Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp backdoor allows snooping on encrypted messages

theguardian.com

Post reply on HN
Print view View original

11–20 of 334 posts

Re: WhatsApp backdoor allows snooping on encrypted messages

#11

Post by retox »

antocv wrote: post #9
cm2187 wrote: post #7

But if whatsapp owns the code, they don't need a backdoor. They can simply push an update that sends a copy of the msg to whatever server they may like.

Which is the case with Signal as well, and this "security" feature of "google play services" is why the developer of Sigal does not want Signal to be in f-droid.org's repositories. He wants to be able to push "updates" for any future "vulnerability" onto the users of Signal.

A big reason I dont trust signal. Every single that app has some bad side, signals is the reliance on Google.

Re: WhatsApp backdoor allows snooping on encrypted messages

#12

Post by pilif »

No matter what IM service you use: As long as they manage the public keys for their users, they will be vulnerable to exactly this problem. This isn't just WhatsApp. This applies to iMessage and Signal too.

In all cases, we rely on the word of the service provider that they don't sneak additional public keys to encrypt for into the clients and in all cases we hear that doing so would cause a message dialog to appear, but we have zero control over that as this is just an additional software functionality (yes. Signal is Open Source, but do you know whether the software you got from the App Store is the software that's on Github?)

Also imagine the confusion and warning-blindness it would cause if every time one of my friends gets a new device I'd get huge warnings telling me that public keys have changed.

This is a hard problem to solve in a user-friendly way and none of the current IM providers really solve it. Maybe Threema does it best with their multiple levels of authenticity.

As such I think it's unfair to just complain about WhatsApp here.

Re: WhatsApp backdoor allows snooping on encrypted messages

#13

Post by padraic7a »

antocv wrote: post #8
agd wrote: post #4

"Asked to comment specifically on whether Facebook/WhatApp had accessed users’ messages and whether it had done so at the request of government agencies or other third parties, it directed the Guardian to its site that details aggregate data on government requests by country." This is why people should try and use Signal instead of WhatsApp. You can't trust Facebook to care about your privacy.

Signal is bad as explained previously, it requires Google on your phone to even work. If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever. We cant have nice good encryption and safe communication when geeks push this Signal onto unsuspecting users, when the real option is to keep improving Tox.Chat and bitmessage.

"Signal is bad as explained previously, it requires Google on your phone to even work.

If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever."

Every time Signal comes up on HN people make this point (Signal is bad) as if it is true.

And every time it is exposed as bs.

Re: WhatsApp backdoor allows snooping on encrypted messages

#14

Post by pilif »

antocv wrote: post #8
agd wrote: post #4

"Asked to comment specifically on whether Facebook/WhatApp had accessed users’ messages and whether it had done so at the request of government agencies or other third parties, it directed the Guardian to its site that details aggregate data on government requests by country." This is why people should try and use Signal instead of WhatsApp. You can't trust Facebook to care about your privacy.

Signal is bad as explained previously, it requires Google on your phone to even work. If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever. We cant have nice good encryption and safe communication when geeks push this Signal onto unsuspecting users, when the real option is to keep improving Tox.Chat and bitmessage.

> Signal is bad as explained previously, it requires Google on your phone to even work.

only for notification delivery. The message payload is not part of the push notification.

Re: WhatsApp backdoor allows snooping on encrypted messages

#16

Post by parent5446 »

antocv wrote: post #8
agd wrote: post #4

"Asked to comment specifically on whether Facebook/WhatApp had accessed users’ messages and whether it had done so at the request of government agencies or other third parties, it directed the Guardian to its site that details aggregate data on government requests by country." This is why people should try and use Signal instead of WhatsApp. You can't trust Facebook to care about your privacy.

Signal is bad as explained previously, it requires Google on your phone to even work. If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever. We cant have nice good encryption and safe communication when geeks push this Signal onto unsuspecting users, when the real option is to keep improving Tox.Chat and bitmessage.

This makes no sense in so many ways. I suggest you read more on exactly how Signal relies on Google. It does not at all compromise the encryption protocol. Also Tox? Good luck with that.

Re: WhatsApp backdoor allows snooping on encrypted messages

#17

Post by gourou »

> The desire to protect people's private communication is one of the core beliefs we have at WhatsApp, and for me, it's personal. I grew up in the USSR during communist rule, and the fact that people couldn't speak freely is one of the reasons my family moved to the United States

Jan Koum and Brian Acton, founders of Whatsapp

Re: WhatsApp backdoor allows snooping on encrypted messages

#18

Post by whyever »

pilif wrote: post #12

No matter what IM service you use: As long as they manage the public keys for their users, they will be vulnerable to exactly this problem. This isn't just WhatsApp. This applies to iMessage and Signal too. In all cases, we rely on the word of the service provider that they don't sneak additional public keys to encrypt for into the clients and in all cases we hear that doing so would cause a message dialog to appear,…

> do you know whether the software you got from the App Store is the software that's on Github?

Yes: https://whispersystems.org/blog/reproducible-android/

Re: WhatsApp backdoor allows snooping on encrypted messages

#19

Post by joelhaasnoot »

jaymzcampbell wrote: post #2

The key part is this, and it was apparently reported back in April 2016 with Facebook replying it's "expected behavior", it's not something a general attacker can do but it would enable WhatsApp/Facebook to read conversations: > WhatsApp has the ability to force the generation of new encryption keys for offline users, unbeknown to the sender and recipient of the messages, and to make the sender re-encrypt messages wi…

According to the article however, the notification is given after the messages are resent. There is nothing the user can seemingly do to prevent retransmission on a forced key change. This prevents further information from being sent, but in case of undelivered messages, they could be snooped on.

Re: WhatsApp backdoor allows snooping on encrypted messages

#20

Post by blorgle »

It doesn't matter whether you use WhatsApp, Facebook Messenger "Secret Conversations" or even Signal app (or PGP or any public key based communications system)!.

If you are not verifying key fingerprints out of band, then you are potentially vulnerable to a malicious server MITMing new sessions.

If you want secure end-to-end messaging, verify keys out of band, do not solely trust a 3rd party for key exchange!

Post reply on HN