Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp backdoor allows snooping on encrypted messages

theguardian.com

Post reply on HN
Print view View original

261–270 of 334 posts

Re: WhatsApp backdoor allows snooping on encrypted messages

#261

Post by jyrkesh »

seppin wrote: post #155
skrebbel wrote: post #87

Earlier quoted context omitted.

This is a nice idea, but it's also baseless speculation. You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor whenever they want to (for those who haven't actually read the article: this backdoor only works when WhatsApp issues a key change for a conversation, and only then in certain circumstances). In other words, you imply that Egypt said "Hey WhatsApp, p…

> You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor whenever they want to (for those who haven't actually read the article: this backdoor only works when WhatsApp issues a key change for a conversation, and only then in certain circumstances). In other words, you imply that Egypt said "Hey WhatsApp, please actively hack into your Egyptian users' messages…

Yeah, but that's not how the exploit would work. If you read the article, the "backdoor" is that WhatsApp could "generate" a new private key without your knowledge. Except that instead of generating a key, they'd use a well-known key. From there, they could give that key to state actors, or they could decrypt the traffic themselves and give it to state actors.

Either way, you need server side control of WhatsApp.

Re: WhatsApp backdoor allows snooping on encrypted messages

#262

Post by DavideNL »

guidovranken wrote: post #31

From the outset I've always expected that a backdoor was present in Whatsapp. In fact, I'd be surprised if they hadn't granted themselves some special capabilities with regards to the content of the communications. Touting their end-to-end encryption has enticed many people to trust the product, sometimes with strong conviction, while giving themselves a monopoly on access to communication perceived as secure by the…

> I've always expected that a backdoor was present in Whatsapp

Yea, and this is exactly why i never understood why Whispersystems/Moxie cooperated with Whatsapp/Facebook: It gives people a false feeling of security (communicating via Whatsapp), and basically Whispersystems facilitated/made this possible.

It was so obvious...

Re: WhatsApp backdoor allows snooping on encrypted messages

#263

Post by subliminalpanda »

hbosch wrote: post #194
kamjam wrote: post #175

Earlier quoted context omitted.

> Simple explanation would be that activists use Signal. But why do activists simply not use WhatsApp, instead of Signal? If both were suppose to be fully encrypted and secure, why not use the tool that is available. I assume the needing encryption is to prevent the government snooping and eavesdropping on your plans rather than "liking the UI/UX of one system over the other"? Maybe the activists know something we di…

I think the rule of thumb around here is that any system that is closed-source must be treated as inherently untrustworthy from a security standpoint. WhatsApp has therefore always been untrustworthy for the scrupulous, regardless of the relatively flattering PR.

Based on news like this, rightfully so.

Re: WhatsApp backdoor allows snooping on encrypted messages

#264

Post by MichaelGG »

jgaa wrote: post #192
dr_zoidberg wrote: post #185

Earlier quoted context omitted.

> If it's closed source, you cannot possible know what it does. You can set up a wifi and try to MitM yourself and see what packets WhatsApp is sending/receiving. Then you can try to snoop on them and test. The fact that it is closed source doesn't mean you can't analyze it, it just means it's a black box that you have to carefully dissect.

You can get some idea by looking at where the packages are going - but in todays ipv4 space, most p2p packages have to transit trough some public IP addresses. That means that, unless you are able to decrypt the traffic, it will be difficult to know if someone is listening in on the conversation. Also, just by looking at the packages, you will not have any means to detect back-doors, unless they are accessed while yo…

So just look at the actual code executing. Should be fairly easy to tell if there's some huge secret function in the binary.

Re: WhatsApp backdoor allows snooping on encrypted messages

#265

Post by frabbit »

mentat wrote: post #259
evv wrote: post #256

Earlier quoted context omitted.

Sarcasm usually plays out very poorly on written mediums like this, but you nailed it.

Yes, well done.

I feel bad now. I'm just highly frustrated that everyone is not actuated by the idea "if they _can_ spy on you, then they _will_".

Any appeal to morals/integrity/laws are essentially moot in this area. We have the ability to protect ourselves and we should be using it.

https://www.eff.org/deeplinks/2017/01/obama-expands-surveill...

Re: WhatsApp backdoor allows snooping on encrypted messages

#267

Post by ashark »

uselpa wrote: post #116
dserodio wrote: post #108

Earlier quoted context omitted.

I often give Signal another chance, but it's UI is horrible. Some messages are not delivered, some are delivered only to Signal Desktop but not to my cell phone so I'm only notified days after the message was sent...

I have also had my share of delivery problems. But I'm on iOS and there is no alternative to Signal. So I ended up using iMessages most of the time, and Signal only for confidential stuff or when the recipient is on Android.

What I want is: 1) desktop/tablet and phone message delivery, with sane notifications and reliability, 2) doesn't feed all my messages to an ad company, 3) works on my non-Apple devices (otherwise iMessage would be entirely sufficient), and 4) good enough that I can get people to switch (or transparently uses SMS, so it doesn't matter).

Signal fails 1 (the desktop app is pretty bad) and 4 (too many little problems, others won't switch). I'm starting to think Slack, of all things, might be my best solution. Really, I just want ICQ with smart phone/desktop notifications, and picture/video embedding, which doesn't seem like it should be a thing I ought to have any difficulty whatsoever tracking down in 2017.

Re: WhatsApp backdoor allows snooping on encrypted messages

#268

Post by mtgx »

MrsPeaches wrote: post #128
niksakl wrote: post #47

Well, I kind of feel that I have to repost my comment on this old thread[1] with regards to the government of Egypt blocking Signal application: "Isn't it "weird" that they chose to block Signal app and not the signal-protocol based Whatsapp? If Whatsapp really implements the same kind of security and privacy measures that Signal does, why is Whatsapp allowed to continue operating? If signal is preventing them spy on…

Simple explanation would be that activists use Signal. [1] They don't trust WhatsApp and rely on Signal for secure messaging. Blocking Signal means they are able to target activists without impacting much of the rest of the population. [1] Many of the people I know who are activists in countries where they need to protect their identities use Signal

WhatsApp is used by over a billion people. I'm sure some activists in Egypt use WhatsApp, too. That said, I think WhatsApp was blocked in Egypt, too, at least for a while. I don't know if they later "fixed" that or not, and how they did it.

Re: WhatsApp backdoor allows snooping on encrypted messages

#269

Post by m-p-3 »

geocar wrote: post #130

I remember receiving the downvote brigade[1], when Moxie himself said that I should trust WhatsApp without having the source code and the ability to put it on my device. We (even a "smart" community like HN) clearly do not have the ability to think critically about security, and even when our leaders are sincere -- and I really don't mean to suggest Moxie/Signal was complicit in this move -- we still rush to defend o…

Yup, the protocol might be secure, but the implementation might not be. Without the source code, you can only guess and hope for the best.

Re: WhatsApp backdoor allows snooping on encrypted messages

#270

Post by whyever »

drdaeman wrote: post #195
whyever wrote: post #154

Earlier quoted context omitted.

When the US government asked OWS for data on some users, all they got was the telephone number and the date of the last login.

Ahem. Don't they also have contact information? From https://whispersystems.org/blog/contact-discovery/ and lack of future follow-ups on the subject, I believe they do. Possibly, hashed or obfuscated, but still recoverable. Which must mean either I'm misunderstanding something (e.g. things had changed since the blog post was published and relevant GitHub issues were closed), or they had not disclosed some information…

You can look at the published court documents:

https://www.documentcloud.org/documents/3120046-Open-Whisper...

The page I linked was the full data they disclosed.

Post reply on HN