Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp is broken, really broken

fileperms.org

Post reply on HN
Print view View original

71–80 of 137 posts

Re: WhatsApp is broken, really broken

#71

Post by UnoriginalGuy »

gsibble wrote: post #4

I've been seriously considering creating a highly secure text messaging replacement. I'm aware of TextSecure but find it lacking (and only available on Android). I'd love to hear if you guys think it would be a worthwhile project.

You could make one but the audience would have almost no cross-over with WhatsApp.

Your app would have a nice geeky audience of tech nerds who would drool over how secure it is and how smart they are.

WhatsApp on the other hand "just works." It requires zero setup, zero technical understanding, and is available on almost every platform (at least the "biggies" anyway).

I would say its audience is teenagers, and the less tech savvy consumer in general. I cannot see them wanting to switch to something else unless you make come up with a USP which appeals to them (i.e. security is not a USP that they're interested in).

Re: WhatsApp is broken, really broken

#72

Post by UnoriginalGuy »

rjzzleep wrote: post #67

seriously though, why does it have to send the whole contact list EVERY time? you close whatsapp remove the contact list permission, open it again, surprise, it won't work. -_-

I presume because the list of potential people who you could connect to might change.

I guess they could re-scan it on a schedule but that wouldn't solve your issue and might annoy their user base who are using it because it "just works."

Plus removing a permission isn't something any app supports that I am aware of. It isn't even something you're meant to be able to do on Android.

Re: WhatsApp is broken, really broken

#74

Post by tobias3 »

grk wrote: post #3

So, what's the best alternative?

Google Talk, Facebook messenger, ... then it is not even dependent on the mobile phone number. And I like being able to type the messages if I have a keyboard and not just my mobile phone. I cannot understand why everybody uses WhatsApp.

Re: WhatsApp is broken, really broken

#75

Post by gsibble »

UnoriginalGuy wrote: post #71
gsibble wrote: post #4

I've been seriously considering creating a highly secure text messaging replacement. I'm aware of TextSecure but find it lacking (and only available on Android). I'd love to hear if you guys think it would be a worthwhile project.

You could make one but the audience would have almost no cross-over with WhatsApp. Your app would have a nice geeky audience of tech nerds who would drool over how secure it is and how smart they are. WhatsApp on the other hand "just works." It requires zero setup, zero technical understanding, and is available on almost every platform (at least the "biggies" anyway). I would say its audience is teenagers, and the le…

Those are basically the same thoughts that I had. Security is not enough of a concern for most of the market. I wouldn't built it as a commercial product, but basically as art for those of us who value privacy.

That said, I think the number of people concerned with message privacy is on the rise around the world. Over a few years, the market may grow significantly as privacy receives more attention.

Re: WhatsApp is broken, really broken

#77

Post by hwatson »

truncate wrote: post #59
morsch wrote: post #25

No mention of this on their blog (in fact, no new posts since July). And no quick patch that pops up a box asking the user to assign a password. Since it's tied to a phone number/SIM card anyway, you could easily offer a password retrieval option via SMS. I wonder what happens if a phone number (the login) is tied to a different IMEI (the password). This can happen when you transfer a phone number from one provider t…

> I wonder what happens if a phone number (the login) is tied to a different IMEI I think they send verification code to the phone via SMS or ask your permission to make a call and speak the verification code.

Yep. You'll normally see this happen if you restore an iPhone backup onto another iPhone then try to launch WhatsApp. Login will fail and you'll be asked to type in the SMS received.

Re: WhatsApp is broken, really broken

#78

Post by andrewljohnson »

danso wrote: post #31
jneal wrote: post #22

Earlier quoted context omitted.

My opinion - something so trivial as private data sent in plaintext isn't a bug or a security hole, it's bad by design. You shouldn't have to notify someone they've designed their app poorly. If he was taking advantage of a security hole, or something of that nature that wouldn't already be known to the developers, then I could see notifying them before publishing.

This is an excellent point. Fixing a design flaw this inherent is going to take more than a weekend of frantic dev time. It could conceivably take weeks to implement an overhaul to their framework, all the while the users are vulnerable.

They could theoretically take the app down, or issue a warning to users.

On the other hand, this article does little to alert users, while blithely informing techies, some of whom are likely to be hackers of some order.

Re: WhatsApp is broken, really broken

#79

Post by bvdbijl »

I was working on a better whatsapp api than the mess that is whatsapi, do not have enough time though. It's based in wazapp which has an actual implementation of the binary packed xmpp transfer mechanism they use. Might upload it if someone's interested, it seems broken right now though
Post reply on HN