WhatsApp backdoor allows snooping on encrypted messages • Hacker News Board

Re: WhatsApp backdoor allows snooping on encrypted messages

#331

Post by t0b » Sun, Jan 15, 2017, 1:49 AM UTC

ycmbntrthrwaway wrote: post #307

belovedeagle wrote: post #232

Earlier quoted context omitted.

You go read the article. The deciding factor is not whether the message has been delivered, but whether WhatsApp servers report to the device that the message has been delivered. There's nothing stopping them from claiming that no messages have been delivered and thus recovering all messages (as long as they had been preselected for false delivery reports) despite true delivery status.

> but whether WhatsApp servers report to the device that the message has been delivered It is hard to check what WhatsApp does, but in Signal it is not the server, but a recipient who sends delivery receipt. WhatsApp then has to either recognize encrypted receipts or allow only one-way conversation during attack. Carrying out the whole attack just to decrypt "hi, are you here?" is not really interesting.

The delivery receipt is the message that is directly sent after the message has been delivered. Not too hard to distinguish those from other text messages.

Re: WhatsApp backdoor allows snooping on encrypted messages

#332

Post by Johnny_Brahms » Tue, Jan 17, 2017, 8:48 AM UTC

foxylion wrote: post #214

Johnny_Brahms wrote: post #197

Earlier quoted context omitted.

All messages, sent while a person is offline. It is bad, but not nearly as bad as "all messages"

It is in fact all messages. They can simply not deliver the first message and force a resend record that mesaage. Afterwards force again a resend with the old encryption key and deliver that mesaage. No one would get a notification.

Well, what you are describing is a regular MITM attack. Unless you validate fingerprints, this is a risk with _all_ public key-based protocols.

Re: WhatsApp backdoor allows snooping on encrypted messages

#333

Post by Vertirigian5 » Thu, Jan 19, 2017, 6:39 PM UTC

My wife use to be a big time cheat,and i was curious of getting proofs about it for real then i saw recommendations about mastershield55@gmail.com online and never hesitated to contact him,He asked me for some few information about my wife mobile device no personal info was asked for also,i provided it all to him and in less than 24 hours i was getting too see my wife text messages,call logs and as well as whats app messages as they come into his phone,i was able to get good and solid proof for my Antony to file a divorce,if you are having similar issues i would advice you contact mastershield55@gmail.com tell him Vertrigian Davison referred you.

Re: WhatsApp backdoor allows snooping on encrypted messages

#334

Post by Jarwain » Tue, Jan 24, 2017, 9:38 AM UTC

ycmbntrthrwaway wrote: post #308

Jarwain wrote: post #277

Earlier quoted context omitted.

So they can recover the messages, right? However, wouldn't these messages still be encrypted? Sure, they force a key change, and the messages are encrypted using the new key and sent. Theoretically, an attacker could have multiple copies of the same message, but these messages would still be encrypted under a variety of different keys right? Wouldn't the content of the messages still be secure? Unless the key-change…

New encryption (public) key is selected by the attacker, so he knows the decryption (private) key. Basically attacker just puts real device offline and registers his own device.

Wouldn't the attacker need to be authenticated as the user of the real device for this to work?