Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp end-to-end encrypted backups security assessment

research.nccgroup.com

Post reply on HN
Print view View original

91–100 of 121 posts

Re: WhatsApp end-to-end encrypted backups security assessment

#91

Post by richardwhiuk »

WillSmithPro wrote: post #6

I came across this twitter thread during the last Facebook outage. Apparently something very wrong is happening there with their backups. I would definitely check similar cases. Confirmed by multiple people :/ I quote the author: This is really weird. In #WhatsApp, I started to see messages that I know 100% that I deleted 2 days ago?! WTF is happening there? I think this is a really big violation of privacy! I see th…

The standard fix to this is to give each message a GUID, and then when you delete a message, instead of deleting it, your store a tombstone with the GUID, and that prevents a network re-send from causing the message to reappear.

Re: WhatsApp end-to-end encrypted backups security assessment

#92

Post by wruza »

beermonster wrote: post #89
wruza wrote: post #84

Earlier quoted context omitted.

I tried signal among my close-y circle and we had no issue with nobody else there. But it didn’t stick because of how it looks and works. When I read reports like yours it feels like you don’t use all of the features, but what repelled us was not that inertia thing.

I find this odd as how signal looks and works is one of the reasons I enjoy using it. Can you highlight your collective pet peeves ?

Sadly no, I should have written that down (a good habit I’ve only got later). But I have vague memories that some of the issues were very basic, like replying or images or chat handling, and that we mostly expressed the same concerns. It’s not unusable, but it just didn’t feel right as a whole.

It should also be noted that we are not privacy-critical, just like these “numb people” I believe, who choose over little details rather than a big picture. Our background at the time was whatsapp, telegram and viber.

Re: WhatsApp end-to-end encrypted backups security assessment

#93

Post by texasbigdata »

richardwhiuk wrote: post #91
WillSmithPro wrote: post #6

I came across this twitter thread during the last Facebook outage. Apparently something very wrong is happening there with their backups. I would definitely check similar cases. Confirmed by multiple people :/ I quote the author: This is really weird. In #WhatsApp, I started to see messages that I know 100% that I deleted 2 days ago?! WTF is happening there? I think this is a really big violation of privacy! I see th…

The standard fix to this is to give each message a GUID, and then when you delete a message, instead of deleting it, your store a tombstone with the GUID, and that prevents a network re-send from causing the message to reappear.

Sorry, what’s a tombstone? Like add a field that says “deleted”?

Re: WhatsApp end-to-end encrypted backups security assessment

#94

Post by texasbigdata »

authed wrote: post #65

I don't know why anyone would trust anything Facebook-related when it comes to privacy...

That’s exactly why maybe they would do this? They’re self aware of their reputation, try to go above and beyond to counter it, and then chose to publish a damning report against themselves in that effort.

Note, I hate Facebook, but there’s nothing worse than when someone/something tries to get better in good faith, and we shit on their efforts simply because their starting position is weak (aka fat shaming the new person at the gym).

Re: WhatsApp end-to-end encrypted backups security assessment

#96

Post by yrro »

WillSmithPro wrote: post #6

I came across this twitter thread during the last Facebook outage. Apparently something very wrong is happening there with their backups. I would definitely check similar cases. Confirmed by multiple people :/ I quote the author: This is really weird. In #WhatsApp, I started to see messages that I know 100% that I deleted 2 days ago?! WTF is happening there? I think this is a really big violation of privacy! I see th…

I don't think services should be allowed to mislead their users in this way. If 'delete message' does not delete the message then it should not be labelled as such.

The option should be labelled as 'Hide Message*' together with a link to an explanation of the feature & its limitations.

Re: WhatsApp end-to-end encrypted backups security assessment

#98

Post by rand49an »

beermonster wrote: post #89
wruza wrote: post #84

Earlier quoted context omitted.

I tried signal among my close-y circle and we had no issue with nobody else there. But it didn’t stick because of how it looks and works. When I read reports like yours it feels like you don’t use all of the features, but what repelled us was not that inertia thing.

I find this odd as how signal looks and works is one of the reasons I enjoy using it. Can you highlight your collective pet peeves ?

Just anecdotally Signal seems to be far less reliable when delivering messages and I've had a few crashes with the Android app.

Another very small thing, but it irks me slightly - the chat bubbles are rounded too much.

Re: WhatsApp end-to-end encrypted backups security assessment

#99

Post by jensensbutton »

jacquesm wrote: post #86
jensensbutton wrote: post #26

Earlier quoted context omitted.

Because the number of people who can actually validate the security of the open source options is vanishingly small and assessments like this provide sufficient evidence that WhatsApp's claims are not bunk.

> and assessments like this provide sufficient evidence that WhatsApp's claims are not bunk. Actually, no that's not sufficient evidence. That's only sufficient evidence for those interactions between the auditors and whatsapp's servers, it doesn't say anything about your interaction with whatsapp's servers. And that's the heart of the problem: using code shipped to a browser for e2e encryption is a flawed model, it…

Sure it's not sufficient to formally prove security of the system e2e, but i'd guess it's sufficient for the average user. As for shipping a client with broken encryption... Aren't people using Signal (like the person I originally responded to suggested) at risk of the same thing? Nobody's verifying checksums on every update except for people who aren't using WhatsApp for their comms anyway.

Re: WhatsApp end-to-end encrypted backups security assessment

#100

Post by intricatedetail »

richardwhiuk wrote: post #91
WillSmithPro wrote: post #6

I came across this twitter thread during the last Facebook outage. Apparently something very wrong is happening there with their backups. I would definitely check similar cases. Confirmed by multiple people :/ I quote the author: This is really weird. In #WhatsApp, I started to see messages that I know 100% that I deleted 2 days ago?! WTF is happening there? I think this is a really big violation of privacy! I see th…

The standard fix to this is to give each message a GUID, and then when you delete a message, instead of deleting it, your store a tombstone with the GUID, and that prevents a network re-send from causing the message to reappear.

Or store message encrypted and corresponding key, then just delete the key.
Post reply on HN