I find this hardly surprising. Somehow the USA government is very, very good at convincing companies to spy on their users.
WhatsApp backdoor allows snooping on encrypted messages
151–160 of 334 posts
Re: WhatsApp backdoor allows snooping on encrypted messages
#152Earlier quoted context omitted.
'As such I think it's unfair to just complain about WhatsApp here.' I disagree. WhatsApp have a known vulnerability which they won't fix (indeed they deliberately added this vuln on top of the Signal protocol), and no denial that they have used this vulnerability in the past. They made a big PR song and dance about this feature only to backdoor it. That deserves criticism.
> I disagree. WhatsApp have a known vulnerability which they won't fix (indeed they deliberately added this vuln on top of the Signal protocol) how would you fix it without causing notification-blindness?
Isn't this a warning that only shows up when someone gets a new phone? That shouldn't cause many notifications.
Re: WhatsApp backdoor allows snooping on encrypted messages
#153No matter what IM service you use: As long as they manage the public keys for their users, they will be vulnerable to exactly this problem. This isn't just WhatsApp. This applies to iMessage and Signal too. In all cases, we rely on the word of the service provider that they don't sneak additional public keys to encrypt for into the clients and in all cases we hear that doing so would cause a message dialog to appear,…
I don't think people switch phones often enough for the warnings to be a nuisance or be ignored. I agree that a lot of people would be very confused when they see the error, though, and while it's easy enough to explain even in layman's terms, I don't think it would help. I think that's it's totally fair to complain about WhatsApp, since the issue mentioned is separate from the more general problem you describe; they…
> I don't think people switch phones often enough for the warnings to be a nuisance or be ignored.
apparently in some countries they do and that's a reason to compromise the rest of the world..
just summarising how bizarre this excuse really is.
make it an opt-in setting, in some countries reliable connectivity in a situation of frequently changing devices (the more I think about it, the more contrived it sounds) might be more important than privacy, but in others it very much isn't and the consequences for failing privacy are much worse than missing a message between swapping of devices.
that's not a tradeoff you should get to make for everyone.
the error message itself (I have it on) is not at all obtrusive btw, it's a friendly yellow (like the old Google ads) small type, which a user will either ignore or get a vague sense of unease about not being secure (which is exactly correct), I don't see how this can be further confusing.
Re: WhatsApp backdoor allows snooping on encrypted messages
#154"Asked to comment specifically on whether Facebook/WhatApp had accessed users’ messages and whether it had done so at the request of government agencies or other third parties, it directed the Guardian to its site that details aggregate data on government requests by country." This is why people should try and use Signal instead of WhatsApp. You can't trust Facebook to care about your privacy.
It seems hard to expect full privacy from any company based in the US given the government's tendency to force them to allow access.
When the US government asked OWS for data on some users, all they got was the telephone number and the date of the last login.
Re: WhatsApp backdoor allows snooping on encrypted messages
#155Well, I kind of feel that I have to repost my comment on this old thread[1] with regards to the government of Egypt blocking Signal application: "Isn't it "weird" that they chose to block Signal app and not the signal-protocol based Whatsapp? If Whatsapp really implements the same kind of security and privacy measures that Signal does, why is Whatsapp allowed to continue operating? If signal is preventing them spy on…
This is a nice idea, but it's also baseless speculation. You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor whenever they want to (for those who haven't actually read the article: this backdoor only works when WhatsApp issues a key change for a conversation, and only then in certain circumstances). In other words, you imply that Egypt said "Hey WhatsApp, p…
> You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor whenever they want to (for those who haven't actually read the article: this backdoor only works when WhatsApp issues a key change for a conversation, and only then in certain circumstances). In other words, you imply that Egypt said "Hey WhatsApp, please actively hack into your Egyptian users' messages and send us the results" and WhatsApp said "ok sure here ya go".
No, the private hackers Govs hire were able to use an exploit to snoop on Whatsapp. That's very probable.
Re: WhatsApp backdoor allows snooping on encrypted messages
#156The key part is this, and it was apparently reported back in April 2016 with Facebook replying it's "expected behavior", it's not something a general attacker can do but it would enable WhatsApp/Facebook to read conversations: > WhatsApp has the ability to force the generation of new encryption keys for offline users, unbeknown to the sender and recipient of the messages, and to make the sender re-encrypt messages wi…
I happened to have the Security Notifications on for a while now. I see the message: "X's security code has changed." pretty often. Under what circumstances does a new pair of encryption keys get generated?
I think when people swap sims in their device it triggers a key change
Re: WhatsApp backdoor allows snooping on encrypted messages
#157C'mon we know this already, it's not a backdoor.
This has been known and is discussed in the protocol and forums as the trade off in ease-of-use versus validation. For people wanting security, they simply check the verify keys, warn on key change. For people who don't care as much about verifying the recipient, they don't know about the feature, and don't use it, but they still get pretty good security, can upgrade to verifying if the choose, all without having to re-key or change protocols/messenger apps.
Re: WhatsApp backdoor allows snooping on encrypted messages
#158Has anyone heard anything from Moxie Marlinspike on this? Would be interesting to hear his perspective - Open Whisper Systems helped out with the encryption.
Well there are two possible scenarios I can envisage. a) The issue was an oversight and simply a bug that needs to be fixed. The question is why FB doesn't want it fixed? b) Moxie knew that this issue existed but was NDA'ed into leaving it there for nefarious purposes. Now it's public knowledge, where do we go from here?
If one of those was fact I would guess "a".
Re: WhatsApp backdoor allows snooping on encrypted messages
#159Well, I kind of feel that I have to repost my comment on this old thread[1] with regards to the government of Egypt blocking Signal application: "Isn't it "weird" that they chose to block Signal app and not the signal-protocol based Whatsapp? If Whatsapp really implements the same kind of security and privacy measures that Signal does, why is Whatsapp allowed to continue operating? If signal is preventing them spy on…
Possibly answers your question: https://news.ycombinator.com/item?id=13234211
Re: WhatsApp backdoor allows snooping on encrypted messages
#160Earlier quoted context omitted.
This makes no sense in so many ways. I suggest you read more on exactly how Signal relies on Google. It does not at all compromise the encryption protocol. Also Tox? Good luck with that.
I am currently trying out tox with a small number of friends (ok, one friend). I am curious as to what your criticism of tox is. While it seems it's still a bit new, it seems it does all that it claims to do.
It is completely unusable on mobiles because it drains bandwidth and battery.