Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There is no WhatsApp 'backdoor'

whispersystems.org

Post reply on HN
Print view View original

211–220 of 437 posts

Re: There is no WhatsApp 'backdoor'

#211

Post by tedunangst »

lisper wrote: post #186
tptacek wrote: post #155

Earlier quoted context omitted.

You're using a word, "easier", that is keeping us off the same page. I agree that Haskell programs are easier in many senses to verify than PHP programs. But our field does formal methods verification of assembly programs, for instance by lifting them to an IR.

That's news to me. At least it's news that this is actually practical for any interesting cases (i.e. real crypto code). Do you have a reference?

The Skype client was obfuscated, encrypted, and riddled with anti debugging boobytraps, none of which prevented people from figuring out exactly what it did. (Not exactly a formal analysis, but probably news to the people who think messaging apps have never been reversed before.)

Re: There is no WhatsApp 'backdoor'

#212

Post by Grollicus »

sebleon wrote: post #18

At the end of the day, it comes down to trusting WhatsApp. Even without a backdoor in their protocol, they can easily do all kinds of things. For instance, it could instruct specific clients to encrypt and send each message twice: one for the recipient, and one for the WhatsApp server. As long as this was off for 99.9% of users, it's unlikely that security researchers would ever detect this.

The joke is if this specific "Backdoor" would be used widespread it would generate a lot of noise (eg. random key changes, keys that don't match) and would cause massively bad PR for WhatsApp. No way are they doing that.

Re: There is no WhatsApp 'backdoor'

#213

Post by rndgermandude »

haser_au wrote: post #205
rndgermandude wrote: post #170

Earlier quoted context omitted.

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just chec…

> This allows WhatsApp to MITM. Technically, yes. Users could verify if they have been MITMed by verifying the Security Number (just tap on a contact, view contact details -> Encryption). This assumes the WhatsApp app doesn't just display the old safety number.

Indeed. I'm working under the assumption that the client itself is sound.

The question is: how many users will actually check the Security Number, and recheck all the security numbers now that they were made aware of having to turn on the notification.

What WhatsApp is doing here is like using a self signed certificate to do TLS (your own fault if you did not check the cert yourself using whatever out-of-bands method available) and on top of that the TLS client later by default will not tell you when that self-signed cert changes (and you therefore need to recheck it) and for added bonus routing all traffic through them.

Re: There is no WhatsApp 'backdoor'

#214

Post by wfunction »

moxie wrote: post #207
rndgermandude wrote: post #170

Earlier quoted context omitted.

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just chec…

> This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. You've just d…

> That way the server has no knowledge of who it can MITM without getting caught.

What exactly do you think is the worst thing that could happen if you "catch" them doing this?

Now what do you think is the worst thing that could happen if they receive a subpoena or NSL or whatever that tells them to do this regardless of whether the user finds out or not (because the government wants the message contents that badly)?

Which do you think will prevail?

Re: There is no WhatsApp 'backdoor'

#215

Post by agd »

'Given the size and scope of WhatsApp's user base, we feel that their choice to display a non-blocking notification is appropriate. It provides transparent and cryptographically guaranteed confidence in the privacy of a user's communication, along with a simple user experience. The choice to make these notifications "blocking" would in some ways make things worse. That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully.'

Why not have every client show up as having safety number change notifications on and just choose whether to display them client side depending on user settings? i.e. if you have them off, no message will display and the message will automatically be resent using the new key?

Re: There is no WhatsApp 'backdoor'

#216

Post by occamrazor »

MichaelGG wrote: post #172
tucif wrote: post #72

Earlier quoted context omitted.

It could . I guess the point here is: Can there be a backdoor in whatsapp? Of course! Is there a backdoor on Whatsapp as described on the guardian article? No. Can the UX be improved to alert the smaller percentage of users that rely heavily on the encryption features when their communication is not being actively protected without disturbing the UX of the rest of the users? Probably yes,

No it's very different. Without further details, it sounds like it's possible for FB to switch keys and intercept all messages on everyone, all the time.

But the sender would receive at least a notification of key change by the recipient. It is up to them to confirm the validity of the key.

Re: There is no WhatsApp 'backdoor'

#217

Post by Ajedi32 »

rndgermandude wrote: post #170
jMyles wrote: post #5

Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just chec…

Right, as the article says:

> The only question it might be reasonable to ask is whether these safety number change notifications should be "blocking" or "non-blocking." In other words, when a contact's key changes, should WhatsApp require the user to manually verify the new key before continuing, or should WhatsApp display an advisory notification and continue without blocking the user.

You seem to be arguing that they should be blocking. While I agree that's definitely the best choice from a security perspective, I kinda doubt most users would appreciate having to manually re-verify keys every time someone reinstalls WhatsApp or changes their phone. In this case, WhatsApp decided to prioritize usability over security. You and I are of course free to criticize that choice, but it's hardly a "backdoor".

I'd add to the author's statement above and say another question we might reasonably ask is whether the notification should be on or off by default. While my gut reaction to that "On, obviously!", upon giving it a bit more thought I think it's actually understandable why WhatsApp chose off instead.

They're not designing WhatsApp merely for security conscious people, but for the masses. The average user is unlikely to understand or care enough about this warning to manually re-verify keys every time they see it, especially when the vast majority of the time it's just going to turn out to be the result of something mundane, like one of their friends getting a new phone. Honestly, I could go either way on this one.

Re: There is no WhatsApp 'backdoor'

#218

Post by rndgermandude »

Ajedi32 wrote: post #217
rndgermandude wrote: post #170

Earlier quoted context omitted.

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just chec…

Right, as the article says: > The only question it might be reasonable to ask is whether these safety number change notifications should be "blocking" or "non-blocking." In other words, when a contact's key changes, should WhatsApp require the user to manually verify the new key before continuing, or should WhatsApp display an advisory notification and continue without blocking the user. You seem to be arguing that t…

No, first and foremost, I argue the notifications should be ON by default and feature a lot more clear and understandable text than what is displayed now.

The auto-resending of unread messages is another issue next to the potential of MITM due to no or unclear notifications about key changes

Re: There is no WhatsApp 'backdoor'

#219

Post by Ajedi32 »

agd wrote: post #215

'Given the size and scope of WhatsApp's user base, we feel that their choice to display a non-blocking notification is appropriate. It provides transparent and cryptographically guaranteed confidence in the privacy of a user's communication, along with a simple user experience. The choice to make these notifications "blocking" would in some ways make things worse. That would leak information to the server about who h…

Huh? Isn't that exactly how it is now?

Re: There is no WhatsApp 'backdoor'

#220

Post by rndgermandude »

moxie wrote: post #207
rndgermandude wrote: post #170

Earlier quoted context omitted.

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just chec…

> This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. You've just d…

> The notification that you see in WhatsApp, Signal, SSH, PGP, or whatever is the defense.

That defense, which happens to be the only defense, is turned off by default in WhatsApp.

You seem to argue they do so because it's bad UX to present such notification by default. That's - in my humble opinion - like suggesting browsers should turn off TLS chain errors by default because it's bad UX and just proceed with the connection as if nothing happened...

Post reply on HN