I thought WhatsApp had a history of horrendous security?
Any Android app can read your WhatsApp database
11–20 of 140 posts
Re: Any Android app can read your WhatsApp database
#12Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage.... ) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.
You are absolutely right. Still, I think Google is taking the wrong approach: the insecure /sdcard partition is the place where most of the storage is in nearly all Android phones. If your app needs to store larger amounts of data, that is the place to do it. Now, there are methods to use that storage a lot more securely than this, but the way Android works really leaves developers no other option than storing this s…
Yeah I agree - increasing the size of internal storage was a blessing for my/our apps in terms of security (no more storing of secure data on shared storage due to lack of space).
Google should probabl MTP from the start and just formatted SD cards with one of the ACL supporting filesystems to get security right. But as the saying goes... it's easy to be a general after battle :)
Re: Any Android app can read your WhatsApp database
#13I am flabbergasted they still didn't improve it properly...
Let's hope Facebook helps their development team.
Re: Any Android app can read your WhatsApp database
#14I am flabbergasted they still didn't improve it properly... Let's hope Facebook helps their development team.
As long as Facebook gets to read all those billions of "personal" communications - messages, videos, audio, images - they are fine with anything.
Re: Any Android app can read your WhatsApp database
#15Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?
What's troubling is, that their security track record has been abysmal from the start. In that regard, the acquisition sends entirely the wrong message.
Re: Any Android app can read your WhatsApp database
#16Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?
That's why you use TextSecure instead of insecure proprietary "popular" apps.
Whatsapp could also use TextSecure's ratcheting protocol, too. Why aren't they? Beats me. Maybe they prefer weaker security for their users.
Re: Any Android app can read your WhatsApp database
#17I am flabbergasted they still didn't improve it properly... Let's hope Facebook helps their development team.
As long as Facebook gets to read all those billions of "personal" communications - messages, videos, audio, images - they are fine with anything.
Are you... are you saying they are trying to copy... Google?!?
I am speechless by such a statement.
Re: Any Android app can read your WhatsApp database
#18Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage.... ) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.
You are absolutely right. Still, I think Google is taking the wrong approach: the insecure /sdcard partition is the place where most of the storage is in nearly all Android phones. If your app needs to store larger amounts of data, that is the place to do it. Now, there are methods to use that storage a lot more securely than this, but the way Android works really leaves developers no other option than storing this s…
[deleted]
Re: Any Android app can read your WhatsApp database
#19Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?
Just out of curiosity, where would you store the unique AES key, that wouldn't break the UX in many ways? For instance, not losing messages when you upgrade your phone.
Re: Any Android app can read your WhatsApp database
#20Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?
One might think Facebook did their due diligence and said, "DANG, you got all these users with this big of a hole just laying right out there? Here, have some money."