> I used this webserver with a simple php script. "webserver" is a hyperlink, but it just links back to the blog. Anyone know what he's referring to here?
What's his blog hosted on...?
Any Android app can read your WhatsApp database
111–120 of 140 posts
Re: Any Android app can read your WhatsApp database
#112> if the user allows it to access the SD card. And since majority of the people allows everything on their Android device 1. So basically, if you're installing an app AND you're allowing the app to access all of your phone (and its dirty secrets) 2. I don't see why whatsapp would encrypt the chats (I might be very wrong on this one), isn't it better if we can access them offline through a computer if the phone crashe…
There are endless good reasons for an app to request access to the SD card, so I would say it's still very reasonable to trick anybody into accepting it. The idea of handling the SD card has a global shared filesystem that totally bypasses the application sandbox is a security disaster from the get go. Fortunately, SD cards are on the way out, and Google doesn't even bother to fix it at the system level since they're…
> Fortunately, SD cards are on the way out,
I don't know about you, but I'd rather not sacrifice my freedom to manage storage for a little temporary security...
Re: Any Android app can read your WhatsApp database
#113Earlier quoted context omitted.
Nah, of course not. They're copying Apple of course, everybody does after all? iMessage, FaceTime, whatnot.
Apple doesn't read or store iMessages.
Any proof of that? I know there was an article about how it encrypts each message with the key of the device it is being sent to however I haven't seen anyone audit it to be sure that it isn't adding an Apple key to that list.
Re: Any Android app can read your WhatsApp database
#114Earlier quoted context omitted.
> Security is not even a main selling point. Didn't the founder specifically cite growing up under an oppressive regime as a key motivation behind WhatsApp?
Hrm. I'm torn both ways. I think a world with whatsapp is less oppressive than a world without whatsapp, even if people can spy on it, tap into it, etc- because it allows people to communicate where they previously might not have been able to. A world with secure whatsapp would, of course, be even better than a world with insecure whatsapp.
> I think a world with whatsapp is less oppressive than a world without whatsapp, even if people can spy on it, tap into it, etc- because it allows people to communicate where they previously might not have been able to.
That's a fair stance. I don't have strong feelings vis a vis WhatsApp, so this is more of a general statement :
I think the illusion of secure communication is more dangerous than insecure communication. People who think they can't be spied on will expose themselves in ways they otherwise wouldn't.
Re: Any Android app can read your WhatsApp database
#115Earlier quoted context omitted.
Haha! But seriously given the leaked chat messages from when Zuckerberg was still not the polished CEO and less mature [1], your argument seems plausible. > ZUCK: yea so if you ever need info about anyone at harvard > ZUCK: just ask > ZUCK: i have over 4000 emails, pictures, addresses, sns > FRIEND: what!? how’d you manage that one? > ZUCK: people just submitted it > ZUCK: i don’t know why > ZUCK: they “trust me” > Z…
Are you the same person who posts this snippet every time FB is mentioned on HN?
This is actually the first time that I'm posting this, but yeah I don't fault Zuckerberg. That was one of the reasons that I added that he was perhaps less mature then. Thought processes & some beliefs change over time and I'm not saying he is the same person now that he was then.
Re: Any Android app can read your WhatsApp database
#11619bn $. No way anyone else at FB could have built this app and given it away for free for years for that price. No way. Totally worth it. 19bn $. Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.
Might have a few flaws, but hey at 19b $ it's probably 50% less buggy than this 12b $ piece of firmware. So value for money.
Re: Any Android app can read your WhatsApp database
#11719bn $. No way anyone else at FB could have built this app and given it away for free for years for that price. No way. Totally worth it. 19bn $. Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.
So much jelly in this comment. They obviously made good product decisions to get to this point. A few blips along the way will happen, when you are focusing on much more important things. Your entire SMS history is available to any app with permissions. Most people don't even know that, or are not bothered by it. This is literally feature parity with default SMS. WhatsApp is about messaging that is simple and functio…
The competition isn't "default SMS". The competition is iMessage. Can you do this with iMessage? Emphatically not.
And my friends are already using it; I guess the luck was not really needed.
Re: Any Android app can read your WhatsApp database
#118Considering apps like this exist: https://play.google.com/store/apps/details?id=com.androidapp...
it seems pretty obvious that this was the case
Re: Any Android app can read your WhatsApp database
#119Can't any app access all SMSs too in an easier manner? Whatsapp is a similar app, so why hold it to different standards?
Re: Any Android app can read your WhatsApp database
#120Earlier quoted context omitted.
Storing the key is easy, you put it in your app's private data folder. Which is where the database should have just been stored in the first place, and not on the public SD card. You could also have a user-supplied passphrase with email recovery. Or any of a dozen other best practices that exist. This isn't exactly a new problem, there are plenty of solutions that are far superior to rot13 (which is basically all thi…
Even better than the app's private data folder, use Android's KeyChain API to store the key in hardware-backed credential storage: http://developer.android.com/reference/android/security/KeyC...
This API wasn't available until Ice Cream (4.0). I don't know WhatsApp user makeup, but I wouldn't be surprised if this "system" is a holdover of what was available to them in Eclair.