Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There is no WhatsApp 'backdoor'

whispersystems.org

Post reply on HN
Print view View original

201–210 of 437 posts

Re: There is no WhatsApp 'backdoor'

#201

Post by NoodleIncident »

tyrust wrote: post #110
jMyles wrote: post #71

Earlier quoted context omitted.

Isn't it possible (in fact trivial) to sniff the traffic generated by WhatsApp and verify that it is indeed the message transmitted, encrypted by the key on the device? Has anyone performed such an audit?

This might be possible, but I don't think it addresses the issue that such an exploit could be turned on and off remotely. The only way to be sure would be to do such sniffing all the time.

Is an app like this enough for that purpose?

https://play.google.com/store/apps/details?id=com.googlecode...

Re: There is no WhatsApp 'backdoor'

#202

Post by tptacek »

lisper wrote: post #186
tptacek wrote: post #155

Earlier quoted context omitted.

You're using a word, "easier", that is keeping us off the same page. I agree that Haskell programs are easier in many senses to verify than PHP programs. But our field does formal methods verification of assembly programs, for instance by lifting them to an IR.

That's news to me. At least it's news that this is actually practical for any interesting cases (i.e. real crypto code). Do you have a reference?

I'm in a cab typing on my phone but good Google searches are "llvm lifter" and "symbolic execution" or "SMT".

Re: There is no WhatsApp 'backdoor'

#204

Post by tedunangst »

burkaman wrote: post #173
DannyBee wrote: post #100

Earlier quoted context omitted.

"The journalist gave a reasonable effort to get a comment from Lattner, never got a response, so went with a story from a source they found trustworthy. " Oh well, can't figure out the actual facts, better just publish whatever i do have? Seriously. Also, the "i tried to contact you" is clearly a BS defense. It wasn't a "reasonable effort". This is a reporter. They know that people basically never respond to intervie…

Yes, if you make several requests for comment over several days and don't get a response, it is acceptable to run with what you have, as long as you note those facts in the article. Also, he's switching jobs, not landing on the moon. If he has time to tweet, he has time to check his email. If you just assume that both players in this story are human beings trying to do their jobs, you'll understand that neither of th…

Several days? The news of his departure isn't even several days old. Even if he asked lattner to comment five minutes after his email to the swift list, that wasn't a reasonable time to wait before publishing.

Re: There is no WhatsApp 'backdoor'

#205

Post by haser_au »

rndgermandude wrote: post #170
jMyles wrote: post #5

Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just chec…

> This allows WhatsApp to MITM. Technically, yes.

Users could verify if they have been MITMed by verifying the Security Number (just tap on a contact, view contact details -> Encryption). This assumes the WhatsApp app doesn't just display the old safety number.

Re: There is no WhatsApp 'backdoor'

#206

Post by makomk »

cypherpunks01 wrote: post #44
ycmbntrthrwaway wrote: post #12

> That would leak information to the server about who has enabled safety number change notifications and who hasn't , effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully. I am not convinced. Why should this option exist at all? Even worse, it is disabled by default. Just enable notifications for everyone and demand verification. If you…

If we're talking about key change notifications, isn't SSH the thing that throws the following error when a key changes? @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attac…

Yeah, SSH is at the complete opposite end of the scale in how it handles unexpected key changes - it won't even let you connect unless you manually edit known_hosts, whereas WhatsApp automatically uses the new key without any possible way for the user to stop it from doing so until it's too late.

Re: There is no WhatsApp 'backdoor'

#207

Post by moxie »

rndgermandude wrote: post #170
jMyles wrote: post #5

Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just chec…

> This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop.

You've just described a "man in the middle" attack. It is endemic to any public key cryptosystem, including Signal and PGP, not just WhatsApp. The notification that you see in WhatsApp, Signal, SSH, PGP, or whatever is the defense.

> PS: I just check on my phone if those notifications were turned on. There were not. And I'd never turn those off myself, which leads me to conclude that the rekeying notifications are off by default (in their android app)

Key change notifications are off by default in WhatsApp. That's probably going to be a fundamental limit of any application that serves billions of people from many different demographics all over the world.

Even if they were on by default, a fact of life is that the majority of users will probably not verify keys. That is our reality. Given that reality, the most important thing is to design your product so that the server has no knowledge of who has verified keys or who has enabled a setting to see key change notifications. That way the server has no knowledge of who it can MITM without getting caught. I've been impressed with the level of care that WhatsApp has given to that requirement.

I think we should all remain open to ideas about how we can improve this UX within the limits a mass market product has to operate within, but that's very different from labeling this a "backdoor."

Re: There is no WhatsApp 'backdoor'

#208

Post by Grollicus »

olegkikin wrote: post #192

It actually doesn't matter. They are talking about comprimising the servers. The government has the power to force a backdoor (remember Lavabit?). All Whatsapp has to do is update their client, and all the beautiful encryption schemes are ruined. If you need a truly secure communication system, it has to be open source and self-hosted. You still have to trust the hardware though.

To expand on this argument a bit, if you think the Government/Whatsapp are specifically out to get you (eg. willing to mount an active attack against you specifically), then WhatsApp is propably the wrong messenger for you.

If on the other hand you want a reasonably secure Messenger that you can use to chat privately with everybody and their Grandma then maybe you should not expect that it does super complex security thingys that 99% of its users just don't care about and don't want to be bothered with..

Re: There is no WhatsApp 'backdoor'

#209

Post by jknoepfler »

haser_au wrote: post #205
rndgermandude wrote: post #170

Earlier quoted context omitted.

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just chec…

> This allows WhatsApp to MITM. Technically, yes. Users could verify if they have been MITMed by verifying the Security Number (just tap on a contact, view contact details -> Encryption). This assumes the WhatsApp app doesn't just display the old safety number.

In the world of security, technically means actually. Life or death situations require zero trust technologies.

Re: There is no WhatsApp 'backdoor'

#210

Post by shawnz »

rndgermandude wrote: post #170
jMyles wrote: post #5

Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just chec…

> This allows WhatsApp to MITM.

If you're operating under the assumption that users aren't going to check their peers' key fingerprints, then you could just give compromised keys from the beginning -- no rekeying necessary. There's no way to protect against that scenario. That's not a fault of WhatsApp.

Post reply on HN