Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp end-to-end encrypted backups security assessment

research.nccgroup.com

Post reply on HN
Print view View original

81–90 of 121 posts

Re: WhatsApp end-to-end encrypted backups security assessment

#81

Post by wruza »

stef25 wrote: post #70
epolanski wrote: post #24

Earlier quoted context omitted.

Just imagine the world we live in, how numb average joe is. I said same things to most of my closer people and in the end they tell me “well they have all our data anyway”. And all they have to do is just download an application.

Isn't it more like changing email? You'd keep checking your old one for quite a while.

Email is much easier because of forwarding (or polling, in case an old service doesn’t have forwarding). I’m changing my main email every ten years or so and have few degenerate addresses like apple or yandex accounts which are dead but still attached to few orgs.

Messengers usually don’t have forwarding or a sensible polling interface. It would be nice to have all-in-one app even with limited functionality, since I’m mostly using text and images. Or use one of real full-featured messengers with gateways to others.

Re: WhatsApp end-to-end encrypted backups security assessment

#82

Post by bcraven »

rkoten wrote: post #41
WillSmithPro wrote: post #6

I came across this twitter thread during the last Facebook outage. Apparently something very wrong is happening there with their backups. I would definitely check similar cases. Confirmed by multiple people :/ I quote the author: This is really weird. In #WhatsApp, I started to see messages that I know 100% that I deleted 2 days ago?! WTF is happening there? I think this is a really big violation of privacy! I see th…

Durov posting about this in his Telegram channel in 3... 2... 1...

What is Durov and why is it relevant?

Re: WhatsApp end-to-end encrypted backups security assessment

#83

Post by rocqua »

baby wrote: post #45
WillSmithPro wrote: post #6

I came across this twitter thread during the last Facebook outage. Apparently something very wrong is happening there with their backups. I would definitely check similar cases. Confirmed by multiple people :/ I quote the author: This is really weird. In #WhatsApp, I started to see messages that I know 100% that I deleted 2 days ago?! WTF is happening there? I think this is a really big violation of privacy! I see th…

How is this a violation of privacy… that’s not how e2e encryption works.

e2e encryption does nothing about ensuring deletion. Whatsapp can simply re-deliver the same encrypted blob.

Re: WhatsApp end-to-end encrypted backups security assessment

#84

Post by wruza »

beermonster wrote: post #62
jakecopp wrote: post #15

Why on earth do people trust a closed source messenger owned by Facebook, which backs up to Google? Signal and Matrix are open source and full-featured.

I think Signal and Matrix are more trustworthy and auditable. However I also think more people are on WhatsApp than those two (and possibly more) combined and people want to just use it probably for that reason. I saw some of my contacts sign up to Signal firstly after the privacy fiasco then again in smaller quantity after the major outage. I deleted WhatsApp a while ago but I decided to re-install it again recently…

I tried signal among my close-y circle and we had no issue with nobody else there. But it didn’t stick because of how it looks and works. When I read reports like yours it feels like you don’t use all of the features, but what repelled us was not that inertia thing.

Re: WhatsApp end-to-end encrypted backups security assessment

#85

Post by jacquesm »

You can audit a browser based solution until the cows come home but unless you are willing to audit the code that was sent to you on each and every interaction you will never have any real security. I don't think browsers are a platform for secure communications based on code sent down the wire at run time, it is much too easy to replace that code by other code.

And that's before we get to Whatsapp == Facebook.

Re: WhatsApp end-to-end encrypted backups security assessment

#86

Post by jacquesm »

jensensbutton wrote: post #26
jakecopp wrote: post #15

Why on earth do people trust a closed source messenger owned by Facebook, which backs up to Google? Signal and Matrix are open source and full-featured.

Because the number of people who can actually validate the security of the open source options is vanishingly small and assessments like this provide sufficient evidence that WhatsApp's claims are not bunk.

> and assessments like this provide sufficient evidence that WhatsApp's claims are not bunk.

Actually, no that's not sufficient evidence. That's only sufficient evidence for those interactions between the auditors and whatsapp's servers, it doesn't say anything about your interaction with whatsapp's servers. And that's the heart of the problem: using code shipped to a browser for e2e encryption is a flawed model, it would be trivial to target you with a version that has broken e2e encryption but subtle enough that you would never notice.

Re: WhatsApp end-to-end encrypted backups security assessment

#87

Post by izacus »

rOOb85 wrote: post #55
AnonC wrote: post #48

Earlier quoted context omitted.

Are you saying it’s not getting enough credit or that it shouldn’t? The Signal code was closed source for longer than a year (from April 2020) when no commits were done in the public repo because . Some months ago the public repo got a barrage of commits after that long gap. It wasn’t that the Signal platform and client had no updates during this time. There were many, but the code wasn’t released. Signal may be open…

> The Signal code was closed source for longer than a year (from April 2020) This absolutely untrue. Signals source has NEVER been closed source. The Signal server source code(which isn't special and doesn't change that often) just had no public commits. The Signal client source code(what matters and makes Signal secure) was frequently updated. > Signal may be open source at times, Again, Signal has always been open…

> The Signal server source code(which isn't special and doesn't change that often) just had no public commits.

So it was opensource... you just couldn't see the source running on the servers? Yeah, makes sense. Right.

Re: WhatsApp end-to-end encrypted backups security assessment

#88

Post by GekkePrutser »

polyomino wrote: post #52
GekkePrutser wrote: post #46

Earlier quoted context omitted.

> Those are some of the few companies that are large enough to oppose government They're more likely to cooperate with governments because they have so much to lose. All the big guys are caving in to China for example because they don't want to lose that sweet 1+ billion consumer market. Yes even Google. Check maps.google.cn and see the border around the South China Sea. And also their interests are much more aligned…

Facebook is in china? News to me.

Facebook the service no. Facebook/Meta the company yes :)

Re: WhatsApp end-to-end encrypted backups security assessment

#89

Post by beermonster »

wruza wrote: post #84
beermonster wrote: post #62

Earlier quoted context omitted.

I think Signal and Matrix are more trustworthy and auditable. However I also think more people are on WhatsApp than those two (and possibly more) combined and people want to just use it probably for that reason. I saw some of my contacts sign up to Signal firstly after the privacy fiasco then again in smaller quantity after the major outage. I deleted WhatsApp a while ago but I decided to re-install it again recently…

I tried signal among my close-y circle and we had no issue with nobody else there. But it didn’t stick because of how it looks and works. When I read reports like yours it feels like you don’t use all of the features, but what repelled us was not that inertia thing.

I find this odd as how signal looks and works is one of the reasons I enjoy using it.

Can you highlight your collective pet peeves ?

Re: WhatsApp end-to-end encrypted backups security assessment

#90

Post by tzs »

WillSmithPro wrote: post #6

I came across this twitter thread during the last Facebook outage. Apparently something very wrong is happening there with their backups. I would definitely check similar cases. Confirmed by multiple people :/ I quote the author: This is really weird. In #WhatsApp, I started to see messages that I know 100% that I deleted 2 days ago?! WTF is happening there? I think this is a really big violation of privacy! I see th…

OT: I saw a similar thing (deleted messages returning) in Messages on MacOS a couple weeks ago, shortly after I upgraded to Monterey. A whole bunch of deleted messages from 2017 through 2019 returned. Nothing from earlier or later returned.

I mentioned this on Reddit and someone replied that they saw it too with hundreds of deleted messages going back to 2015 returning.

Post reply on HN