Ask HN: How can I verify that WhatsApp uses E2E encryption?

#1

Post by Inc82 » Thu, Jan 01, 2015, 1:17 PM UTC

Everyone seems thrilled that WhatsApp has announced they they have switched to E2E encryption developed by Open Whisper. Is there a way I can verify this is happening?

Re: Ask HN: How can I verify that WhatsApp uses E2E encryption?

#2

Post by ritonlajoie » Thu, Jan 01, 2015, 2:29 PM UTC

I guess, connect on a computer using your phone VPN ability, and launch wireshark.

Re: Ask HN: How can I verify that WhatsApp uses E2E encryption?

#3

Post by fdik » Thu, Jan 01, 2015, 2:37 PM UTC

You cannot verify that WhatsApp isn't cheating without a source code analysis. And it's even worse, WhatsApp is a doughter company of Facebook, so WhatsApp is falling under Section 215 US Patriot Act.

In short: it's not Facebook's or WhatsApp's fault, but they're forced to cheat if there is the requirement from US officials.

While there may be E2E encryption in WhatsApp, there is no way to get it trustworthy.

Re: Ask HN: How can I verify that WhatsApp uses E2E encryption?

#4

Post by joepie91_ » Thu, Jan 01, 2015, 2:40 PM UTC

Basically, you can't. And this is precisely why open-source is so important for cryptography-, security- and privacy-related purposes.

Re: Ask HN: How can I verify that WhatsApp uses E2E encryption?

#5

Post by DaGardner » Thu, Jan 01, 2015, 2:43 PM UTC

ritonlajoie wrote: post #2

I guess, connect on a computer using your phone VPN ability, and launch wireshark.

The packets might be encrypted, but Facebook/WhatsApp _could_ still hold on a master key.

Re: Ask HN: How can I verify that WhatsApp uses E2E encryption?

#6

Post by jacquesm » Thu, Jan 01, 2015, 2:46 PM UTC

ritonlajoie wrote: post #2

I guess, connect on a computer using your phone VPN ability, and launch wireshark.

That only shows a bit of information on some packets. Maybe there is a switch in the code that can be triggered remotely which then sends out your data without any encryption at all. You really need to look at the source to get any kind of confidence with stuff like this, and even then there are a lot of possible issues if your data passes through servers owned by others.

Re: Ask HN: How can I verify that WhatsApp uses E2E encryption?

#7

Post by [deleted] » Thu, Jan 01, 2015, 2:51 PM UTC

[deleted]

Re: Ask HN: How can I verify that WhatsApp uses E2E encryption?

#8

Post by davexunit » Thu, Jan 01, 2015, 2:54 PM UTC

You can't. WhatsApp is proprietary software that you aren't allowed to audit. Use free software chat programs instead.

Re: Ask HN: How can I verify that WhatsApp uses E2E encryption?

#9

Post by colanderman » Thu, Jan 01, 2015, 3:04 PM UTC

I suppose, if they published the algorithm they claim to use, and if you can stub out the app's random number source (say LD_PRELOAD or the like), and if you can sniff the app's network traffic (again, LD_PRELOAD might be necessary if it's encrypted, assuming they're not using a statically linked SSL library), and if they don't perform one of any number of trivial modifications to the algorithm (such as adding a fixed salt), you might be able to, for a given message, confirm that for that message, they encrypt it identically to how the algorithm they claim to use would encrypt it.

But that's a lot of ifs, and doesn't prove there's no backdoor that's currently disabled.

Re: Ask HN: How can I verify that WhatsApp uses E2E encryption?

#10

Post by sdevlin » Thu, Jan 01, 2015, 3:35 PM UTC

Most of the comments so far focus on the fact that WhatsApp is a closed-source system. And just to be clear, it would absolutely be better to have source code. Source code gives you a 1000-foot view of the application and lets you spot obvious problems quickly.

But source code can also lie to you. To really understand what the application is doing, you need to do what security auditors do irrespective of source code availability. Namely:

1. Disassemble the application binary.

2. Debug the running application.

3. Observe the network traffic.

Here's another thing to think about. Suppose the source code were available. How could you trust that the source code provided matches the compiled binary running on your phone? You would need to perform the above steps to verify.