Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp backdoor allows snooping on encrypted messages

theguardian.com

Post reply on HN
Print view View original

251–260 of 334 posts

Re: WhatsApp backdoor allows snooping on encrypted messages

#251

Post by odbol_ »

dserodio wrote: post #108
agd wrote: post #4

"Asked to comment specifically on whether Facebook/WhatApp had accessed users’ messages and whether it had done so at the request of government agencies or other third parties, it directed the Guardian to its site that details aggregate data on government requests by country." This is why people should try and use Signal instead of WhatsApp. You can't trust Facebook to care about your privacy.

I often give Signal another chance, but it's UI is horrible. Some messages are not delivered, some are delivered only to Signal Desktop but not to my cell phone so I'm only notified days after the message was sent...

Signal Desktop is pretty bad, but their Android client is top-notch. One of the best messaging apps I've ever used. It integrates with SMS seamlessly, does inline replies directly from the notification, smartwatch support, Giphy support, etc

Re: WhatsApp backdoor allows snooping on encrypted messages

#252

Post by throwaway11317 »

frabbit wrote: post #249
mentat wrote: post #242

Earlier quoted context omitted.

There's a there right?

What? You must be some sort of conspiracy theorist. Just be rational and extrapolate from your beliefs: if you admit that Facebook might do this, then why not Google, AT&T, Microsoft? There would be no end to it. Basically it would mean that all businesses are spying on you and handing the information over to the government. I have complete faith that that is untrue based upon just the history of the last 5 years.

> AT&T

https://en.wikipedia.org/wiki/Room_641A

I thought maybe after the last decade's revelations about the security apparatus, we might be beyond calling people who are a bit paranoid about their security "conspiracy theorists".

Re: WhatsApp backdoor allows snooping on encrypted messages

#254

Post by CamelCaseName »

seangrogg wrote: post #240
afshinmeh wrote: post #229

Earlier quoted context omitted.

Good point. At least as a technical person, I would like to use an open-source messaging application. Of course I'm not going to read the source code but at least I'm sure developers behind the app do not open a backdoor for someone else.

While I'm totally the same in this regard, this does feel a bit like an open-source version of the bystander effect.

I suppose the difference is that the bystander effect has a connotation with the person stepping in not getting any real benefit personally (e.g. breaking up a fight) vs. here where you would get some name recognition for calling out Signal (for example)

Re: WhatsApp backdoor allows snooping on encrypted messages

#255

Post by frabbit »

throwaway11317 wrote: post #252
frabbit wrote: post #249

Earlier quoted context omitted.

What? You must be some sort of conspiracy theorist. Just be rational and extrapolate from your beliefs: if you admit that Facebook might do this, then why not Google, AT&T, Microsoft? There would be no end to it. Basically it would mean that all businesses are spying on you and handing the information over to the government. I have complete faith that that is untrue based upon just the history of the last 5 years.

> AT&T https://en.wikipedia.org/wiki/Room_641A I thought maybe after the last decade's revelations about the security apparatus, we might be beyond calling people who are a bit paranoid about their security "conspiracy theorists".

Ah, obviously you are a Russian troll trying to hack the US telecoms industry.

Re: WhatsApp backdoor allows snooping on encrypted messages

#256

Post by evv »

frabbit wrote: post #249
mentat wrote: post #242

Earlier quoted context omitted.

There's a there right?

What? You must be some sort of conspiracy theorist. Just be rational and extrapolate from your beliefs: if you admit that Facebook might do this, then why not Google, AT&T, Microsoft? There would be no end to it. Basically it would mean that all businesses are spying on you and handing the information over to the government. I have complete faith that that is untrue based upon just the history of the last 5 years.

Sarcasm usually plays out very poorly on written mediums like this, but you nailed it.

Re: WhatsApp backdoor allows snooping on encrypted messages

#257

Post by Sgt_Apone »

Moyamo wrote: post #207
therealmarv wrote: post #51

The biggest security issue on WhatsApp are the backups, especially the cloud backups not the protocol and this so called "backdoor" itself. Pictures not encrypted on backups, encryption keys of backups stored on WhatsApp side which might or might not (???) have access to your cloud backups on Google Drive and iCloud. If a government (USA?) gets access to one of your or your friends backups and the encryption key it c…

I've noticed this as well, do they even encrypt the backups the upload to google drive and if so with what key? If they use one key then the advantages of perfect forward and perfect future secrecy that the double-ratchet protocol provides is lost.

Messages and media backed up to Google Drive are "not protected by WhatsApp end-to-end encryption while in Google Drive" according the app.

Re: WhatsApp backdoor allows snooping on encrypted messages

#258

Post by geocar »

squeaky-clean wrote: post #245
whyever wrote: post #142

Earlier quoted context omitted.

> when Moxie himself said that I should trust WhatsApp without having the source code and the ability to put it on my device. What are you talking about? All I can see there is that you asked for the source code of the QR generator and he delivered. He does not say you should trust WhatsApp.

> All I can see there is that you asked for the source code of the QR generator and he delivered. Eh, I kind of agree with geocar's point in the original thread. Moxie shared source code to "a" QR generator. Is there any way to verify that this code is what's running inside of WhatsApp?

Yes. The most obvious one is to make it possible for me to build WhatsApp and install it on my phone, however there are a lot of challenges with this.

A less obvious one is to make it possible to detect WhatsApp cheating. This isn't perfect, but someone only needs to detect it cheating once and then your name is mud.

One such way I proposed: If I can create my own key, then I can pass my public key out of band to someone who can mitm[1] themselves and verify that the message on the wire was encrypted and only encrypted with my key, and I can mitm myself to verify that my device only ever sends things encrypted with my own key. Tooling for the protocol is non-existent, and despite someone claiming they could do it in 10 seconds, they never followed up with instructions on how I could do it in 10 seconds.

This also allows other non-WhatsApp versions of the client, which may make things much more difficult for FaceBook (since now they can't upgrade legitimate clients if they discover a protocol-level problem) but the Internet has some experience with protocols.

[1]: https://mitmproxy.org/

Re: WhatsApp backdoor allows snooping on encrypted messages

#259

Post by mentat »

evv wrote: post #256
frabbit wrote: post #249

Earlier quoted context omitted.

What? You must be some sort of conspiracy theorist. Just be rational and extrapolate from your beliefs: if you admit that Facebook might do this, then why not Google, AT&T, Microsoft? There would be no end to it. Basically it would mean that all businesses are spying on you and handing the information over to the government. I have complete faith that that is untrue based upon just the history of the last 5 years.

Sarcasm usually plays out very poorly on written mediums like this, but you nailed it.

Yes, well done.

Re: WhatsApp backdoor allows snooping on encrypted messages

#260

Post by pmoriarty »

EGreg wrote: post #190
nothrabannosir wrote: post #90

Earlier quoted context omitted.

Good point, but there is an explanation: blocking WhatsApp would lead to more intense backlash. See what happened in Brazil. Not to say it isn't both, but the price of blocking (one of) the most popular messaging apps is higher to a government than blocking one in the low low percentiles of usage.

Can you make an unblockable app?

An app that effectively used steganography[1] would probably come the closest to being an "unblockable app". As long as they don't detect that communication is going on, they can't usually block it -- short of blocking everything, which is rarely practical for long.

Some other interesting reading is: [2], [3], and [4]

[1] - https://en.wikipedia.org/wiki/Steganography

[2] - https://en.wikipedia.org/wiki/Covert_channel

[3] - https://en.wikipedia.org/wiki/Traffic_analysis

[4] - https://en.wikipedia.org/wiki/Anonymous_remailer

Post reply on HN