Live data from Hacker News

WhatsApp backdoor allows snooping on encrypted messages

theguardian.com

1–10 of 334 posts

Re: WhatsApp backdoor allows snooping on encrypted messages

#2
The key part is this, and it was apparently reported back in April 2016 with Facebook replying it's "expected behavior", it's not something a general attacker can do but it would enable WhatsApp/Facebook to read conversations:

> WhatsApp has the ability to force the generation of new encryption keys for offline users, unbeknown to the sender and recipient of the messages, and to make the sender re-encrypt messages with new keys and send them again for any messages that have not been marked as delivered.

It's worth noting as the article says, that this is built on top of the Signal protocol. In Signal, a similar situation with a user changing key offline will result in failure of delivery. Within WhatsApp under Settings>Account>Security there is an option to Show Security Notifications which will notify you if a users key has changed.

Re: WhatsApp backdoor allows snooping on encrypted messages

#4
"Asked to comment specifically on whether Facebook/WhatApp had accessed users’ messages and whether it had done so at the request of government agencies or other third parties, it directed the Guardian to its site that details aggregate data on government requests by country."

This is why people should try and use Signal instead of WhatsApp. You can't trust Facebook to care about your privacy.

Re: WhatsApp backdoor allows snooping on encrypted messages

#8
post #4

"Asked to comment specifically on whether Facebook/WhatApp had accessed users’ messages and whether it had done so at the request of government agencies or other third parties, it directed the Guardian to its site that details aggregate data on government requests by country." This is why people should try and use Signal instead of WhatsApp. You can't trust Facebook to care about your privacy.

Signal is bad as explained previously, it requires Google on your phone to even work.

If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever.

We cant have nice good encryption and safe communication when geeks push this Signal onto unsuspecting users, when the real option is to keep improving Tox.Chat and bitmessage.

Re: WhatsApp backdoor allows snooping on encrypted messages

#9
post #7

But if whatsapp owns the code, they don't need a backdoor. They can simply push an update that sends a copy of the msg to whatever server they may like.

Which is the case with Signal as well, and this "security" feature of "google play services" is why the developer of Sigal does not want Signal to be in f-droid.org's repositories. He wants to be able to push "updates" for any future "vulnerability" onto the users of Signal.
Post reply on HN