11–20 of 29 posts
It is sad, and misinformative, that this article is currently #1 on HN, while the much more accurate and better-written Guardian piece "WhatsApp backdoor allows snooping on encrypted messages" is #2. The linked piece is hard to critique because it's borderline incoherent. The "conclusion" is simply not a conclusion, particularly this passage: > A provider always has the ability to intercept messages as long as the us…
This backdoor cannot be exploited by third parties, only by Facebook themselves, who already have much easier ways to intercept or manipulate communication. So although I don't think Whatsapp makes the right trade-off here (people get a new phone only once every few years, so why optimize for that edge case?), I'm not concerned about the privacy implications either.
I suspect other commenters here are confused about the nature of the Signal protocol, and who you have to trust for the system to be secure. If you used to believe that Facebook is 100% unable to intercept or tamper with Whatsapp communication, then this would be upsetting. But since they're a trusted party already, this changes nothing.
The point about this "backdoor" business is that the WhatsApp client does not even give the user the chance to even make a mistake of skipping or mis-executing validation. Instead, it will just make that mistake FOR you, every time, for your convenience!
That utter failure of design, and breach of trust, enables a remote actor (the WhatsApp servers) to access secure data. So yes, it is a "backdoor".
It is sad, and misinformative, that this article is currently #1 on HN, while the much more accurate and better-written Guardian piece "WhatsApp backdoor allows snooping on encrypted messages" is #2. The linked piece is hard to critique because it's borderline incoherent. The "conclusion" is simply not a conclusion, particularly this passage: > A provider always has the ability to intercept messages as long as the us…
If the title of the article is the conclusion, I really don't see how they arrive there based on the post. If I read the post and came up with the thesis sentence myself, it would be "WhatsApp is vulnerable to MITM attacks because it tries to automate key changes by default"
It is sad, and misinformative, that this article is currently #1 on HN, while the much more accurate and better-written Guardian piece "WhatsApp backdoor allows snooping on encrypted messages" is #2. The linked piece is hard to critique because it's borderline incoherent. The "conclusion" is simply not a conclusion, particularly this passage: > A provider always has the ability to intercept messages as long as the us…
The encryption in WhatsApp and Signal and Apple messaging all are all built to protect data from others in transit not necessarily from the service provider itself.
No system where a central service provider manages both key infrastructure and message delivery can ever be secure from MITM by the service provider unless you do manual key verification through a different channel. Signal does provide the means to doing so by physically meeting a person and verifying which is good. But are you truly going to be able to explain these concepts beyond techies?
This is flat-out wrong. There is no opt-in feature to block sending when the key material changes. There is only an option that notifies when the material changes.
And this is precisely the problem. On certain messages (those not yet delivered) whatsapp can force re-transmission encrypted with a key of their choosing. No options will block the re-transmission.
It is sad, and misinformative, that this article is currently #1 on HN, while the much more accurate and better-written Guardian piece "WhatsApp backdoor allows snooping on encrypted messages" is #2. The linked piece is hard to critique because it's borderline incoherent. The "conclusion" is simply not a conclusion, particularly this passage: > A provider always has the ability to intercept messages as long as the us…
It's actually very accurate technically. The Guardian article seems to miss the basic point. The encryption in WhatsApp and Signal and Apple messaging all are all built to protect data from others in transit not necessarily from the service provider itself. No system where a central service provider manages both key infrastructure and message delivery can ever be secure from MITM by the service provider unless you do…