Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any Android app can read your WhatsApp database

bas.bosschert.nl

Post reply on HN
Print view View original

101–110 of 140 posts

Re: Any Android app can read your WhatsApp database

#101

Post by jnbiche »

kingnight wrote: post #94
hagope wrote: post #92

Earlier quoted context omitted.

So why isn't HN up-in-arms about Google allowing Android apps access to all your phone's un-encrypted images?!? That seems like a much bigger issue!

Perhaps it's inaccurate? It has to be right? I would have to think this would be something EVERYONE would be upset by.

No, it's quite true. If you're running Android prior to 4.1, any app can read anything from your SD card. Starting in 4.1, apps require READ_EXTERNAL_STORAGE to be able to read from the card (so user has to grant app this permission upon installation)[1].

Have you never noticed this when you grant apps permissions? All of this is clearly written on the permissions list -- READ_EXTERNAL_STORAGE is explained there in layman's terms (as in, "this app will be able to read and write files on your SD card" or something similar).

And now, in KitKat, there have been some major changes in how the SD card can be accessed by apps, which I don't fully understand (never had to develop for KitKat only). But only a small percentage of users have KitKat installed.

If you're really storing sensitive things on your SD card, you should probably look into using some type of app for encrypted file storage (there are many on the market).

1. http://source.android.com/devices/tech/storage/index.html

Re: Any Android app can read your WhatsApp database

#102

Post by tjgq »

kllrnohj wrote: post #56
jcampbell1 wrote: post #43

Earlier quoted context omitted.

You do realize all desktop software has this same vulnerability. I think you are being a tad hyperbolic. WhatsApp has some blame, but Google should have figured out how to let applications sandbox data on the SD card without having to do roll your own AES key management system. It could have been as simple as put the data in a folder named "private/appname/".

> Google should have figured out how to let applications sandbox data on the SD It's called put your data in /data. You get a private app data folder by default . /sdcard and /data are both internal storage on the majority of phones, neither points at a physical sd card slot. And seriously, who wants their messages stored on /sdcard anyway? You pop out the sdcard and all your text messages vanish? What kind of brain…

I think the widespread practice of Android applications storing potentially large data in /sdcard dates to a time when /data was extremely small on most phones, and would fill up quite rapidly if you had a large number of applications installed. I don't think that's the case any longer, at least certainly not for an SMS app.

Re: Any Android app can read your WhatsApp database

#103

Post by giovannibajo1 »

mncolinlee wrote: post #50

As an Android developer, the real hole here is being able to read the encryption key. Jelly Bean 4.3 adds the potential for "secure key storage" which only works if the user is not smart or persistent enough to break the obfuscation through using the application itself with a debugger and a rooted phone. There is no fully safe method to store keys on a device if the attacker can gain access to the same device.

Depends on the definition of "fully safe", or maybe "device". Extracting keychain secrets from a iOS device requires brute-forcing the lock screen password.

Bruteforcing the 4-pin digit is easy "math-wise", but complicated in practice because you can't really access the data on the flash (not even dumping it, as it's fully encrypted with a hardware key), and the device will not pair to a new PC/Mac without first unlocking; so you would also need physical access to a paired PC/Mac.

For the newest devices, fingerprints can't really be bruteforced (not because of complexity, but the because the hardware locks down burning its secret after a few attempts) and Apple advises using a complex password as a fallback for the fingerprint; basically the password is the real secret for encryption, while the fingerprint hw just holds a temporary unlock secret which selfdestroys if bruteforced; this is why the user is always required to enter the password after a reboot.

Of course you might still have a 0-day root exploit to use if you're NSA (or somebody with $300K to invest), and that's where I concede the "not fully safe".

Re: Any Android app can read your WhatsApp database

#104

Post by Tloewald »

sentenza wrote: post #51
acchow wrote: post #36

Earlier quoted context omitted.

It's also a highly-simplified backend. No multisession (synchronization is hard), no back-end message history searching (search and graphs are hard). They took a lot of shortcuts, which turned out really well for them. Simplification made for a very fast client and a low-latency, low-bandwidth protocol.

Being slim to deliver only essential functionality is one thing, but playing fast and loose with user data is not a shortcut that should be rewarded so lavishly.

Playing fast and loose with user data === entire android ecosystem.

Re: Any Android app can read your WhatsApp database

#105

Post by charleslmunger »

weixiyen wrote: post #83
pinaceae wrote: post #31

19bn $. No way anyone else at FB could have built this app and given it away for free for years for that price. No way. Totally worth it. 19bn $. Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.

So much jelly in this comment. They obviously made good product decisions to get to this point. A few blips along the way will happen, when you are focusing on much more important things. Your entire SMS history is available to any app with permissions. Most people don't even know that, or are not bothered by it. This is literally feature parity with default SMS. WhatsApp is about messaging that is simple and functio…

> with permissions

I mean, yeah. That's what permissions are for.

Re: Any Android app can read your WhatsApp database

#106

Post by charleslmunger »

bentcorner wrote: post #41
dermatthias wrote: post #35

Earlier quoted context omitted.

One important point here: In the article the author says that the location of the database is /sdcard/WhatsApp/Databases. That's not entirely correct. It only gets copied there when you use the build in backup feature (Settings -> Chat Settings). Else, it sits "safely" under /data/data/com.whatsapp/databases like every other Android sqlite database. But nonetheless, WhatsApp was and is not really known for its safety…

This needs to be at the top. The fix here is very simple then - prompt the user for a passphrase when doing a backup, allow no passphrase for a "friction free" if you really want to, but give the user the option.

You don't even need a passphrase. Just generate a random key and store it somewhere, like whatsapp's servers.

Re: Any Android app can read your WhatsApp database

#107

Post by jug6ernaut »

mncolinlee wrote: post #50

As an Android developer, the real hole here is being able to read the encryption key. Jelly Bean 4.3 adds the potential for "secure key storage" which only works if the user is not smart or persistent enough to break the obfuscation through using the application itself with a debugger and a rooted phone. There is no fully safe method to store keys on a device if the attacker can gain access to the same device.

Sure. Why not then store on there servers, and have the phones only keep an in memory copy?

Re: Any Android app can read your WhatsApp database

#108

Post by [deleted] »

pinaceae wrote: post #31

19bn $. No way anyone else at FB could have built this app and given it away for free for years for that price. No way. Totally worth it. 19bn $. Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.

[deleted]

Re: Any Android app can read your WhatsApp database

#110

Post by visakanv »

doktrin wrote: post #86
weixiyen wrote: post #83

Earlier quoted context omitted.

So much jelly in this comment. They obviously made good product decisions to get to this point. A few blips along the way will happen, when you are focusing on much more important things. Your entire SMS history is available to any app with permissions. Most people don't even know that, or are not bothered by it. This is literally feature parity with default SMS. WhatsApp is about messaging that is simple and functio…

> Security is not even a main selling point. Didn't the founder specifically cite growing up under an oppressive regime as a key motivation behind WhatsApp?

Hrm. I'm torn both ways. I think a world with whatsapp is less oppressive than a world without whatsapp, even if people can spy on it, tap into it, etc- because it allows people to communicate where they previously might not have been able to. A world with secure whatsapp would, of course, be even better than a world with insecure whatsapp.
Post reply on HN