Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering WhatsApp Web

github.com

Post reply on HN
Print view View original

101–110 of 127 posts

Re: Reverse Engineering WhatsApp Web

#102

Post by leetbulb »

woolvalley wrote: post #81
gustavmarwin wrote: post #18

I'm very hopeful this reverse engineering effort will enable the creation of a tool to export my conversations (WhatsApp can do email export, which let's be real, doesn't cut it for most cases). A point to those that support migrating to alternatives such as Signal. Signal is good, but far from great for a single reason: you need a phone number. This is very bad in necsec and reliability terms, my case: Reliability:…

Why not use wire then? iMessage works with email addresses too.

I second wire. Love it.

Re: Reverse Engineering WhatsApp Web

#103

Post by sigalor »

letslightafire wrote: post #97
sigalor wrote: post #69

Earlier quoted context omitted.

Hi, I'm sigalor, the original creator of the project. The reverse engineering was almost entirely done using the Chrome debugging tools. That is, pretty-printing the JS source files, setting breakpoints and stepping through the code for hours. When I started, all of this was incredibly difficult, but the longer you do it, the more you get used to it. Additionally, the debugging tools also provide you with looking at…

That must've taken forever. Do you have any plans to reverse engineer other apps? I know people like you are in short supply and high demand.

It certainly did, but after all it was just a fun spare time project. I guess there would be a lot of interesting software to reverse engineer; I am always open to suggestions that are able to extend my knowledge. And well, if you mean it in context of a job... I don't have any experience regarding the job market yet, but that also sounds quite striking :)

Re: Reverse Engineering WhatsApp Web

#104

Post by sigalor »

pankajdoharey wrote: post #101

Why did they not write the backend server for Whatsapp web in Erlang, which the original Whatsapp was mostly written in?

Well, I don't know Erlang (yet) and AFAIK, Erlang is rather focused on fail tolerance, high availability etc., which wasn't really a concern when I started the project. Python and NodeJS are quite good for quickly trying out ideas though.

Re: Reverse Engineering WhatsApp Web

#105

Post by brokenmachine »

alerighi wrote: post #82
spullara wrote: post #34

Earlier quoted context omitted.

Cellphones are far more safe than your computer - especially iPhones. All apps are run in a sandboxed environment and are vetted before being released. Further, the secure enclave is far better at protecting secrets than anything on a typical laptop/desktop machine.

iPhones are secure, maybe they contain backdoors from Apple and we don't know, but Android are not secure at all, especially because most Android vendors usually don't update the OS to the latest security patches, so the majority of the Android phones out there are full of unpatched security vulnerabilities. Also there are not good free software mobile operating systems, sure there is LineageOS and other ROMs that st…

You're talking about Android not being secure because it uses proprietary blobs, but saying that iphones are secure because both the hardware and software is proprietary?

Apple's reality distortion field in full effect...

Neither Android nor iPhone can be considered secure.

Re: Reverse Engineering WhatsApp Web

#106

Post by mikkelam »

severine wrote: post #55
ape4 wrote: post #50

A pidgin plugin would be nice. Oh there seems to be one already - https://github.com/davidgfnet/whatsapp-purple/

There's also a Python library: https://github.com/tgalal/yowsup

Don't even bother with yowsup, you will be banned after wasting a lot of time setting it up

Re: Reverse Engineering WhatsApp Web

#107

Post by pmlnr »

madeofpalk wrote: post #80
pmlnr wrote: post #54

Earlier quoted context omitted.

After playing around with federated XMPP (on my own server): XMPP with OMEMO is brilliant. No battery drain (Conversations and Astrachat tested on android), multi-client e2e encryption, even voice/video is possible. And, being federated, I finally own my identity.

What's the benefit of end-to-end encryption if you don't have anyone on the other end?

I've underestimated XMPP myself, there's a surprising amount of providers out there.

Re: Reverse Engineering WhatsApp Web

#108

Post by gsich »

StavrosK wrote: post #89
gsich wrote: post #87

Earlier quoted context omitted.

Any flaws in Telegrams crypto that lead to decryption?

None discovered yet, just like my new design, this cardboard box on wheels I'd like to offer you as a replacement for your car.

Car comparisons aren't viable.

Re: Reverse Engineering WhatsApp Web

#110

Post by mykull »

spullara wrote: post #34
kome wrote: post #23

Earlier quoted context omitted.

I would like to use Signal, but I am forced to use Telegram for the same reason. (I have also to say that Telegram mac client is pretty awesome). It makes no sense to create a "secure" chat app, and then to force your users to use cellphones, which is the most unsafe technology I can imagine... Why this cellphone fetish?

Cellphones are far more safe than your computer - especially iPhones. All apps are run in a sandboxed environment and are vetted before being released. Further, the secure enclave is far better at protecting secrets than anything on a typical laptop/desktop machine.

no, this is wrong. secure enclave or not. radio chips have direct memory access. phones are only as secure as providers want them to be. Computers actually do what I tell them to --I don't need hacks to "root" them or inspect their behavior.
Post reply on HN