Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp Blocking Encrypted Calls to All Saudi Numbers

gist.github.com

Post reply on HN
Print view View original

41–50 of 86 posts

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#41

Post by eridius »

dogma1138 wrote: post #36
eridius wrote: post #14

Earlier quoted context omitted.

The gist explicitly claims that's not possible. Specifically, it claims that there's no way for the Saudi teleco to distinguish encrypted phone calls from encrypted messages, and since you can send encrypted messages to Saudi users, there's no technical reason why you can't also call them. The implication is that if WhatsApp did allow the calls, the Saudi telecos might block both calls and messages (since they can't…

There are plenty of DPI/TM solutions that identify and classify the protocol very quickly and efficiently, every ISP today does it. It's highly unlikely that a Saudi or any modern telco would would not be able to analyse the traffic and extrapolate the exact protocol and application from it as well as other information such as if it's an encrypted stream or not (heck testing if data is encrypted or not is as simple a…

This would work for a call in-progress. The gist explicitly claims the calls are blocked during the handshake, which would be before there's enough data to analyze. It appears from other comments that what's really going on is calls simply use a different port and that port is blocked.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#42

Post by Canada »

eridius wrote: post #40
Canada wrote: post #38

Earlier quoted context omitted.

Assuming WhatsApp uses ZRTP, it's possible to detect and block encrypted calls no matter what port is used because the ZRTP advertisement can be seen in the RTP packet. In order to know when ZRTP will fail WhatsApp would need to maintain lists of address space where ISPs drop such packets. It would have to be done on the client side, but then clients can't easily discover their public address because NAT. The signali…

According to Wikipedia, ZRTP use a specific encryption protocol (SRTP). Surely that means that calls made using Signal can't be using ZRTP.

ZRTP is a key agreement protocol. It sets the key for SRTP, which is ultimately responsible for securing the RTP payload. SRTP keys can also be set by the signaling server, but then the encryption is not end to end. There's another protocol called SDP to handle this

Signal does use ZRTP. It just doesn't use SIP. ZRTP is currently the best choice for voice.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#44

Post by littletimmy »

EdSharkey wrote: post #11

Thank you, WhatsApp! Oppressive governments, especially ones that have lots of resources to torment their citizens, should not get to play with our toys.

Saudi Arabia is one of the main US allies in the region. Millions of tax dollars go towards securing the Saudi regime every year through American military bases in the country.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#46

Post by iamdave »

DominikR wrote: post #39
eridius wrote: post #32

Earlier quoted context omitted.

Detecting calls like that would be for detecting calls in-progress, not for shutting them down during the initial handshake, which is what the gist claims is WhatsApp's explanation.

My point was that this is one way to detect the IP where the client connects to for calls as call signalling, call media transfer and chat messaging all connect to different IP's. Once you have that you can block media transfer, or if the clients use peer to peer media transfer at least block the call signalling. After this it is only a matter of keeping the list of IP's updated which you could easily do by ongoing l…

After this it is only a matter of keeping the list of IP's updated which you could easily do by ongoing logging of bandwidth used.

Erm, well...I suppose this could be done if you're fond of the "navigating through the digestive terminus to arrive at the synovial hinge" method[1]. There are several much easier and much less lossy ways of blocking voice transmissions streams that doesn't involve continuous and arduous logging of IP addresses or even blocks of IP addresses.

---

[1] also known as "going through your ass to get to your elbow"

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#47

Post by DominikR »

iamdave wrote: post #46
DominikR wrote: post #39

Earlier quoted context omitted.

My point was that this is one way to detect the IP where the client connects to for calls as call signalling, call media transfer and chat messaging all connect to different IP's. Once you have that you can block media transfer, or if the clients use peer to peer media transfer at least block the call signalling. After this it is only a matter of keeping the list of IP's updated which you could easily do by ongoing l…

After this it is only a matter of keeping the list of IP's updated which you could easily do by ongoing logging of bandwidth used. Erm, well...I suppose this could be done if you're fond of the "navigating through the digestive terminus to arrive at the synovial hinge" method[1]. There are several much easier and much less lossy ways of blocking voice transmissions streams that doesn't involve continuous and arduous…

I wrote myself that there are surely more advanced ways to do that but I'm not a professional in this particular area as I'm not in the business of censoring people or blocking communication.

Still my point remains valid I believe: The OP claimed with certainty that no one could know if a call is being made which is wrong.

But you can outline your ideas on how to detect a call attempt without "going through your ass to get to your elbow" as you put it.

I still feel that blocking IP's or ports is an easy solution for governments that feel the need to censor.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#48

Post by tptacek »

eridius wrote: post #41
dogma1138 wrote: post #36

Earlier quoted context omitted.

There are plenty of DPI/TM solutions that identify and classify the protocol very quickly and efficiently, every ISP today does it. It's highly unlikely that a Saudi or any modern telco would would not be able to analyse the traffic and extrapolate the exact protocol and application from it as well as other information such as if it's an encrypted stream or not (heck testing if data is encrypted or not is as simple a…

This would work for a call in-progress. The gist explicitly claims the calls are blocked during the handshake, which would be before there's enough data to analyze. It appears from other comments that what's really going on is calls simply use a different port and that port is blocked.

The root comment on this thread resolves that distinction: it might make sense from a UX perspective to block calls that are known in advance not to be workable. WhatsApp can sensibly be reacting to something that occurs once a session is in steady state.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#49

Post by dreamfactory2 »

captainmuon wrote: post #24
united893 wrote: post #3

They're simply providing a better user experience. The Saudis blocked encrypted calls, and users would have wait staring at frustrating repeated timeouts and long 'connecting' hangs. Therefore Whatsapp simply said OK, let's just improve the users experience by giving them an immediate error informing them.

Couldn't someone with WhatsApp/Facebook's resources find a way around the blockage? Write a bunch of different protocols and switch randomly - or use steganography - use machine learning to evade the block - buy a bunch of existing apps and hide the data in their protocols - put up a fake weak encryption, detect "dissident" talk, and in that case generate a long nonsense recording for the censors from the voices of t…

Governments and companies are very much on the same team these days (think of it as a one party state with occasional internal disagreements and manouverings) - so there won't be anything 'mischievous' going on from those quarters

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#50

Post by moxie »

eridius wrote: post #14
united893 wrote: post #3

They're simply providing a better user experience. The Saudis blocked encrypted calls, and users would have wait staring at frustrating repeated timeouts and long 'connecting' hangs. Therefore Whatsapp simply said OK, let's just improve the users experience by giving them an immediate error informing them.

The gist explicitly claims that's not possible. Specifically, it claims that there's no way for the Saudi teleco to distinguish encrypted phone calls from encrypted messages, and since you can send encrypted messages to Saudi users, there's no technical reason why you can't also call them. The implication is that if WhatsApp did allow the calls, the Saudi telecos might block both calls and messages (since they can't…

The author is incorrect. While Signal Protocol is used to communicate an SRTP master secret and a session id, the clients still need to do an ICE handshake in order to establish communication with each other before the responder can even ring. It is very straightforward for SA to block that traffic, and it is established fact that they do.

It seems as if WhatsApp is short circuiting this frustrating series of timeouts to improve a flaky seeming UX. That strategy does negatively effect people on the internet who register for WhatsApp with Saudi VoIP numbers when they're in France, but it is a much clearer UX for almost everyone who is actually a Saudi WhatsApp user or calling actual Saudi users. What the author is demanding is a worse UX for the same outcome.

It sounds like there might be room for improvement, but I have a feeling that if WhatsApp were recording their users' locations in order to provide a more advanced location-aware version of the same strategy, people would not be very happy about that.

Post reply on HN