Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any Android app can read your WhatsApp database

bas.bosschert.nl

Post reply on HN
Print view View original

81–90 of 140 posts

Re: Any Android app can read your WhatsApp database

#81

Post by yid »

timjahn wrote: post #77
mahyarm wrote: post #52

Earlier quoted context omitted.

No it isn't 'prefer'. It's that users don't care about this kind of security in practice, they only care about the kind of security from other people in their personal lives, which is more about privacy controls than actual security. Because of this, they get no reward from the market if they actually focus on security. Instead they focus on things the market DOES reward them for, which is being fast, never being dow…

"They only have 35 engineers, what they could do is limited." Um, am I the only one that thinks 35 engineers is a pretty good size team to get a good amount of work done?

> Um, am I the only one that thinks 35 engineers is a pretty good size team to get a good amount of work done?

It takes extraordinarily good engineering practices and discipline to get 35 engineers working as well as you'd imagine WhatsApp could have.

Re: Any Android app can read your WhatsApp database

#83

Post by weixiyen »

pinaceae wrote: post #31

19bn $. No way anyone else at FB could have built this app and given it away for free for years for that price. No way. Totally worth it. 19bn $. Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.

So much jelly in this comment. They obviously made good product decisions to get to this point. A few blips along the way will happen, when you are focusing on much more important things.

Your entire SMS history is available to any app with permissions. Most people don't even know that, or are not bothered by it. This is literally feature parity with default SMS. WhatsApp is about messaging that is simple and functional. Security is not even a main selling point.

If you want security, there are apps for that. Good luck getting your friends to use it.

Re: Any Android app can read your WhatsApp database

#84

Post by weixiyen »

sp332 wrote: post #66
delecti wrote: post #64

Unless I'm mistaken, any application can read the device's SMS database if given the appropriate permission (and few users are very discerning with regards to permissions). To an end-user, WhatsApp is essentially an SMS application, except it doesn't use SMSs. Given that, this doesn't seem like the end of the world.

WhatsApp claims to keep your texts secret, and this is a big selling point. They make privacy claims that go beyond normal SMS messages, and that's why this is a big deal.

I've been using WhatsApp for years and seen many selling points, but security has never been one. A link would help because I've never gotten the impression that they were trying to sell security.

Re: Any Android app can read your WhatsApp database

#85

Post by josu »

TazeTSchnitzel wrote: post #78
josu wrote: post #49

Earlier quoted context omitted.

>app's private data folder That may be the problem. WhatsApp has focused since the beginning on making their app available on as many devices as possible (They even have symbian compatibiity). My WhatsApp database is almost 500MB, this is more than many low end Android phone's internal memory. Therefore, they decided to store the database on the SD card. I don't think that this should be a problem had they decided to…

Did you read the post? You only need to store the key in private data. A few bytes at most.

Yes, I did, I wouldn't be replying if I hadn't. But I was replying to the parent comment.

>Which is where the database should have just been stored in the first place, and not on the public SD card

I was just guessing why WhatsApp may have decided to put the database on the SD card. But maybe I didn't understand what kllrnohj was referring to when he said "database".

EDIT: Also, that's why I said:

>I don't think that this should be a problem had they decided to implement proper encryption on the database.

Re: Any Android app can read your WhatsApp database

#86

Post by doktrin »

weixiyen wrote: post #83
pinaceae wrote: post #31

19bn $. No way anyone else at FB could have built this app and given it away for free for years for that price. No way. Totally worth it. 19bn $. Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.

So much jelly in this comment. They obviously made good product decisions to get to this point. A few blips along the way will happen, when you are focusing on much more important things. Your entire SMS history is available to any app with permissions. Most people don't even know that, or are not bothered by it. This is literally feature parity with default SMS. WhatsApp is about messaging that is simple and functio…

>Security is not even a main selling point.

Didn't the founder specifically cite growing up under an oppressive regime as a key motivation behind WhatsApp?

Re: Any Android app can read your WhatsApp database

#88

Post by aryastark »

sp332 wrote: post #66
delecti wrote: post #64

Unless I'm mistaken, any application can read the device's SMS database if given the appropriate permission (and few users are very discerning with regards to permissions). To an end-user, WhatsApp is essentially an SMS application, except it doesn't use SMSs. Given that, this doesn't seem like the end of the world.

WhatsApp claims to keep your texts secret, and this is a big selling point. They make privacy claims that go beyond normal SMS messages, and that's why this is a big deal.

huh? Stop making shit up. None of what you said is true. They were sending messages in plaintext not that long ago. Their switch to encrypted communication was merely a footnote.

Re: Any Android app can read your WhatsApp database

#89

Post by roc »

sentenza wrote: post #15
kllrnohj wrote: post #9

Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?

What's troubling is, that their security track record has been abysmal from the start. In that regard, the acquisition sends entirely the wrong message.

The market's been sending that same message for years.

Security is a cost center and potential source of user-friction. User Data Integrity is a "nice to have". Privacy is considered only from the angle of "what can other users see through normal operation".

And that market is driven by the consumers themselves.

Re: Any Android app can read your WhatsApp database

#90

Post by jdewald »

kllrnohj wrote: post #56
jcampbell1 wrote: post #43

Earlier quoted context omitted.

You do realize all desktop software has this same vulnerability. I think you are being a tad hyperbolic. WhatsApp has some blame, but Google should have figured out how to let applications sandbox data on the SD card without having to do roll your own AES key management system. It could have been as simple as put the data in a folder named "private/appname/".

> Google should have figured out how to let applications sandbox data on the SD It's called put your data in /data. You get a private app data folder by default . /sdcard and /data are both internal storage on the majority of phones, neither points at a physical sd card slot. And seriously, who wants their messages stored on /sdcard anyway? You pop out the sdcard and all your text messages vanish? What kind of brain…

Reading the article, the data the "exploit" looks at is only if the user has turned on the backup feature (disabled by default).
Post reply on HN