WhatsApp end-to-end encrypted backups security assessment
research.nccgroup.com
WhatsApp end-to-end encrypted backups security assessment
1–10 of 121 posts
Re: WhatsApp end-to-end encrypted backups security assessment
#2WhatsApps security used to rely on the signal protocol, a (fairly) open source protocol that you could implement and verify yourself (and I did).
It now has backups which rely on 'trusted' hardware security modules in Facebook's data centers.
That seems like a serious downgrade to me.
Re: WhatsApp end-to-end encrypted backups security assessment
#3WhatsApps security used to rely on the signal protocol, a (fairly) open source protocol that you could implement and verify yourself (and I did). It now has backups which rely on 'trusted' hardware security modules in Facebook's data centers. That seems like a serious downgrade to me.
Wrong.
1. Backups are opt-in - just as they have always been.
2. The E2EE backups do not rely on HSM's - they rely on a client-side only key derived by the WhatsApp client, on the user's phone.
3. The client-side key backup does not rely solely on HSM's - naturally, the client-side key must be backed up in case the user loses their phone. This key is itself encrypted and stored remotely (whether this is on third-party cloud or on WA servers is unclear from the report). However, decrypting it requires a user passphrase, known only to the user.
4. The design uses HSM's additively, not as the only support - via an OPAQUE exchange the user can combine their passphrase with a per-user secret stored in the HSM to derive, client-side, the key that unwraps the backup key. OPAQUE ensures WA cannot learn the user key material required to derive the key that unwraps the backup key.
This is all on page 6 of the published NCC report.
Re: WhatsApp end-to-end encrypted backups security assessment
#4WhatsApps security used to rely on the signal protocol, a (fairly) open source protocol that you could implement and verify yourself (and I did). It now has backups which rely on 'trusted' hardware security modules in Facebook's data centers. That seems like a serious downgrade to me.
You implemented the signal protocol and came to this (wrong) conclusion? I have a hard time believing that.
Re: WhatsApp end-to-end encrypted backups security assessment
#5[deleted]
Re: WhatsApp end-to-end encrypted backups security assessment
#6I came across this twitter thread during the last Facebook outage. Apparently something very wrong is happening there with their backups. I would definitely check similar cases. Confirmed by multiple people :/
I quote the author:
This is really weird. In #WhatsApp, I started to see messages that I know 100% that I deleted 2 days ago?! WTF is happening there? I think this is a really big violation of privacy! I see the messages from a month ago, with my disappearing messages setting turned on?! Gosh
https://twitter.com/pytlicek/status/1445072626729242637?s=21
Re: WhatsApp end-to-end encrypted backups security assessment
#7WhatsApps security used to rely on the signal protocol, a (fairly) open source protocol that you could implement and verify yourself (and I did). It now has backups which rely on 'trusted' hardware security modules in Facebook's data centers. That seems like a serious downgrade to me.
Wrong. 1. Backups are opt-in - just as they have always been. 2. The E2EE backups do not rely on HSM's - they rely on a client-side only key derived by the WhatsApp client, on the user's phone. 3. The client-side key backup does not rely solely on HSM's - naturally, the client-side key must be backed up in case the user loses their phone. This key is itself encrypted and stored remotely (whether this is on third-part…
Last time I looked at it, WhatsApp backup key was simply stored server side. Also, backup encryption key never changes, basically. I tell you this because I needed to extract an old backup that I did on Android years ago to recover some messages: well it was as simple as extracting the key from another phone where I was signed into (need root privileges, but of course you can just access the account from an emulator, insert the SMS code, recover the key and sign in again on the main phone), then the backup is easily decrypted. And no passphrase needed (and even if it is, how it would be difficult to brute force? Considering that users use the same password everywhere...)
This for local backups, but I assume that the encryption schema is the same for a backup on Google Drive (just the file that would be stored locally is uploaded into Google Drive in a non user accessible location).
By the way I don't care that much of backup secrecy, in fact I use mainly Telegram even if everything is on the server clear text. WhatsApp tries to give users a false sense of security in my opinion.
Re: WhatsApp end-to-end encrypted backups security assessment
#8WhatsApps security used to rely on the signal protocol, a (fairly) open source protocol that you could implement and verify yourself (and I did). It now has backups which rely on 'trusted' hardware security modules in Facebook's data centers. That seems like a serious downgrade to me.
Wrong. 1. Backups are opt-in - just as they have always been. 2. The E2EE backups do not rely on HSM's - they rely on a client-side only key derived by the WhatsApp client, on the user's phone. 3. The client-side key backup does not rely solely on HSM's - naturally, the client-side key must be backed up in case the user loses their phone. This key is itself encrypted and stored remotely (whether this is on third-part…
It may be my fault, but I have always set it to no backups, but 2am it'll more or less freeze with a "backing up..." message
Re: WhatsApp end-to-end encrypted backups security assessment
#9Clearly the key thing here is the security but I having used a backup to switch to a new phone recently, I was amazed at what an appallingly bad user experience it was - it got stuck multiple times (no fault of my own and no way to tell it to stop trying to hopelessly continue) and then you have to wait longer and longer each time to repeat it.
Re: WhatsApp end-to-end encrypted backups security assessment
#10WhatsApps security used to rely on the signal protocol, a (fairly) open source protocol that you could implement and verify yourself (and I did). It now has backups which rely on 'trusted' hardware security modules in Facebook's data centers. That seems like a serious downgrade to me.
Wrong. 1. Backups are opt-in - just as they have always been. 2. The E2EE backups do not rely on HSM's - they rely on a client-side only key derived by the WhatsApp client, on the user's phone. 3. The client-side key backup does not rely solely on HSM's - naturally, the client-side key must be backed up in case the user loses their phone. This key is itself encrypted and stored remotely (whether this is on third-part…
what's the threat this hsm is adding protection against ?
i don't mean to be ironic, i genuinely couldn't understand after reading the paper.