WhatsApp is broken, really broken • Hacker News Board

Re: WhatsApp is broken, really broken

#81

Post by jjcm » Fri, Sep 14, 2012, 9:48 PM UTC

UnoriginalGuy wrote: post #71

gsibble wrote: post #4

I've been seriously considering creating a highly secure text messaging replacement. I'm aware of TextSecure but find it lacking (and only available on Android). I'd love to hear if you guys think it would be a worthwhile project.

You could make one but the audience would have almost no cross-over with WhatsApp. Your app would have a nice geeky audience of tech nerds who would drool over how secure it is and how smart they are. WhatsApp on the other hand "just works." It requires zero setup, zero technical understanding, and is available on almost every platform (at least the "biggies" anyway). I would say its audience is teenagers, and the le…

Alternately, you could just create a third party client for WhatsApp that uses an actual password. The issue with WhatsApp is on the client end, which you can control.

Re: WhatsApp is broken, really broken

#82

Post by css771 » Fri, Sep 14, 2012, 9:55 PM UTC

jrajav wrote: post #52

zachalexander wrote: post #19

OT, but I'm intrigued by their business model. I don't know the history, but currently, the Android app is free, and it says the use of the service is free for the first year, then will be $0.99 per year after that. Meanwhile, the iOS app is $0.99 straight up. Thoughts: (a) "Free for a year, $1/year after that" seems like an awful long time to wait for a payday, but if it works, and you get lots of free users, I bet…

Even more OT, but Angry Birds is $0.99 on iOS and free (with ads) on Android to this day: https://www.google.com/search?&q=angry+birds+android+OR+... Just the nature of the different app ecosystems, really.

That has changed recently. With the recent Angry Birds Space, they have a 'premium' option for 0.99 and it has a healthy 500,000-1,000,000 downloads.

Re: WhatsApp is broken, really broken

#83

Post by flatline3 » Fri, Sep 14, 2012, 10:00 PM UTC

HorizonXP wrote: post #65

andrewljohnson wrote: post #8

Did the author email the WhatsApp team to give them any chance to fix this before they splashed it across the internet for anyone to abuse? The article makes no mention of it, so I assume not. In my opinion, the obscurity peeled off by this expose did more to endanger WhatsApp users than the bad programming. So, I can only conclude this post's main goal is page views. OP could easily warn them, and at least wait unti…

A friend of mine works for WhatsApp. I tried bringing the original article to his attention, but it went down that day. I've linked him to both articles now. I agree about the need to disclose such security issues to the authors privately. While I understand the sentiment of others, that it's such an inherent issue in their design that it'll take time to fix, that's not really a reason to not give them a chance. If i…

The pitchforks are out because this demonstrates complete incompetence on their part.

Re: WhatsApp is broken, really broken

#84

Post by minikomi » Fri, Sep 14, 2012, 10:29 PM UTC

zachalexander wrote: post #19

OT, but I'm intrigued by their business model. I don't know the history, but currently, the Android app is free, and it says the use of the service is free for the first year, then will be $0.99 per year after that. Meanwhile, the iOS app is $0.99 straight up. Thoughts: (a) "Free for a year, $1/year after that" seems like an awful long time to wait for a payday, but if it works, and you get lots of free users, I bet…

NAVER Line is also currently killing it in this space in Japan, Korea and other nearby places.. Their business model started as "free but sell extra stickers to send to your friends", but now they have critical mass it seems they're setting up some kind of social network.. But a piece at a time by making an app at a time. Their Photo sharing app is gaining ground, as is their "diary" (read: timeline) app.

Re: WhatsApp is broken, really broken

#85

Post by koski » Fri, Sep 14, 2012, 10:34 PM UTC

I'm a "open source guy". Very picky to pay of Anything.

I use the mentioned app with my Lady every day because it works so well on her iPhone too. The easy of sending photoes is just pure awesome. Never failed (during one year). It works so well I don't hesitate a second to pay a dollar of it when it asks for it.

Ps. Drunk in a bar and a regular guy next me agrees who did not agree on punch of other stuff.

Re: WhatsApp is broken, really broken

#86

Post by koski » Fri, Sep 14, 2012, 10:43 PM UTC

koski wrote: post #85

I'm a "open source guy". Very picky to pay of Anything. I use the mentioned app with my Lady every day because it works so well on her iPhone too. The easy of sending photoes is just pure awesome. Never failed (during one year). It works so well I don't hesitate a second to pay a dollar of it when it asks for it. Ps. Drunk in a bar and a regular guy next me agrees who did not agree on punch of other stuff.

Pps. yes. Ofcourse the dude next to me did not know about the possible problems the auther mentions. Which ofcourse is an issue.

How to explain to a "regular dude" anyone can listen your phone call if they want to?

In my world everyone "normal I know" loves the mentioned app. How do I explain them everyone can read their messages if they want to? They answer me, everyone can steal my "normal" mail too if "they want to".

Ppps. I modified the typo i think i created after 8 pints.

Re: WhatsApp is broken, really broken

#87

Post by mikeash » Fri, Sep 14, 2012, 10:44 PM UTC

ZoFreX wrote: post #32

Yes, it's insecure by the standards we would normally apply to software. But let's be honest - this is competing against SMS, not XMPP, Skype, et al. How hard do you think it is for someone to sniff an SMS?

Armed with this blog post and a laptop, you could start spying on IM traffic in your local coffee shop in five minutes. I don't know where you'd even begin with spying on SMS, but I bet that in the least it requires substantially more specialized equipment.

Re: WhatsApp is broken, really broken

#88

Post by mikeash » Fri, Sep 14, 2012, 10:46 PM UTC

ollysb wrote: post #13

I'd have thought a large majority of what's app users use it for chatting. I can't imagine they're particularly fussed about people sniffing their plans for meeting up that night. There are varying requirements for security...

I suggest you go find some nearby open wifi in use, spy on some people, then tell them what you've found and see how they react to it. Report back when you're done... If you can....

Re: WhatsApp is broken, really broken

#89

Post by mikeash » Fri, Sep 14, 2012, 10:49 PM UTC

andrewljohnson wrote: post #8

Did the author email the WhatsApp team to give them any chance to fix this before they splashed it across the internet for anyone to abuse? The article makes no mention of it, so I assume not. In my opinion, the obscurity peeled off by this expose did more to endanger WhatsApp users than the bad programming. So, I can only conclude this post's main goal is page views. OP could easily warn them, and at least wait unti…

This is the security equivalent of having a giant flashing neon sign saying, "the door is unlocked, please come steal my stuff." That is to say, it's blindingly obvious to anyone who cares to look, so there's no reason to try to hide it, even temporarily.

Re: WhatsApp is broken, really broken

#90

Post by codeka » Fri, Sep 14, 2012, 10:50 PM UTC

joelhaasnoot wrote: post #33

zachalexander wrote: post #19

OT, but I'm intrigued by their business model. I don't know the history, but currently, the Android app is free, and it says the use of the service is free for the first year, then will be $0.99 per year after that. Meanwhile, the iOS app is $0.99 straight up. Thoughts: (a) "Free for a year, $1/year after that" seems like an awful long time to wait for a payday, but if it works, and you get lots of free users, I bet…

I've never had to pay for the Android app - it seems to autorenew.

I'm fairly lucky in that my work gives me a new phone about every year. So far I haven't had to pay for it, even though I've been using it for more than a year.

I'm not sure how that works with their "login" stuff, though, since I'd get a new IMEI with each new phone, but it just seems to work and the contact list is still there...

Personally, I'd always assumed there was no security at all and it just worked off your phone number. Certainly, I never treated any of it as in any way secure.