Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There is no WhatsApp 'backdoor'

whispersystems.org

Post reply on HN
Print view View original

61–70 of 437 posts

Re: There is no WhatsApp 'backdoor'

#61

Post by FiloSottile »

jMyles wrote: post #5

Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…

It wouldn't be a conversation. The attacker would have to rely Alice's messages to Bob before switching the key. But then if the attacker let Alice (the target) receive Bob's messages they will learn theirs got delivered and the attack would fail.

So it only works once against a string of messages with no replies. That's not a conversation.

Re: There is no WhatsApp 'backdoor'

#63

Post by UncleMeat »

hackuser wrote: post #56
UncleMeat wrote: post #24

Earlier quoted context omitted.

If your threat model includes using a malicious app to send messages then you lose anyway. Nothing can ever be done to send messages securely using whatsapp if the client is neither trusted nor verified. This is true for basically all software that you use.

Open source software can be verified.

To do this you must not only verify the open source code, but that the binary was built from this code, and that your operating system and every layer below it is also trustworthy.

I stand by my claim that using software written by a malicious developer is game over in the vast majority of contexts.

Re: There is no WhatsApp 'backdoor'

#64

Post by teddyh »

kingnight wrote: post #15

This main flagrant or off-topic, but something that nags at me when thinking about truly secure messaging apps from the App Store: Even with perfect e2e encryption protocol added, what's preventing WhatsApp developers (FB) from adding in a feature of the app: if local.user is "TargetUser007" { takeDeviceSnap(); sendDeviceSnapshotToFBOverSameEncryption(); } Wouldn't this not be ever verifiable unless you ARE that spec…

Yes. Richard Stallman calls these “Universal Back Doors”: https://www.gnu.org/proprietary/proprietary-back-doors.en.ht...

Re: There is no WhatsApp 'backdoor'

#65

Post by MichaelGG »

kingnight wrote: post #34
maxerickson wrote: post #25

Earlier quoted context omitted.

You'd also have to make sure they were the only user that received that binary. Otherwise you'd have to hope that no one reverse engineered the binary and noticed the oddly specific comparison there.

Are reverse engineering techniques currently greater than known ability to obfuscate compiled iOS code?

And it'd have to work for other platforms, too. Android is Java right? Which is even easier to RE.

Re: There is no WhatsApp 'backdoor'

#66

Post by zaken »

zspitzer wrote: post #26

What about https://web.whatsapp.com ? It grants full access to the entire message archive on your phone

Only once you scan the barcode, which contains an encryption key to use for your phone to securely ship /its/ keys to the browser. Only encrypted messages are transmitted between phone and browser

Re: There is no WhatsApp 'backdoor'

#67

Post by burkaman »

joeblau wrote: post #23

There seems to be a pretty clear war going on between engineers and journalists lately. - Chris Latter [1] vs Business Insider [2] - Elon Musk vs (Bunch of outlets) - Moxie vs The Guardian I feel like journalists want to write a compelling story and engineers are on the other side like "No, those aren't facts!" I don't follow a lot of media outlets but it seems like journalists either lack the skills or don't care ab…

I don't think the Chris Lattner thing is a war at all. The journalist gave a reasonable effort to get a comment from Lattner, never got a response, so went with a story from a source they found trustworthy. Lattner issued a denial after the fact, and it's included near the top of the story.

I guess it's possible that the journalist completely fabricated the story, but I think it's a lot more likely that either someone at Apple overstated their relationship with Lattner to vent their own frustrations, or Lattner is trying not to burn bridges. At worst it's an avoidable inaccuracy, not a war.

Re: There is no WhatsApp 'backdoor'

#68

Post by amelius »

UncleMeat wrote: post #24
tyrust wrote: post #9

>The WhatsApp clients have been carefully designed so that they will not re-encrypt messages that have already been delivered. Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. This prevents anyone who compromises the server from being able to selectively target previously delivered messages for re-encryption. Can this be verified? Can this be verified to be th…

If your threat model includes using a malicious app to send messages then you lose anyway. Nothing can ever be done to send messages securely using whatsapp if the client is neither trusted nor verified. This is true for basically all software that you use.

> This is true for basically all software that you use.

And hardware too.

Re: There is no WhatsApp 'backdoor'

#69

Post by jMyles »

enduser wrote: post #60
hackuser wrote: post #56

Earlier quoted context omitted.

Open source software can be verified.

Source code can be verified. Binaries distributed via app stores may or may not have behavior different from the published code.

Certainly it's possible to remedy this situation simply by having the app author sign a checksum of binaries in the app store. Why this is not currently an option (to my knowledge) is a mystery to me.

Re: There is no WhatsApp 'backdoor'

#70

Post by joeblau »

hackuser wrote: post #47
joeblau wrote: post #23

There seems to be a pretty clear war going on between engineers and journalists lately. - Chris Latter [1] vs Business Insider [2] - Elon Musk vs (Bunch of outlets) - Moxie vs The Guardian I feel like journalists want to write a compelling story and engineers are on the other side like "No, those aren't facts!" I don't follow a lot of media outlets but it seems like journalists either lack the skills or don't care ab…

I don't know what happened here, but ... Let's avoid our own bias of automatically believing the engineers are in the right; they are fallible people, no more or less honest or prone to error than journalists. Every news story that breaks, involving any person or industry, gets the same response: It's false, they didn't ask us, etc. etc. Therefore, that response is not an indication that something is wrong (or right)…

You're right. Everyone is fallible and I'm all for mistakes being made — We are all human. I also agree that the immediate snap response tells us nothing.

Based on the BI story, I know a few people that have actually already uninstalled WhatApp for fear of a backdoor. What I wish is that there was a better way for these two entities to communicate rather than finger pointing and name calling so that we as consumers of both media and technology can read a better more comprehensive narrative.

Post reply on HN