Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There is no WhatsApp 'backdoor'

whispersystems.org

Post reply on HN
Print view View original

401–410 of 437 posts

Re: There is no WhatsApp 'backdoor'

#401

Post by litetime »

bisby wrote: post #267
jMyles wrote: post #246

Earlier quoted context omitted.

Moxie, I think it's fair to say that you are the world thought leader on these matters right now. One thing that the rest of us are wondering right now is: > I've been impressed with the level of care that WhatsApp has given to that requirement. To what degree do you really know that? Is there a place where we can read about your interactions with Facebook, the level of access they've given you, and the degree to whi…

> But there are nuances here that are important, and fleshing them out is a big part of what this community is about. The entire point of the crypto community is to maintain as little trust as possible unless you can be highly certain about things. The media reaction to "OMG WHATSAPP IS FOR SURE NOT SAFE" is a HUGE over reaction. But in an industry where audits and open source are huge factors in trust... WhatsApp do…

> But I trust Moxie a lot

What does trust have to do with this? The trade-off has been clearly explained. As it stands, WhatsApp is great for protecting sexts and low value conversations if you're not famous (99.99% of everyone), but if you're snowden, or hillary, there is no protection - contrary to what has been advertised.

Re: There is no WhatsApp 'backdoor'

#402

Post by lisper »

FabHK wrote: post #400
lisper wrote: post #384

Earlier quoted context omitted.

I'm not sure I understand what you mean by that. Do you mean that people think that it doesn't matter what language code is written in as long as it is open source? I certainly don't believe that. It's pretty clear to me that C is a terrible language for writing secure code. (But coming up with something that is actually better than C is not so easy.)

All agree that higher level (e.g. C) is easier to reason about than lower level (assembly). Now, you say that open source (e.g. C) is not only easier, but qualitatively different: open source good, closed source bad. tptacek points out: higher level (e.g. Haskell) is easier to reason about than lower level (e.g. C) - maybe even qualitatively . So, why are people only complaining about closed source, when they should…

For what it's worth, I complain about code written in C too.

Re: There is no WhatsApp 'backdoor'

#405

Post by t0b »

FabHK wrote: post #356
akvadrako wrote: post #126

Earlier quoted context omitted.

It's also not clear that the server must forward all the delivery receipts before it forwards the later replies. Could it just eat them all? EDIT: after a quick look at the spec¹, it seems that it supports out-of-order messages, meaning the server could selectively eat receipts. [1] https://whispersystems.org/docs/specifications/doubleratchet...

So, given that, it would seem that a compromised server could pull a whole conversation (if people overlook the single tick mark), as claimed in the article?

seems like it, yes

Re: There is no WhatsApp 'backdoor'

#406

Post by t0b »

FabHK wrote: post #105
FiloSottile wrote: post #94

Earlier quoted context omitted.

> It could also pass back Bob's answers, and so Alice could have what appears to be a normal conversation - except that Alice only sees single ticks, instead of double blue ticks. No, it can't do this, because Bob's answers contain the "delivery receipt". Hence, the attack doesn't work on conversations. EDIT to reply: messages are sequential and "delivery receipts" are messages, so it would be visible if the attacker…

Ah. If that is so (and it's not obvious - clearly you can get delivery or even read receipts without Bob sending an answer), then it would seem that a bad server could only intercept a long monologue, indeed, but not a conversation. (Greetings from HS F13 :)

you get "delivered" and "read" notifications before the recipient sends you a text response, so they must be independent.

Re: There is no WhatsApp 'backdoor'

#408

Post by yarou »

pvg wrote: post #331
yarou wrote: post #274

Earlier quoted context omitted.

> Why do you feel that there's no way to verify closed-source software? Isn't that the very definition of security through obscurity?

No. The security of WhatsApp is not dependent on it being closed source.

I'm not trying to be rude, but I think if you cannot see how closed-source software uses the model of security through obscurity, you may have a cognitive deficit of some kind. Again, I'm not trying to talk shit or be rude.

Re: There is no WhatsApp 'backdoor'

#409

Post by wglb »

yarou wrote: post #408
pvg wrote: post #331

Earlier quoted context omitted.

No. The security of WhatsApp is not dependent on it being closed source.

I'm not trying to be rude, but I think if you cannot see how closed-source software uses the model of security through obscurity, you may have a cognitive deficit of some kind. Again, I'm not trying to talk shit or be rude.

Regardless how the comment tries to work around it, cognitive deficit is in fact rude.

Re: There is no WhatsApp 'backdoor'

#410

Post by yarou »

wglb wrote: post #409
yarou wrote: post #408

Earlier quoted context omitted.

I'm not trying to be rude, but I think if you cannot see how closed-source software uses the model of security through obscurity, you may have a cognitive deficit of some kind. Again, I'm not trying to talk shit or be rude.

Regardless how the comment tries to work around it, cognitive deficit is in fact rude.

You didn't even bother to respond to the content of my post, rather you're more concerned with some weird sense of decorum.

We all have cognitive deficits, but it is not necessarily rude to point out when one's mental faculties are failing.

Post reply on HN