Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There is no WhatsApp 'backdoor'

whispersystems.org

Post reply on HN
Print view View original

261–270 of 437 posts

Re: There is no WhatsApp 'backdoor'

#261

Post by smartbit »

mos_basik wrote: post #106
derefr wrote: post #101

Earlier quoted context omitted.

WhatsApp seems to be built for a threat model where a single message (and you can think of a block of messages without reply as semantically equivalent to a single message, here) being compromised is no big deal; only a conversation being compromised is a problem. If there are cases (like this) where a single-message compromise is a big deal, and WhatsApp cares about these cases, then the simplest solution would be f…

And - as the article describes - such a blocking mode would immediately expose to WhatsApp which users had not enabled it, and who would therefore be safe(er) to MITM (because they probably don't verify key changes in any meaningful way).

why? The UI on the receiver end could show the warning, not the message, and in the dialog to the Whatsapp systems behave normally. In that way the user would be notified of rekeying, the MITM attacker wouldn't be notified that the user is security consious.

Re: There is no WhatsApp 'backdoor'

#262

Post by kbwt »

smartbit wrote: post #250
taneq wrote: post #242

Earlier quoted context omitted.

Why are unsigned key changes a 'normal' thing? It'd be trivial to sign the new public key with the old private key, maintaining a chain of trust.

> It'd be trivial to sign the new public key with the old private key How would these 'trivial' steps look like if a telephone gets stolen or upgraded? What easy steps did Facebook & Moxie overlook?

> How would these 'trivial' steps look like if a telephone gets stolen

Just as 'trivial' as it is Facebook to swap your key at the request of a government. You should have to start from a blank slate (zero trust) in that situation.

Getting your phone stolen is an extraordinary event that warrants requesting some attention from your contacts, even if only to inform them of the old identity being compromised. And then you might as well have them verify a new key.

Re: There is no WhatsApp 'backdoor'

#263

Post by srathi »

rndgermandude wrote: post #199
ehsankia wrote: post #189

Earlier quoted context omitted.

I'm confused. The way I understand it is that once the double checkmark appears, those messages are locked in and never rekeyed. That means once you see those checkmarks, you're guaranteed no one can snoop on that message anymore. Assuming you have the notification on (Which anyone who cares about security could and should turn on), once you see a warning, you could just delete all messages that don't have the double…

One checkmark = message delivered / Double checkmark = somebody read it. That somebody might as well be WhatApp doing a MITM The double checkmark stuff the blog talks about just means you cannot retroactively rekey already sent (old) messages. WhatApp inserting itself as a MITM can however read (and double checkmark) and new messages after they did the MITM rekeying

It is actually slightly different. One checkbox means received by WhatsApp, two checkboxes means received by the recipient and two blue checkboxes means read by the recipient.

Re: There is no WhatsApp 'backdoor'

#264

Post by Saavedro »

Veratyr wrote: post #244
moxie wrote: post #237

Earlier quoted context omitted.

> That defense, which happens to be the only defense, is turned off by default in WhatsApp. > You seem to argue they do so because it's bad UX to present such notification by default. That's - in my humble opinion - like suggesting browsers should turn off TLS chain errors by default because it's bad UX and just proceed with the connection as if nothing happened... One thing we've learned over the years is that secur…

> Key changes in a messenger are totally different. They happen under normal conditions This doesn't have to be the case. If you stop coupling a key to a device and instead couple a key to a person (generating a key deterministically from a password for example), they can be changed far more rarely.

this requires humans to be able to generate and remember passwords with decent entropy

Re: There is no WhatsApp 'backdoor'

#265

Post by newsat13 »

Yawn. Next what, whatsapp is not going to use monetizing to advertise? Why don't we just all admit that all our data is being plundered by corporations to make money and just leave it at that? Seriously, nobody cares about their data being used by corporations for profit. Just be honest about it.. and you will see that people continue to use whatsapp or signal or whatever the current fad is.

Re: There is no WhatsApp 'backdoor'

#266

Post by kentonv »

I love this post for the in-depth explanation of the UX challenges around e2e encryption and why they made the decisions they did. It's educational.

I think Moxie highlights a very good point that is commonly underrated among "security Dunning-Krugers": Opening yourself to the possibility of an attack is often OK if the attack is easily detectable, and if the identity of the attacker would be obvious upon detection. Yes, Facebook could intercept and decrypt a message without your advance knowledge. However, you would be able to detect it after the fact. And if you detected an attack, the attacker could be no one other than Facebook. You could then expose them and ruin their reputation. Given this, it's unlikely that Facebook would risk carrying out such an attack in the first place.

Security is not binary, it's risk management. The goal is to minimize the risk of an attack, not to rule it out entirely (hint: you can't). I think WhatsApp has made the right choices here.

Re: There is no WhatsApp 'backdoor'

#267

Post by bisby »

jMyles wrote: post #246
moxie wrote: post #207

Earlier quoted context omitted.

> This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. You've just d…

Moxie, I think it's fair to say that you are the world thought leader on these matters right now. One thing that the rest of us are wondering right now is: > I've been impressed with the level of care that WhatsApp has given to that requirement. To what degree do you really know that? Is there a place where we can read about your interactions with Facebook, the level of access they've given you, and the degree to whi…

> But there are nuances here that are important, and fleshing them out is a big part of what this community is about.

The entire point of the crypto community is to maintain as little trust as possible unless you can be highly certain about things.

The media reaction to "OMG WHATSAPP IS FOR SURE NOT SAFE" is a HUGE over reaction. But in an industry where audits and open source are huge factors in trust... WhatsApp doesn't do a whole lot. Phrased better, the article could have done a great job of explaining how to secure yourself and enable the messages, rather than just fear mongering.

Lets be honest. Facebook doesn't have a great privacy record. Theyre an advertising and data harvesting company. I basically trust them 0. But I trust Moxie a lot (its possible that he's been bought out by facebook/egyptian government for billions of dollars, but Im just gonna keep trusting him).

Honestly, Moxie saying that WhatsApp has a decent implementation of Signal does a lot more for my concerns than Facebook saying the exact same thing (though I too would love to know more about how much Moxie knows about whatsapp). I don't use whatsapp, but Im less prone to go "oh yeah, you def dont want to use that, its a facebook product!" like i would for skype/MS.

Its reassuring to know that if someone tried this, I could be notified of it, which means it seems like no one would really try this unless it was SUPER worth it (I dont think facebook is going to try to MITM and expose themselves so they can hear about my weekend drinking plans). So for common folk, I think it would be pretty safe. And if you are talking about things that require crazy opsec, definitely turn notifications on and verify those numbers.

Re: There is no WhatsApp 'backdoor'

#268

Post by abecedarius »

eternalban wrote: post #228
moxie wrote: post #207

Earlier quoted context omitted.

> This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. You've just d…

> That's probably going to be a fundamental limit of any application that serves billions of people from many different demographics all over the world. Moxie, some of us are of the opinion that [that] (implied) goal is certainly noble but ill-considered. Modern state surveillance has 2 general unstated goals: 1) Create an atmosphere of fear to affect self-censorship. Some states (such as China) announce this as a ma…

I don't understand. How is it misguided, and who is it a hazard to? Are you saying the unstated goals of state surveillance are good ones which conflict with popular use of crypto, and therefore popular use of crypto is bad?

Re: There is no WhatsApp 'backdoor'

#269

Post by gsylvie »

moxie wrote: post #237
rndgermandude wrote: post #220

Earlier quoted context omitted.

> The notification that you see in WhatsApp, Signal, SSH, PGP, or whatever is the defense. That defense, which happens to be the only defense, is turned off by default in WhatsApp. You seem to argue they do so because it's bad UX to present such notification by default. That's - in my humble opinion - like suggesting browsers should turn off TLS chain errors by default because it's bad UX and just proceed with the co…

> That defense, which happens to be the only defense, is turned off by default in WhatsApp. > You seem to argue they do so because it's bad UX to present such notification by default. That's - in my humble opinion - like suggesting browsers should turn off TLS chain errors by default because it's bad UX and just proceed with the connection as if nothing happened... One thing we've learned over the years is that secur…

At one of my jobs the network team uses a thing called "Forcepoint's TLS inspection" (aka Websense) (aka Raytheon). My browser happily let's that network team MITM me all day long without a peep, and logs & archives all my TLS traffic for who knows how long.

The funny thing is a VM I setup from my same laptop tried to make an https:// connection and the browser outright refused, without any possible workaround until I imported the Forcepoint CA cert.

Security people must love us users so bad. Love you, too! xox

(Note: the same network team imaged the laptop in the first place, and it's against my contract to re-image it. Hence the Forcepoint CA cert's presence in my browser's root chain. I prefer to call this LAN-In-The-Middle.)

Re: There is no WhatsApp 'backdoor'

#270

Post by ncallaway »

eternalban wrote: post #228
moxie wrote: post #207

Earlier quoted context omitted.

> This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. You've just d…

> That's probably going to be a fundamental limit of any application that serves billions of people from many different demographics all over the world. Moxie, some of us are of the opinion that [that] (implied) goal is certainly noble but ill-considered. Modern state surveillance has 2 general unstated goals: 1) Create an atmosphere of fear to affect self-censorship. Some states (such as China) announce this as a ma…

I am not convinced of the conclusion you've drawn based on the things you've outlined.

Would you mind elaborating on your chain of reasoning a little bit further?

Post reply on HN