Israel has some companies who are really good at this. I recall a story about the Saudis purchasing service from some Israeli companies to spy on other's cellphones.
NSO hacked WhatsApp to spy on top government officials at U.S. allies
101–110 of 321 posts
Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies
#102Earlier quoted context omitted.
That's reasonable, I suppose I'm lucky to have a friend group that universally prefers open source sorftware to good UX -- there was never really a question for us.
It's a little eye opening to me that anyone could have a friend group that "universally prefers open source software to good UX". I have and use Signal with some friends, but there are also loads of people I communicate with who couldn't even tell you what open source software is, let alone articulate a preference for it over good UX. Are all of your friends software engineers and/or technophiles?
I don't have many friends, TBH. I've got 2 friends who use normal SMS, and a group of 6 friends (not including myself) who use Signal; of those, three of them are software developers and one of them uses R at work though software development isn't her primary job. The other two are probably more aware of open source software than they would otherwise be due to peer exposure. It's also worth noting that one of my developer friends got the rest of us into programming, though three of us had been running Linux before that -- it's not that I've disproportionately made friends with software developers, it's that a group of people I'd been hanging out with for years assimilated a software developer who converted the rest of us. There may have been some MDMA involved in that.
Edit in case of potential ambiguity: s/a couple of/2
Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies
#103The article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd love to read a post-mortem in a few months. Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books "encrypte…
A buddy of mine is Special Forces (U.S.). He said JSOC recently banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app). Allegedly WhatsApp uses Signal's encryption (OpenWhisper) but I stopped trusting it the second Facebook bought them out.
If one assumes that WhatsApp are implementing the protocol as well as signal are (which I do), then I think there are three questions in deciding what is more secure:
1. Do you trust Facebook (or open whisper systems) with your metadata/expect them to delete it?
2. How likely are there to be bugs (in the app, not in the protocol itself) which lead to exploits. On the one hand WhatsApp probably have more people working on the app and likely more security people too. On the other hand they may be pushed to add more features and having lots of code churn may introduce security holes.
3. How much work will be put into exploiting each app. On the one hand more people use WhatsApp but on the other, I guess security conscious people may be more likely to use signal.
A known exploit to WhatsApp happened due to 2 with a bug in how audio calls were initiated. I don’t really have a good guess as to how the apps compare on points 2 and 3 but I guess WhatsApp loses on 1. A more practical point is that it’s likely easier to convince someone to use WhatsApp than signal, especially for group chat.
Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies
#104What are Israel doing to get so good at this and chip design and weapons making and everything else they seem to be really good at?
There’s only about 8 million people in the whole country. There are plenty of cities with more people than that.
How come they punch so far above their weight?
Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies
#105Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies
#106The article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd love to read a post-mortem in a few months. Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books "encrypte…
Based on the U.K. news, approximately everyone in parliament uses WhatsApp to talk/scheme with one another
Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies
#107The article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd love to read a post-mortem in a few months. Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books "encrypte…
A buddy of mine is Special Forces (U.S.). He said JSOC recently banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app). Allegedly WhatsApp uses Signal's encryption (OpenWhisper) but I stopped trusting it the second Facebook bought them out.
> Allegedly WhatsApp uses Signal's encryption (OpenWhisper
About the partnership: https://signal.org/blog/whatsapp-complete/
But of course, in this case the issue seems to be either compromise of the device(s) via zero days, whatsapp usage simply being the target matrix - and/or a leveraging a zero day in whatsapp for full device compromise.
It's unlikely signal would be immune - they didn't Crack the encryption, they cracked the app/os.
In olden times the vector might have been a font, or a gif.
The only advantage signal has is a conservative interface and small userbase. I'm not sure if they do some kind of hard-line whitelisting of attachments though - if you can pack an exploit as a file, I'm pretty sure you could send it via signal.
Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies
#108Sometimes you just feel like using Signal instead
I mean, Signal is open source and not owned by Facebook, so I'm not sure why anybody uses WhatsApp instead.
People use it because other people use it.
Signal's lack of a web interface is another reason.
Moreover, Telegram took the users that left WhatsApp for more secure alternatives (even though Telegrams homemade encryption doesn't look promising).
Same reasons why a lot of people don't leave Facebook.
Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies
#109Earlier quoted context omitted.
Not that I'm dissing Signal (it is my preferred platform, sadly not most used), but don't both WA and Signal use Open Whispers systems? So isn't there the potential that the same exploit might work on Signal?
WhatsApp allegedly uses an implementation of the OpenWhisper encryption system that Signal created (and still uses). However as there is no source code available unlike Signal, there's no way to verify if WhatsApp "really" is using it (or using it correctly).
Is there a way to verify that the Signal app in the app store was compiled from the published Signal sources?
Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies
#110Earlier quoted context omitted.
That's reasonable, I suppose I'm lucky to have a friend group that universally prefers open source sorftware to good UX -- there was never really a question for us.
It's a little eye opening to me that anyone could have a friend group that "universally prefers open source software to good UX". I have and use Signal with some friends, but there are also loads of people I communicate with who couldn't even tell you what open source software is, let alone articulate a preference for it over good UX. Are all of your friends software engineers and/or technophiles?
Exactly.
When all your friends are already using Facebook and you start telling them to use Signal instead... well, I can tell you from experience that it's almost impossible to break the status quo.
What has happened to me is that usually there's 1-2 persons from each friend group who care enough that they will relay information to you through Signal.
I still don't have a friend group that is 100% Signal. For that to happen, more than 50% of the group would need to care enough about privacy to completely abandon other communication channels and accept the cost of switching platforms. The rest would probably follow. In reality, I don't have a single non-tech friend who would give a fuck about encryption. You tell them about Signal and they go "cool", that's it.