that works pretty well, but only ag…
[deleted]