Live data from Hacker News

Any Android app can read your WhatsApp database

bas.bosschert.nl

131–140 of 140 posts

Re: Any Android app can read your WhatsApp database

#131
post #91

Earlier quoted context omitted.

I've been using WhatsApp for years and seen many selling points, but security has never been one. A link would help because I've never gotten the impression that they were trying to sell security.

http://www.whatsapp.com/faq/en/general/21864047 - from their FAQ

WhatsApp communication between your phone and our server is encrypted.

...

Please be aware of who has physical access to your phone.

Re: Any Android app can read your WhatsApp database

#132
post #131
post #91

Earlier quoted context omitted.

http://www.whatsapp.com/faq/en/general/21864047 - from their FAQ

WhatsApp communication between your phone and our server is encrypted. ... Please be aware of who has physical access to your phone.

Well yeah, encrypted with one AES key per user. That shit isn't secure.

Re: Any Android app can read your WhatsApp database

#133
post #98

Earlier quoted context omitted.

Are you the same person who posts this snippet every time FB is mentioned on HN?

This is actually the first time that I'm posting this, but yeah I don't fault Zuckerberg. That was one of the reasons that I added that he was perhaps less mature then. Thought processes & some beliefs change over time and I'm not saying he is the same person now that he was then.

Then you're copying the guy(s) who do(es) post this snippet every time FB is mentioned on HN.

Re: Any Android app can read your WhatsApp database

#134
post #117

Earlier quoted context omitted.

So much jelly in this comment. They obviously made good product decisions to get to this point. A few blips along the way will happen, when you are focusing on much more important things. Your entire SMS history is available to any app with permissions. Most people don't even know that, or are not bothered by it. This is literally feature parity with default SMS. WhatsApp is about messaging that is simple and functio…

The competition isn't "default SMS". The competition is iMessage. Can you do this with iMessage? Emphatically not. And my friends are already using it; I guess the luck was not really needed.

iMessage? Can't find it on my Android. The competition is definitely SMS.

Re: Any Android app can read your WhatsApp database

#135
post #92

Earlier quoted context omitted.

So why isn't HN up-in-arms about Google allowing Android apps access to all your phone's un-encrypted images?!? That seems like a much bigger issue!

Since most desktops/PCs/Macs are now always online, why is nobody up in arms that any application has access to your home directory, your registry (HKCU at very least) and your "My Documents" directory either? This is basically what Android apps have access to when requesting STORAGE permission. Surely it is the same "problem"?

Yes, I agree. I'm not outraged at all, the lesson is to be careful when accepting SD Storage permission on android...

Re: Any Android app can read your WhatsApp database

#136

Earlier quoted context omitted.

> the insecure /sdcard partition is the place where most of the storage is in nearly all Android phones. /sdcard and /data are on the same partition these days, you should just be using the app's private folder if the data is sensitive in the slightest. Which in this case it clearly is, and it's not even large data.

This is true on Nexus phones, but it's a mount point (not "emulated") on Samsung or other SD-card-equipped phones, which I think--not sure--is more of a majority.

No, on Samsung & other SD-card-equipped phones /sdcard points to internal storage and there's some other path, like /sdcard2, that points at the actual SD card.

Re: Any Android app can read your WhatsApp database

#137

Earlier quoted context omitted.

This is actually the first time that I'm posting this, but yeah I don't fault Zuckerberg. That was one of the reasons that I added that he was perhaps less mature then. Thought processes & some beliefs change over time and I'm not saying he is the same person now that he was then.

Then you're copying the guy(s) who do(es) post this snippet every time FB is mentioned on HN.

I'm really not sure why that is relevant?

Do you always check whether what you are about to write/post has been written before?

Re: Any Android app can read your WhatsApp database

#138

Earlier quoted context omitted.

So much jelly in this comment. They obviously made good product decisions to get to this point. A few blips along the way will happen, when you are focusing on much more important things. Your entire SMS history is available to any app with permissions. Most people don't even know that, or are not bothered by it. This is literally feature parity with default SMS. WhatsApp is about messaging that is simple and functio…

> with permissions I mean, yeah. That's what permissions are for.

weixiyen seems to be ignorant of, or omitted, the fact that there's a difference between "read text messages" and "read the SD card" permissions. If some Flappy Bird clone wants to read/write the SD card, maybe users don't care, but they might decide it has no legitimate reason to read their messages.

If one wanted to criticize Android for having such broad SD card permissions, there may be an argument there, but given the current state of things, it's trivial for apps to securely encrypt files they put on the SD card (they store the key in internal storage, which is much better-protected.)

Re: Any Android app can read your WhatsApp database

#139
Are you in search a legitimate hacker? Do you wish to hack someone else facebook, gmail, hotmail, yahoomail, bank account without trace? Do you wish to upgrade your university score or college score without fear of been caught? Do you wish to delete some information from a website database, do you need a website? Search no more as hack word is here to give you a new lease of life. Interested persons should contact us now on this mail. dgf090293@gmail.com

Re: Any Android app can read your WhatsApp database

#140

Earlier quoted context omitted.

Hrm. I'm torn both ways. I think a world with whatsapp is less oppressive than a world without whatsapp, even if people can spy on it, tap into it, etc- because it allows people to communicate where they previously might not have been able to. A world with secure whatsapp would, of course, be even better than a world with insecure whatsapp.

> I think a world with whatsapp is less oppressive than a world without whatsapp, even if people can spy on it, tap into it, etc- because it allows people to communicate where they previously might not have been able to. That's a fair stance. I don't have strong feelings vis a vis WhatsApp, so this is more of a general statement : I think the illusion of secure communication is more dangerous than insecure communicat…

I agree with that. I think it's important to always assume that your communications are insecure.
Post reply on HN