Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any Android app can read your WhatsApp database

bas.bosschert.nl

Post reply on HN
Print view View original

121–130 of 140 posts

Re: Any Android app can read your WhatsApp database

#122

Post by lmz »

yeukhon wrote: post #93
Pxtl wrote: post #29

Earlier quoted context omitted.

Honestly, the more I tinker with Android, the more I'm terribly disappointed in Google. I mean, around Android 2 we were all excited by the potential of a first-class big-money supported open-source OS to really shake up the industry. It had so much potential. Now? Well, it still has a lot of potential. Even Google seems kind of embarrassed by it, compared to the Chrome brand.

It does seem bizarre they don't make any ACL on external storage. I am sure this is not a strange isolated report. This problem must have been known for years both externally and internally. On the side note, from old news I remember Google is indeed pushing forward with Chrome-brand, specifically Chrome OS.

Because people want to take their SD card, plug it in somewhere else, and have access to their photos / videos / songs. This necessitates using FAT. That is the case for most removable media.

Re: Any Android app can read your WhatsApp database

#123

Post by 72deluxe »

hagope wrote: post #92
jnbiche wrote: post #71

Earlier quoted context omitted.

Yes. There is no way on Android to give fine-grained directory-based access permissions (unfortunately). So all SD card permitted apps can read the SD card globally.

So why isn't HN up-in-arms about Google allowing Android apps access to all your phone's un-encrypted images?!? That seems like a much bigger issue!

Since most desktops/PCs/Macs are now always online, why is nobody up in arms that any application has access to your home directory, your registry (HKCU at very least) and your "My Documents" directory either?

This is basically what Android apps have access to when requesting STORAGE permission.

Surely it is the same "problem"?

Re: Any Android app can read your WhatsApp database

#124

Post by _kfb »

eropple wrote: post #39
izacus wrote: post #5

Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage.... ) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.

My last gig was with a medical software company, storing and uploading physician recordings. The first thing I did in the process of building the file system component was to set up AES based off a passphrase and never let it out of memory (not safe against a rooted phone rummaging through memory, but that user's acknowledging the risks by doing so). It took me, like, a day, with tighter performance requirements than…

I think that the problem is that "user-hateful" is the opposite of what's actually happening here: we're still at a state where security is something that users don't actually like, because it often puts the burden directly on them. Viewed cynically, what's happened here is that we have received "the software that we deserve".

Re: Any Android app can read your WhatsApp database

#125

Post by miken123 »

jdewald wrote: post #90
kllrnohj wrote: post #56

Earlier quoted context omitted.

> Google should have figured out how to let applications sandbox data on the SD It's called put your data in /data. You get a private app data folder by default . /sdcard and /data are both internal storage on the majority of phones, neither points at a physical sd card slot. And seriously, who wants their messages stored on /sdcard anyway? You pop out the sdcard and all your text messages vanish? What kind of brain…

Reading the article, the data the "exploit" looks at is only if the user has turned on the backup feature (disabled by default).

The backup feature is on by default, scheduled to backup at 4:00 daily. I can't find an option to turn it off.

Re: Any Android app can read your WhatsApp database

#126

Post by Perseids »

weixiyen wrote: post #83
pinaceae wrote: post #31

19bn $. No way anyone else at FB could have built this app and given it away for free for years for that price. No way. Totally worth it. 19bn $. Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.

So much jelly in this comment. They obviously made good product decisions to get to this point. A few blips along the way will happen, when you are focusing on much more important things. Your entire SMS history is available to any app with permissions. Most people don't even know that, or are not bothered by it. This is literally feature parity with default SMS. WhatsApp is about messaging that is simple and functio…

> A few blips along the way will happen

It is not a few blips. They have consistently shown to be unable to implement any kind of effective cryptography. Take this case as an example. They seem to have tried to prevent such kind of attack by encrypting the data on the SD Card with a static key. How hard would it have been to generate a random key and save the key on the internal storage?

An other example is the transport, i.e. client-to-server encryption. Even their new protocol looks like it has been hacked up by someone who learned his/her cryptography by 5 hour wikipedia reading: https://blog.thijsalkema.de/blog/2013/10/08/piercing-through... . You would think that for a market value of 19x10^9 dollar you could afford to hire a single cryptographer or IT security specialist. Especially after you have been criticized for your bad security for years.

> If you want security, there are apps for that. Good luck getting your friends to use it.

We are not even talking about difficult usability decisions here where strong end-to-end encryption has to be visible in the user interface to allow fingerprint checking. This is about the most fundamental security measures, like if you connect to your server use TLS (and check the certificate) or if you encrypt something don't use the same key everywhere.

Post reply on HN