OT, but AES write(decrypt(open())) in python as done on the post seems to be padding the decrypted data with extra bits to match up in size with the source.
OpenSSL's aes-192-ebc gives me a slightly shorter, but well-formed db.
Any Android app can read your WhatsApp database
21–30 of 140 posts
Re: Any Android app can read your WhatsApp database
#22Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage.... ) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.
You are absolutely right. Still, I think Google is taking the wrong approach: the insecure /sdcard partition is the place where most of the storage is in nearly all Android phones. If your app needs to store larger amounts of data, that is the place to do it. Now, there are methods to use that storage a lot more securely than this, but the way Android works really leaves developers no other option than storing this s…
Google did, almost everybody on HN whined like a baby. https://news.ycombinator.com/item?id=7255579
Re: Any Android app can read your WhatsApp database
#23Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage.... ) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.
You are absolutely right. Still, I think Google is taking the wrong approach: the insecure /sdcard partition is the place where most of the storage is in nearly all Android phones. If your app needs to store larger amounts of data, that is the place to do it. Now, there are methods to use that storage a lot more securely than this, but the way Android works really leaves developers no other option than storing this s…
[deleted]
Re: Any Android app can read your WhatsApp database
#24Does this happen on Windows Phone devices as well? While WP allows reading and writing to the SD card, it provides isolated storage for apps(which is a source of much pain). While I am not sure about how android handles storage for apps, there should be a middle ground where users can explicitly permit apps to read protected storage data of other apps. WP disallows storage data sharing between apps leading to limited…
>Does this happen Windows Phone devices as well?
If they put the database in their isolated storage then no. Apps are sandboxed to their own isolated storage folder and cannot get access to the other apps folder (the source of your pain)
Edit: Spelling is hard
Re: Any Android app can read your WhatsApp database
#25Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?
Just out of curiosity, where would you store the unique AES key, that wouldn't break the UX in many ways? For instance, not losing messages when you upgrade your phone.
Storing the key is easy, you put it in your app's private data folder. Which is where the database should have just been stored in the first place, and not on the public SD card.
You could also have a user-supplied passphrase with email recovery. Or any of a dozen other best practices that exist. This isn't exactly a new problem, there are plenty of solutions that are far superior to rot13 (which is basically all this is)
Re: Any Android app can read your WhatsApp database
#26Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?
Just out of curiosity, where would you store the unique AES key, that wouldn't break the UX in many ways? For instance, not losing messages when you upgrade your phone.
Anywhere in the app-private data dir, ie Context.openFileOutput().
Re: Any Android app can read your WhatsApp database
#27Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage.... ) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.
You are absolutely right. Still, I think Google is taking the wrong approach: the insecure /sdcard partition is the place where most of the storage is in nearly all Android phones. If your app needs to store larger amounts of data, that is the place to do it. Now, there are methods to use that storage a lot more securely than this, but the way Android works really leaves developers no other option than storing this s…
> the insecure /sdcard partition is the place where most of the storage is in nearly all Android phones.
/sdcard and /data are on the same partition these days, you should just be using the app's private folder if the data is sensitive in the slightest. Which in this case it clearly is, and it's not even large data.
Re: Any Android app can read your WhatsApp database
#28Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?
Just out of curiosity, where would you store the unique AES key, that wouldn't break the UX in many ways? For instance, not losing messages when you upgrade your phone.
Store it in private and keep a copy on WhatsApp's server if the internal storage is lost during an upgrade (I'm assuming Android apps can't sniff each other's packets, can they?). It's not secret-from-whatsapp, they can read your messages regardless. Then the data in external storage would be comparatively safe from other apps on your phone.
Re: Any Android app can read your WhatsApp database
#29I thought the way android apps can lock down information away from other apps is they are able to set permission bits to be for their own unix "user" (e.g. each app gets their own userid). It's conceivable that WhatsApp simply set the permissions to be too open.
Em, no - that can only be done in internal store "data" directories which are usually formatted with UNIX filesystems and are by default secure (and cannot be accessed by other apps at all). WhatsApp is storing to external (on most devices FAT) storage (which was SD card on older devices, it's usually a separate directory/partition on newer ones) which does not have any ACL-like system due to FAT backwards compatibil…
Honestly, the more I tinker with Android, the more I'm terribly disappointed in Google. I mean, around Android 2 we were all excited by the potential of a first-class big-money supported open-source OS to really shake up the industry. It had so much potential.
Now? Well, it still has a lot of potential. Even Google seems kind of embarrassed by it, compared to the Chrome brand.
Re: Any Android app can read your WhatsApp database
#30Does this happen on Windows Phone devices as well? While WP allows reading and writing to the SD card, it provides isolated storage for apps(which is a source of much pain). While I am not sure about how android handles storage for apps, there should be a middle ground where users can explicitly permit apps to read protected storage data of other apps. WP disallows storage data sharing between apps leading to limited…
Google switched to the isolated storage model (on the sd card) for KitKat - http://source.android.com/devices/tech/storage/. Google has content providers so if an app wants to share data it can do so https://developer.android.com/guide/topics/providers/content.... If you really want to do something unsafe like allow direct file access to any folder then that is a reason to root your Android phone. Then using an app like SuperSU your can grant root permission to an application.