Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp is broken, really broken

fileperms.org

Post reply on HN
Print view View original

11–20 of 137 posts

Re: WhatsApp is broken, really broken

#11

Post by paulgb »

andrewljohnson wrote: post #8

Did the author email the WhatsApp team to give them any chance to fix this before they splashed it across the internet for anyone to abuse? The article makes no mention of it, so I assume not. In my opinion, the obscurity peeled off by this expose did more to endanger WhatsApp users than the bad programming. So, I can only conclude this post's main goal is page views. OP could easily warn them, and at least wait unti…

The disclosure was previously published on Sept 5 (OP links to it)

http://samgranger.com/whatsapp-is-using-imei-numbers-as-pass...

Re: WhatsApp is broken, really broken

#12

Post by morsch »

aw3c2 wrote: post #2

Sadly, normal free Jabber/XMPP does not seem to be a viable alternative. On Android, sure (though the clients are not too great at reconnecting/noticing-connection-loss/reporting-message-reception) but on iOS apparently you cannot run such things in the background. At least the situation was dire when I tried to convince some iOS friends to use XMPP instead of SMS last winter. http://monal.im/ looked most promising b…

You could run the real XMPP client on a server and use the native push messaging system to wake up the mobile client. This would also enable receiving "offline" messages while the mobile device is not on a network or turned off.

Of course, this would let the person operating the "real" XMPP client read your messages; but the person operating the XMPP server can do that already, so there isn't any real change -- either way you should be using OTR messaging at all times.

In the peer to peer spirit of XMPP, such a project should make it really easy to run this virtual client yourself locally or on a cheap cloud server. Maybe something like that exists already? Anybody wanna build it?

Re: WhatsApp is broken, really broken

#13

Post by ollysb »

I'd have thought a large majority of what's app users use it for chatting. I can't imagine they're particularly fussed about people sniffing their plans for meeting up that night. There are varying requirements for security...

Re: WhatsApp is broken, really broken

#14

Post by msh »

gsibble wrote: post #4

I've been seriously considering creating a highly secure text messaging replacement. I'm aware of TextSecure but find it lacking (and only available on Android). I'd love to hear if you guys think it would be a worthwhile project.

Skype would be a decent bet.

Re: WhatsApp is broken, really broken

#15

Post by dllthomas »

andrewljohnson wrote: post #8

Did the author email the WhatsApp team to give them any chance to fix this before they splashed it across the internet for anyone to abuse? The article makes no mention of it, so I assume not. In my opinion, the obscurity peeled off by this expose did more to endanger WhatsApp users than the bad programming. So, I can only conclude this post's main goal is page views. OP could easily warn them, and at least wait unti…

In this case, I think I disagree. A lot of this not just easy for an attacker to find - it is trivially easy for an attacker to find. Letting people know their communications are vulnerable is important, and it's not like they don't have plenty of alternatives.

Re: WhatsApp is broken, really broken

#16

Post by [deleted] »

andrewljohnson wrote: post #8

Did the author email the WhatsApp team to give them any chance to fix this before they splashed it across the internet for anyone to abuse? The article makes no mention of it, so I assume not. In my opinion, the obscurity peeled off by this expose did more to endanger WhatsApp users than the bad programming. So, I can only conclude this post's main goal is page views. OP could easily warn them, and at least wait unti…

[deleted]

Re: WhatsApp is broken, really broken

#18

Post by dromidas »

dllthomas wrote: post #15
andrewljohnson wrote: post #8

Did the author email the WhatsApp team to give them any chance to fix this before they splashed it across the internet for anyone to abuse? The article makes no mention of it, so I assume not. In my opinion, the obscurity peeled off by this expose did more to endanger WhatsApp users than the bad programming. So, I can only conclude this post's main goal is page views. OP could easily warn them, and at least wait unti…

In this case, I think I disagree. A lot of this not just easy for an attacker to find - it is trivially easy for an attacker to find. Letting people know their communications are vulnerable is important, and it's not like they don't have plenty of alternatives.

Just because a skilled attacker can trivially find the information, doesn't mean that the 15 year old kid living next door to you can find it. Now they can.

The problem doesn't stem from giving information to "l33t hax0rz" but rather providing the key information that can be abused by anyone with a computer and half a brain. They are the ones more likely to make use of it in a widespread and destructive manner.

But with that said, most developers don't care if you tell them this stuff directly since it's simply information and not a proof of concept. Until someone starts using it and shows them that its actually a problem that is affecting their product they usually write it off as paranoia.

Re: WhatsApp is broken, really broken

#19

Post by zachalexander »

OT, but I'm intrigued by their business model.

I don't know the history, but currently, the Android app is free, and it says the use of the service is free for the first year, then will be $0.99 per year after that.

Meanwhile, the iOS app is $0.99 straight up.

Thoughts:

(a) "Free for a year, $1/year after that" seems like an awful long time to wait for a payday, but if it works, and you get lots of free users, I bet you get more conversions in the long run than with a normal free/pro app business model.

(b) "Free in one store, paid in the other" is an interesting idea. If you can build up a large userbase of free Android users, and it's an inherently social app, your free Android users will tell their friends on iOS devices to get the app so they can communicate. They probably don't even know it's not free. It's like unintentional affiliate marketing.

(c) I realize (b) might not be an intentional choice by the developers, but a necessity due to the App Store perhaps not supporting pricing schemes like the one in (a).

Re: WhatsApp is broken, really broken

#20

Post by vvhn »

aw3c2 wrote: post #2

Sadly, normal free Jabber/XMPP does not seem to be a viable alternative. On Android, sure (though the clients are not too great at reconnecting/noticing-connection-loss/reporting-message-reception) but on iOS apparently you cannot run such things in the background. At least the situation was dire when I tried to convince some iOS friends to use XMPP instead of SMS last winter. http://monal.im/ looked most promising b…

imo.im on iOS works perfectly fine with google talk and i receive messages when it's not running as well.
Post reply on HN