Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There is no WhatsApp 'backdoor'

whispersystems.org

Post reply on HN
Print view View original

161–170 of 437 posts

Re: There is no WhatsApp 'backdoor'

#161

Post by serf »

tptacek wrote: post #145
akvadrako wrote: post #116

Earlier quoted context omitted.

Whichever story you are talking about, this one or the guardian one, it doesn't address the closed-source point. There is theoretically a way to verify WhatsApp even though it's closed source, but it's practically impossible. It's hard enough to verify software even when the source is open, you built it yourself and the whole platform and toolchain is trusted. A bunch of the potential NSA crypto backdoors were totall…

I'm sorry, but this simply isn't true. Software of far, far greater complexity than WhatsApp has been reverse engineered comprehensively by hobbyists and amateurs. Meanwhile, professionals have pretty sophisticated tools for doing this work at scale.

This seems to be the same angle played every time the analysis of crypto tools comes up on HN.

(Almost always) when someone mentions the 'impossibility of analysis' of closed-source programs they are actually referring to the difficulty in doing so -- not actually stating that it's impossible.

It is easier to look through source code.

Now, if we're progressing through this conversation according to script, it will be mentioned that open source projects have had tremendous security problems, too. (OpenSSL comes to mind..)

But that's beside the point expressed.

The only point, and it's the point that was originally expressed, is that open source code is easier to look through than a closed code base.

The hurdles posed by closed source, although not impossible to jump, significantly hinder the progress of analysis.

Is this not true?

Re: There is no WhatsApp 'backdoor'

#162

Post by akvadrako »

amelius wrote: post #159
akvadrako wrote: post #130

Earlier quoted context omitted.

And that's why we have 2FA on separate devices or even hardware tokens. They allow some security even if the computer isn't trusted, like protection against replay attacks at a minimum.

How does 2FA protect against eavesdropping with something as simple as this: https://en.wikipedia.org/wiki/Hardware_keylogger

It doesn't of course - it protects your account from future access / replay attacks.

Re: There is no WhatsApp 'backdoor'

#163

Post by evgen »

ljk wrote: post #99
imranq wrote: post #83

Earlier quoted context omitted.

What about...Walmart, Glencore, Phillip Morris, Blackwater, Palantir...

> Walmart I can use cash at Walmart

And be sure to smile at the cameras watching you in the store, and the ones in the parking lot that recorded you driving in.

Re: There is no WhatsApp 'backdoor'

#164

Post by tptacek »

lisper wrote: post #147
conradev wrote: post #132

Earlier quoted context omitted.

> no way to demonstrate (or even provide evidence of) the absence of any vulnerabilities I'd say that's hard for open source software to do as well.

Sure, but so what? Hard != impossible. EDIT: WTF people? Why is every response to this comment being downvoted into oblivion? The sibling comment to this one ( https://news.ycombinator.com/item?id=13395657 ) was killed in a matter of minutes despite being (IMHO) a perfectly reasonable and constructive response.

Votes aren't why that comment is dead --- note that it doesn't say "flagged". There is stuff that happens behind the scenes that [deads] users, especially new accounts; I think some of it might be voting ring related but not sure.

(That comment is incorrect but I agree with you that it's constructive).

Re: There is no WhatsApp 'backdoor'

#165

Post by grappler »

jMyles wrote: post #5

Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…

If you are concerned enough about the security and privacy of the app, then you should learn how to use the app. That includes learning about the indicators provided by the UI telling you about key changes, delivery notifications, and anything else the developers considered important enough to show the user.

Re: There is no WhatsApp 'backdoor'

#166

Post by tptacek »

serf wrote: post #161
tptacek wrote: post #145

Earlier quoted context omitted.

I'm sorry, but this simply isn't true. Software of far, far greater complexity than WhatsApp has been reverse engineered comprehensively by hobbyists and amateurs. Meanwhile, professionals have pretty sophisticated tools for doing this work at scale.

This seems to be the same angle played every time the analysis of crypto tools comes up on HN. (Almost always) when someone mentions the 'impossibility of analysis' of closed-source programs they are actually referring to the difficulty in doing so -- not actually stating that it's impossible. It is easier to look through source code. Now, if we're progressing through this conversation according to script, it will be…

I'm sorry, but if you look upthread, the comment I responded to not only didn't say that verifying open source was easier, but actually made the extreme claim that there was in principle no way to verify closed source software at all.

Meanwhile, addressing your (different) argument directly: sure, reading C code is easier than reading assembly code, and reading Python is easier than reading C. The easier it is to read a program the easier it is to reason about it.

But:

* It's not terribly difficult to reason about the functionality of messaging software in any language.

* WhatsApp is an extremely high-profile target; it would be weird if people hadn't reversed it by now, since less well-known programs that are much harder to reverse have been productively (as in: findings uncovered) reversed.

* The particular things we're looking for in a program like WhatsApp fall into two classes: (1) basic functional stuff like data flow that is even more straightforward to discern from control flow graphs than the kinds of things we routinely use reversing to find (like memory corruption flaws), and (2) cryptographic vulnerabilities that are difficult to spot even in source code, because they're implemented in the mathematical domain of the crypto primitives regardless of the language used to express them to computers.

Sure, though. It is easier to spot backdoors in open source software. It's just not capital-H Hard to do it in closed-source software, so this open vs. closed debate about backdoors is usually a red herring.

Re: There is no WhatsApp 'backdoor'

#167

Post by tptacek »

akvadrako wrote: post #160
tptacek wrote: post #145

Earlier quoted context omitted.

I'm sorry, but this simply isn't true. Software of far, far greater complexity than WhatsApp has been reverse engineered comprehensively by hobbyists and amateurs. Meanwhile, professionals have pretty sophisticated tools for doing this work at scale.

Have you ever heard of the obfuscated C contest? Even with the code in front of your face and looking innocent it's hard to see what it does. When you only have decompiled assembly, obfuscation is much easier.

At the binary level, obfuscation is powerful but obvious. Is iOS WhatsApp meaningfully obfuscated?

Re: There is no WhatsApp 'backdoor'

#168

Post by RatherFunky »

_jp__ wrote: post #158

Of course there is a backdoor. Why not? Under what law whatsapp and whispersystems live? The one with secret courts and secret court orders?. How to trust someone under this umbrella? We need to spread technology companies. Everything but a bunch of things comes from this law. And what starts in another country, magicaly gets bought or dismissed. Take Symbian as an example...

again ows has nothing to do with this. It is solely vulnerability of whatsapp

Re: There is no WhatsApp 'backdoor'

#169

Post by tedunangst »

serf wrote: post #161
tptacek wrote: post #145

Earlier quoted context omitted.

I'm sorry, but this simply isn't true. Software of far, far greater complexity than WhatsApp has been reverse engineered comprehensively by hobbyists and amateurs. Meanwhile, professionals have pretty sophisticated tools for doing this work at scale.

This seems to be the same angle played every time the analysis of crypto tools comes up on HN. (Almost always) when someone mentions the 'impossibility of analysis' of closed-source programs they are actually referring to the difficulty in doing so -- not actually stating that it's impossible. It is easier to look through source code. Now, if we're progressing through this conversation according to script, it will be…

Not necessarily. People who spend their days writing source code tend to think in terms of source code because that's what they know. People who spend their days analyzing binaries don't. Be mindful of the difference between difficult and unfamiliar.

Re: There is no WhatsApp 'backdoor'

#170

Post by rndgermandude »

jMyles wrote: post #5

Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop.

PS: I just check on my phone if those notifications were turned on. There were not. And I'd never turn those off myself, which leads me to conclude that the rekeying notifications are off by default (in their android app)

Post reply on HN