Why is moxie doing PR for WhatsApp?
There is no WhatsApp 'backdoor'
111–120 of 437 posts
Re: There is no WhatsApp 'backdoor'
#112Earlier quoted context omitted.
That doesn't protect you against a malicious developer.
You mean someone publishing source code and then falsely verifying the binary checksum? I mean, at the end of the day, it's very easy to verify - if the binary doesn't match what whomever gets when they compile, there better be a reason for it. Regardless, I don't think this is the biggest problem facing open source.
>if the binary doesn't match what whomever gets when they compile, there better be a reason for it.
True, but deterministic compiles are stupendously difficult in most cases. Which is improving slowly, but still isn't usually an option.
Re: There is no WhatsApp 'backdoor'
#113There seems to be a pretty clear war going on between engineers and journalists lately. - Chris Latter [1] vs Business Insider [2] - Elon Musk vs (Bunch of outlets) - Moxie vs The Guardian I feel like journalists want to write a compelling story and engineers are on the other side like "No, those aren't facts!" I don't follow a lot of media outlets but it seems like journalists either lack the skills or don't care ab…
The dispute is really Facebook vs Tobias Boelter (https://tobi.rocks/), with Manisha Ganguly (freelance, so not really The Guardian) putting pressure on Facebook.
I think it's more that the media is biased against corporations, because positive information about corporations sounds like an advertisement or is instead attributed to the employee. Headlines like "Zuckerberg fires 100 employees" or "Wal-mart saves puppy" seem to be either rare or nonexistent.
Re: There is no WhatsApp 'backdoor'
#114At the end of the day, it comes down to trusting WhatsApp. Even without a backdoor in their protocol, they can easily do all kinds of things. For instance, it could instruct specific clients to encrypt and send each message twice: one for the recipient, and one for the WhatsApp server. As long as this was off for 99.9% of users, it's unlikely that security researchers would ever detect this.
Trusting WhatsApp == trusting Facebook I can't think of a company I trust less than Facebook.
Right, I definitely wouldn't use WhatsApp for anything truly sensitive. I wouldn't use smartphone software at all, personally. But this particular "backdoor" seems bogus.
Re: There is no WhatsApp 'backdoor'
#115Earlier quoted context omitted.
Certainly it's possible to remedy this situation simply by having the app author sign a checksum of binaries in the app store. Why this is not currently an option (to my knowledge) is a mystery to me.
It kinda is - you could add it to the description. App stores seem to be getting progressively more hostile to this kind of thing though - you can't just download an APK / iOS app, you have to do it through a device. This lets the stores do "app slimming" (and per-country / per-carrier customized apks) to remove resources you don't need (like binaries that don't match your architecture), which would change the checks…
It's been a while (a couple of years) since I last tried this, but I remember it being reasonably straightforward to get APKs of apps that were on the Google marketplace. Not through official user interfaces, of course. I can't remember if I ended up using some Chrome extension or a third-party app that needed root.
Not a particularly useful comment sorry, just "it was possible two years ago if you jumped through some hoops."
Re: There is no WhatsApp 'backdoor'
#116Earlier quoted context omitted.
Regardless of the merit of this specific accusational-and-denial cycle, the fact remains that Whatsapp is closed source crypto and there is no way in principle for the user to verify any security claims. I happen to trust Moxie's principles, but not as much as I distrust the relationship-with-government imperatives implied by FB's vast business interests.
There's "no way in principle"? How is this whole story not evidence to the contrary? The person who found this didn't use WhatsApp source code. Why do you feel that there's no way to verify closed-source software?
Whichever story you are talking about, this one or the guardian one, it doesn't address the closed-source point.
There is theoretically a way to verify WhatsApp even though it's closed source, but it's practically impossible. It's hard enough to verify software even when the source is open, you built it yourself and the whole platform and toolchain is trusted. A bunch of the potential NSA crypto backdoors were totally in the open.
The app could just be lying about resending old messages or even not encrypting them or any number of things much more subtle.
Re: There is no WhatsApp 'backdoor'
#117Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…
He does address this: Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. That means a user is able to verify visually that the end-to-end is working. "users might not notice" doesn't seem to me as a strong argument to state this as a backdoor. This would imply not noticing that you don't have a green padlock on chrome is a backdoor too, and it clearly is not.
Correct me if I'm wrong, but don't double-ticks only appear in one on one conversations? What's the story on group chats?
Re: There is no WhatsApp 'backdoor'
#118Earlier quoted context omitted.
He does address this: Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. That means a user is able to verify visually that the end-to-end is working. "users might not notice" doesn't seem to me as a strong argument to state this as a backdoor. This would imply not noticing that you don't have a green padlock on chrome is a backdoor too, and it clearly is not.
Correct me if I'm wrong, but don't double-ticks only appear in one on one conversations? What's the story on group chats?
A double-tick will appear once everyone has received the message. You can view details on a single message to see who has received the message on an individual basis (and also who has read it).
Re: There is no WhatsApp 'backdoor'
#119Why is moxie doing PR for WhatsApp?
He consulted on and helped them implement their E2E encryption.
Re: There is no WhatsApp 'backdoor'
#120Moxie claimed:
> "The choice to make these notifications "blocking" would in some ways make things worse. That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully."
Surely if WhatsApp cared about the server not being able to detect this, they could just get the client to "retransmit" an encrypted blank message in place of the original under these circumstances. Then the server wouldn't be able to tell who has enabled blocking mode and who hasn't.