111–120 of 127 posts
> An UI that is not that technical, but rather starts to emulate the actual WhatsApp Web UI.
No, no, no. This trend of 'Phone UI' chat interfaces on desktop/laptop screens needs to stop. If you are going to all this effort to reverse engineer the protocol, at least make your front end customisable or at the very least IRCish in style.
Earlier quoted context omitted.
It's Russian. You know, like: hand over the encryption keys or you, or someone you love will disappear.
Telegram is actually fighting the Russian government over the encryption keys, saying that it is impossible to hand them over (I assume this is for e2e encrypted secret chats). The consequence of this action is that they'll likely get banned (i.e. removed from app store). How much of this is a farce remains to be seen, since the whole nation, from casual users to small businesses to government employees use the app d…
But to be clear: I have a lot of distrust against governments regarding mass surveillance. But I distrust some governments more than others. And Russia is relatively high on that list for me. I think a healthy dose of distrust would be fitting for Russians citizens too.
The public key of the phone (the first 32 bytes of the variable "secret") is never authenticated by the web-component. Assuming they have the public key of the web-component, the WA Servers could hijack the whole scheme by sending their own public key in the "secret" instead of the phones. MITM doesn't seems possible though as the phone verifies the web-components public key by QR code.
I am no expert so, as I said, maybe I missed something, but relying on keeping a public key secret for security seems icky to me. Or maybe it's stupid to think about that too much, considering that both the phone-application and the servers including the Web API are closed-source anyway and will thus always remain icky security-wise.
Earlier quoted context omitted.
Someone has to roll new crypto, otherwise we're stuck. That said, I know about the potential issues with Telegram's encryption.
You don't roll a new crypto and use it the day after, it must be tested for vulnerabilities, reviewed by expert cryptoanalysts. It can take years, much like a car has to be crash tested, a new crypto algorithm must go through a certain process to be considered good enough.
That said: I belive them when they say that WhatsApps crypto is stronger.
On the other hand I would expect them to leave a little note somewhere about WhatsApp being a data collection tool for Facebook that also still happens to works as an instant messaging platform.
Earlier quoted context omitted.
No, because it is a website.
They also have native apps on most mobile platforms (including Windows Phone, Blackberry and even Nokia Series 40). It isn't as easy to update all of them as one would think.
Earlier quoted context omitted.
That must've taken forever. Do you have any plans to reverse engineer other apps? I know people like you are in short supply and high demand.
It certainly did, but after all it was just a fun spare time project. I guess there would be a lot of interesting software to reverse engineer; I am always open to suggestions that are able to extend my knowledge. And well, if you mean it in context of a job... I don't have any experience regarding the job market yet, but that also sounds quite striking :)
I'm very hopeful this reverse engineering effort will enable the creation of a tool to export my conversations (WhatsApp can do email export, which let's be real, doesn't cut it for most cases). A point to those that support migrating to alternatives such as Signal. Signal is good, but far from great for a single reason: you need a phone number. This is very bad in necsec and reliability terms, my case: Reliability:…
Sounds like you could get a stable VoIP number and just use that. One time cost and has its uses for cheap long distance calling.
Impressive work. Obviously, WhatsApp/Facebook would want to avoid a bunch of third party apps connecting to their service. How long until they make changes to make this more difficult/impossible?
If you have a web API it's impossible to secure it, especially when you have many platforms that access it ( web / mobile ect ... )
Wow that's impressive. But I would imagine WhatsApp/Facebook can just change their protocol at any time since it is easy to redeploy a new version of the WhatsApp Web client, thus breaking any 3p clients built on the original protocol. That would require yet another reverse engineering effort that can take a while. And by the time its reverse engineered again, they can yet again change the protocol. So the only relia…
You can choose your version when you send the requests