Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There is no WhatsApp 'backdoor'

whispersystems.org

Post reply on HN
Print view View original

271–280 of 437 posts

Re: There is no WhatsApp 'backdoor'

#271

Post by ncallaway »

smartbit wrote: post #261
mos_basik wrote: post #106

Earlier quoted context omitted.

And - as the article describes - such a blocking mode would immediately expose to WhatsApp which users had not enabled it, and who would therefore be safe(er) to MITM (because they probably don't verify key changes in any meaningful way).

why? The UI on the receiver end could show the warning, not the message, and in the dialog to the Whatsapp systems behave normally. In that way the user would be notified of rekeying, the MITM attacker wouldn't be notified that the user is security consious.

t0: Client A sends message (1) to Server for Client B

t1: Server sends message (1) to Client B

t2: Client B fails to decode message (1) due to an outdated key. Sends failure notification to Server

t3: Server sends rekey notification to Client A

t4: (usually 1 second) Client A sends rekeyed message (1') to Server for Client B

For t4, if the Server notices the response from Client A came faster than a user could ever have seen and responded to a notification, it now knows Client A is more susceptible to a MitM attack. If, on the other hand, Client A takes an appreciable amount of time to send the rekeyed message (say, 1 second or more) then we know that either there was a network latency, or the user had to respond to a rekey notification before the message was resent. We should be more careful about launching a MitM attack on this class of user.

So, without changing the actual _actions_ that the Server sees, but just the pattern of the timing of those actions, we're still leaking important information.

Note: all numbers completely made up.

Re: There is no WhatsApp 'backdoor'

#272

Post by gwu78 »

ploxiln wrote: post #74
tucif wrote: post #22

Earlier quoted context omitted.

He does address this: Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. That means a user is able to verify visually that the end-to-end is working. "users might not notice" doesn't seem to me as a strong argument to state this as a backdoor. This would imply not noticing that you don't have a green padlock on chrome is a backdoor too, and it clearly is not.

The "green padlock" was not considered enough because users would not be able to differentiate it from a big lock symbol within the page. Thus we got HSTS. (There was a time when browsers would color the entire URL bar yellow to indicate https, but that went out of favor many years ago.) Moxie deserves respect for the web vulnerabilities he discovered and raised awareness about years ago, and for his general competen…

It sounds like you are saying this project's true motivating objective is to advance the author's personal beliefs about "UX" and to see wide adoption of this philosophy as embodied in some particular software. That he chose to use a large, politically-connected, centralized social media^W^W ad sales company as a distribution channel ensuring wide adoption by default. And that the author would make any trade-off in order to see wide adoption.

Should we be surprised?

If I am not mistaken the crytography here is compliments of djb. (Best "UX" designer ever, IMHO.)

The Signal author's contribution is only a protocol and some "UX". His programming language of choice was Java.

Re: There is no WhatsApp 'backdoor'

#274

Post by yarou »

tptacek wrote: post #78
avn2109 wrote: post #40

Earlier quoted context omitted.

Regardless of the merit of this specific accusational-and-denial cycle, the fact remains that Whatsapp is closed source crypto and there is no way in principle for the user to verify any security claims. I happen to trust Moxie's principles, but not as much as I distrust the relationship-with-government imperatives implied by FB's vast business interests.

There's "no way in principle"? How is this whole story not evidence to the contrary? The person who found this didn't use WhatsApp source code. Why do you feel that there's no way to verify closed-source software?

> Why do you feel that there's no way to verify closed-source software?

Isn't that the very definition of security through obscurity?

Re: There is no WhatsApp 'backdoor'

#276

Post by _Codemonkeyism »

moxie wrote: post #207
rndgermandude wrote: post #170

Earlier quoted context omitted.

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just chec…

> This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. You've just d…

"keys or who has enabled a setting to see key change notifications."

If everyone has enabled by default this setting, the server can't detect who has enabled it on purpose(because everyone has enabled it), or not?

Re: There is no WhatsApp 'backdoor'

#277

Post by dleslie »

Saavedro wrote: post #264
Veratyr wrote: post #244

Earlier quoted context omitted.

> Key changes in a messenger are totally different. They happen under normal conditions This doesn't have to be the case. If you stop coupling a key to a device and instead couple a key to a person (generating a key deterministically from a password for example), they can be changed far more rarely.

this requires humans to be able to generate and remember passwords with decent entropy

Pass phrases.

Re: There is no WhatsApp 'backdoor'

#278

Post by likeclockwork »

abecedarius wrote: post #268
eternalban wrote: post #228

Earlier quoted context omitted.

> That's probably going to be a fundamental limit of any application that serves billions of people from many different demographics all over the world. Moxie, some of us are of the opinion that [that] (implied) goal is certainly noble but ill-considered. Modern state surveillance has 2 general unstated goals: 1) Create an atmosphere of fear to affect self-censorship. Some states (such as China) announce this as a ma…

I don't understand. How is it misguided, and who is it a hazard to? Are you saying the unstated goals of state surveillance are good ones which conflict with popular use of crypto, and therefore popular use of crypto is bad?

I THINK the commenter was saying that "serving billions of people from many different demographics all over the world" is inviting all of those different people together so you can betray them all at once.

Re: There is no WhatsApp 'backdoor'

#279

Post by sfifs »

jMyles wrote: post #5

Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…

Look if WhatsApp wants to read your messages without you detecting, there's nothing you can really do to prevent it apart from not using WhatsApp.

For instance if you're on some list for message interception, they can give you MITMed keys when you first login. Or they can insert some subtle signal that tells the app on your specific phone to ignore key changes and avoid showing notification in some way you would struggle to check (closed source and obfuscated code) etc etc. They could even show you the right key if you attempt verification but use a compromised one for communication. This particular vuln. would be a ridiculously crude way to intercept messages.

In any closed source system where key distribution and message distribution are centralized, there is no way to protect against the service provider - and anyone who co-opts the service provider (eg. with a court order). The objective of the encryption is to protect against other actors snooping on you

Re: There is no WhatsApp 'backdoor'

#280

Post by ComodoHacker »

eternalban wrote: post #228
moxie wrote: post #207

Earlier quoted context omitted.

> This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. You've just d…

> That's probably going to be a fundamental limit of any application that serves billions of people from many different demographics all over the world. Moxie, some of us are of the opinion that [that] (implied) goal is certainly noble but ill-considered. Modern state surveillance has 2 general unstated goals: 1) Create an atmosphere of fear to affect self-censorship. Some states (such as China) announce this as a ma…

I think you are wrong. When only a small portion of the population can use end-to-end encryption in their day-to-day communications, a state can declare it (e2e enc.) "suspicious" and achieve both goals far more easier.
Post reply on HN