Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any Android app can read your WhatsApp database

bas.bosschert.nl

Post reply on HN
Print view View original

61–70 of 140 posts

Re: Any Android app can read your WhatsApp database

#61

Post by giovannibajo1 »

baby wrote: post #59

> if the user allows it to access the SD card. And since majority of the people allows everything on their Android device 1. So basically, if you're installing an app AND you're allowing the app to access all of your phone (and its dirty secrets) 2. I don't see why whatsapp would encrypt the chats (I might be very wrong on this one), isn't it better if we can access them offline through a computer if the phone crashe…

There are endless good reasons for an app to request access to the SD card, so I would say it's still very reasonable to trick anybody into accepting it.

The idea of handling the SD card has a global shared filesystem that totally bypasses the application sandbox is a security disaster from the get go. Fortunately, SD cards are on the way out, and Google doesn't even bother to fix it at the system level since they're dropping it anyway at some point.

Re: Any Android app can read your WhatsApp database

#62

Post by [deleted] »

baby wrote: post #59

> if the user allows it to access the SD card. And since majority of the people allows everything on their Android device 1. So basically, if you're installing an app AND you're allowing the app to access all of your phone (and its dirty secrets) 2. I don't see why whatsapp would encrypt the chats (I might be very wrong on this one), isn't it better if we can access them offline through a computer if the phone crashe…

[deleted]

Re: Any Android app can read your WhatsApp database

#63

Post by danielweber »

gress wrote: post #57

One of the great advantages of android is that it permits developers to do things like this. Let's not get upset about it when mistakes happen. Users can always choose a different app if they dislike the behavior.

This is actually good news . . .?

Re: Any Android app can read your WhatsApp database

#64

Post by delecti »

Unless I'm mistaken, any application can read the device's SMS database if given the appropriate permission (and few users are very discerning with regards to permissions).

To an end-user, WhatsApp is essentially an SMS application, except it doesn't use SMSs. Given that, this doesn't seem like the end of the world.

Re: Any Android app can read your WhatsApp database

#65

Post by jaxytee »

kllrnohj wrote: post #9

Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?

>Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?

Cashing out billions why we criticize from a web forum.

Re: Any Android app can read your WhatsApp database

#66

Post by sp332 »

delecti wrote: post #64

Unless I'm mistaken, any application can read the device's SMS database if given the appropriate permission (and few users are very discerning with regards to permissions). To an end-user, WhatsApp is essentially an SMS application, except it doesn't use SMSs. Given that, this doesn't seem like the end of the world.

WhatsApp claims to keep your texts secret, and this is a big selling point. They make privacy claims that go beyond normal SMS messages, and that's why this is a big deal.

Re: Any Android app can read your WhatsApp database

#68

Post by eropple »

jcampbell1 wrote: post #58
eropple wrote: post #47

Earlier quoted context omitted.

OS X doesn't have that problem when using sandboxed applications. I choose to opt out by installing non-sandboxed applications, but I know that I'm doing so and I don't install non-sandboxed stuff from people I don't trust. I also have much more accessible tools for inspecting the behaviors of applications, should I want to do so, on OS X than Android - I can do my own homework if I have a notion. (I don't expect end…

For what it is worth, I wasn't interested in a privacy debate, but rather technical advice. I have come to the conclusion after a bit of research, the only way to make this backup work is to require a passphrase, or for the OS to provide sandboxing. Android 4.4 provides the necessary sandboxing. I am sure WhatsApp will use it. I don't agree with WhatsApp's choice to not require a passphrase, but I at least understand…

It is a choice made by someone prioritizing user acquisition over treating users fairly, and there's no defensible argument for that.

Re: Any Android app can read your WhatsApp database

#69

Post by hagope »

izacus wrote: post #5

Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage.... ) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.

but my native camera app stores all my images on the emulated SD Card (moto x) in a folder called DCIM?!?!?

Re: Any Android app can read your WhatsApp database

#70

Post by gress »

danielweber wrote: post #63
gress wrote: post #57

One of the great advantages of android is that it permits developers to do things like this. Let's not get upset about it when mistakes happen. Users can always choose a different app if they dislike the behavior.

This is actually good news . . .?

Sure - consumers get to decide what tradeoffs they want, and the media assists by exposing information that might not be otherwise available, as is happening here.
Post reply on HN