Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp Blocking Encrypted Calls to All Saudi Numbers

gist.github.com

Post reply on HN
Print view View original

51–60 of 86 posts

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#51

Post by eridius »

tptacek wrote: post #48
eridius wrote: post #41

Earlier quoted context omitted.

This would work for a call in-progress. The gist explicitly claims the calls are blocked during the handshake, which would be before there's enough data to analyze. It appears from other comments that what's really going on is calls simply use a different port and that port is blocked.

The root comment on this thread resolves that distinction: it might make sense from a UX perspective to block calls that are known in advance not to be workable. WhatsApp can sensibly be reacting to something that occurs once a session is in steady state.

Sure, though I think there's still merit in the OP's request for WhatsApp to detect when a customer with a Saudi number is actually in another country and allow the call to go through (though I don't know how easy it is to detect that).

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#52

Post by s_q_b »

spacefight wrote: post #43

This case is a brilliant reminder to anyone working in deep packet inspection/blocking/filtering tech that your work negatively affects the safety of millions of people in such countries at once.

This case is a brilliant reminder to anyone working in fiber optics that your work negatively affects the safety of millions of people in such countries at once.

But seriously, deep packet inspection is evil now? It's an extremely useful security tool.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#53

Post by moxie »

CiPHPerCoder wrote: post #2

I'd be interested in hearing WhatsApp's response to this. Or moxie's, for that matter. He's been contacted by the Saudi government before and publicly turned down their offers to be complicit in their human rights violations. (He also wrote the encryption that WhatsApp uses.) https://moxie.org/blog/saudi-surveillance/ More importantly, can anyone independently verify this? :)

I have no special insight, but it's a fact that SA drops VoIP traffic. The UX for that is pretty bad, calls fail to connect by timing out after 5min or whatever, and people are left trying over and over again or waiting around hoping the call will connect. I think it could make sense to short circuit that process and display an immediate error to the caller that lets them know this call just isn't going to work.

The author's suggestion that it's impossible for SA to block VoIP without blocking messaging is incorrect.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#54

Post by pmarreck »

subliminalpanda wrote: post #18
eridius wrote: post #14

Earlier quoted context omitted.

The gist explicitly claims that's not possible. Specifically, it claims that there's no way for the Saudi teleco to distinguish encrypted phone calls from encrypted messages, and since you can send encrypted messages to Saudi users, there's no technical reason why you can't also call them. The implication is that if WhatsApp did allow the calls, the Saudi telecos might block both calls and messages (since they can't…

WhatsApp calls are made to a different port; I worked at a teleco in Oman and that's how they blocked the calling feature while keeping messaging alive.

Your telco sucks.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#55

Post by subliminalpanda »

pmarreck wrote: post #54
subliminalpanda wrote: post #18

Earlier quoted context omitted.

WhatsApp calls are made to a different port; I worked at a teleco in Oman and that's how they blocked the calling feature while keeping messaging alive.

Your telco sucks.

The telco doesn't have much of a choice, as the rules are administered by the TRA (telecommunications regulatory authority), and by proxy, state security.

No one that worked there wanted to do it, but refusing to do so would be reason to have them dismissed from their jobs.

Many employees are expats; leaving their jobs would mean a loss of their residence and thus deportation.

Such is life in a police state.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#56

Post by moxie »

eridius wrote: post #31
subliminalpanda wrote: post #27

Earlier quoted context omitted.

I believe you would be correct in your assumption. I asked one of the engineers how they did it and that's what they told me to much chagrin.

Seems like WhatsApp could easily choose to use a different port if they wanted to, but I guess this comes back to not wanting to have their encrypted messages get blocked.

VoIP traffic is UDP, and will always be very easy to identify. We barely have functional circumvention strategies for higher-latency traffic types, so building a circumvention strategy for traffic like realtime voice with ultra low-latency requirements is a tall order. Honestly getting VoIP to work well in the best possible network scenarios is enough of a challenge.

I assume that higher latency communication like WhatsApp's push-to-talk "voice notes" works just fine in SA though.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#57

Post by pmarreck »

subliminalpanda wrote: post #55
pmarreck wrote: post #54

Earlier quoted context omitted.

Your telco sucks.

The telco doesn't have much of a choice, as the rules are administered by the TRA (telecommunications regulatory authority), and by proxy, state security. No one that worked there wanted to do it, but refusing to do so would be reason to have them dismissed from their jobs. Many employees are expats; leaving their jobs would mean a loss of their residence and thus deportation. Such is life in a police state.

I correct myself, then: Your police state sucks.

> but refusing to do so would be reason to have them dismissed from their jobs.

I've quit jobs on principle before. The key is to have a nest egg.

> Many employees are expats; leaving their jobs would mean a loss of their residence and thus deportation.

Could they find another job?

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#58

Post by subliminalpanda »

moxie wrote: post #56
eridius wrote: post #31

Earlier quoted context omitted.

Seems like WhatsApp could easily choose to use a different port if they wanted to, but I guess this comes back to not wanting to have their encrypted messages get blocked.

VoIP traffic is UDP, and will always be very easy to identify. We barely have functional circumvention strategies for higher-latency traffic types, so building a circumvention strategy for traffic like realtime voice with ultra low-latency requirements is a tall order. Honestly getting VoIP to work well in the best possible network scenarios is enough of a challenge. I assume that higher latency communication like Wh…

I can't speak for SA but a lot of folks in Oman would message each other voice messages as a compromise.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#59

Post by subliminalpanda »

pmarreck wrote: post #57
subliminalpanda wrote: post #55

Earlier quoted context omitted.

The telco doesn't have much of a choice, as the rules are administered by the TRA (telecommunications regulatory authority), and by proxy, state security. No one that worked there wanted to do it, but refusing to do so would be reason to have them dismissed from their jobs. Many employees are expats; leaving their jobs would mean a loss of their residence and thus deportation. Such is life in a police state.

I correct myself, then: Your police state sucks. > but refusing to do so would be reason to have them dismissed from their jobs. I've quit jobs on principle before. The key is to have a nest egg. > Many employees are expats; leaving their jobs would mean a loss of their residence and thus deportation. Could they find another job?

> I correct myself, then: Your police state sucks.

Police states are very shitty indeed.

> I've quit jobs on principle before. The key is to have a nest egg.

A lot of the expats come from Lebanon, Syria, Pakistan, India, and occasionally Eastern Europe. Almost all of them that I know have families they need to support (immediate and sending remittances), and the money is a lifeline. Being deported back and/or being blacklisted from the GCC is a life-ruining scenario. Getting visas to the west is not always an option.

>Could they find another job?

It's possible, but all countries in the GCC operate under a Kafala (sponsorship) system. Having it revoked in one GCC member state raises complications in others.

For those wondering, GCC = Gulf Cooperation Council, not the compiler.

(edit for clarity)

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#60

Post by stefs »

moxie wrote: post #50
eridius wrote: post #14

Earlier quoted context omitted.

The gist explicitly claims that's not possible. Specifically, it claims that there's no way for the Saudi teleco to distinguish encrypted phone calls from encrypted messages, and since you can send encrypted messages to Saudi users, there's no technical reason why you can't also call them. The implication is that if WhatsApp did allow the calls, the Saudi telecos might block both calls and messages (since they can't…

The author is incorrect. While Signal Protocol is used to communicate an SRTP master secret and a session id, the clients still need to do an ICE handshake in order to establish communication with each other before the responder can even ring. It is very straightforward for SA to block that traffic, and it is established fact that they do. It seems as if WhatsApp is short circuiting this frustrating series of timeout…

so this does affect foreign users using saudi telcos (roaming/wireless)? how about not blanket-blocking by country code, but by country-ip lookup?
Post reply on HN