Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp backdoor allows snooping on encrypted messages

theguardian.com

Post reply on HN
Print view View original

201–210 of 334 posts

Re: WhatsApp backdoor allows snooping on encrypted messages

#201

Post by aembleton »

How do I know that my Android phone doesn't have a backdoor keylogging everything that I type and uploading it to Google/NSA each night?

I haven't rooted and installed wireshark on this device, but even if I did it could just not send it whilst that is logging. Or, it could be that wireshark doesn't see everything. Or I just wouldn't notice as there are many packets going back and forth between my phone and Google.

I suppose I could install Cyanogen and not install Gapps. But then, how do you know that Cyanogen isn't compromised?

Life's too short. Facebook messenger is convenient and most of my friends use it so I go for it. I just assume that all of my communication and more seriously location data for the last few years are logged with the intelligence agencies.

Re: WhatsApp backdoor allows snooping on encrypted messages

#203

Post by riazrizvi »

geocar wrote: post #130

I remember receiving the downvote brigade[1], when Moxie himself said that I should trust WhatsApp without having the source code and the ability to put it on my device. We (even a "smart" community like HN) clearly do not have the ability to think critically about security, and even when our leaders are sincere -- and I really don't mean to suggest Moxie/Signal was complicit in this move -- we still rush to defend o…

It's always hard to tell whether aggressive down voting is real people or digital marketing campaign driven.

Re: WhatsApp backdoor allows snooping on encrypted messages

#204

Post by anotherboffin »

samsonradu wrote: post #144
jaymzcampbell wrote: post #2

The key part is this, and it was apparently reported back in April 2016 with Facebook replying it's "expected behavior", it's not something a general attacker can do but it would enable WhatsApp/Facebook to read conversations: > WhatsApp has the ability to force the generation of new encryption keys for offline users, unbeknown to the sender and recipient of the messages, and to make the sender re-encrypt messages wi…

I happened to have the Security Notifications on for a while now. I see the message: "X's security code has changed." pretty often. Under what circumstances does a new pair of encryption keys get generated?

A new pair of keys are also generated when a device is wiped and restored from backup (in my experience on iOS).

Re: WhatsApp backdoor allows snooping on encrypted messages

#205

Post by stefek99 »

It's a typical example to CONVENIENCE.

It's convenient to re-send the message.

No one serious of privacy would ever use Facebook / WhatsApp.

So the title is a click-bait. The decision behind re-sending is based purely on convenience and cost-benefit analysis.

Actually I think they should display a notification / popup / warning whatever.

Re: WhatsApp backdoor allows snooping on encrypted messages

#206

Post by andyjohnson0 »

FabHK wrote: post #91
andyjohnson0 wrote: post #3

More details in "WhatsApp Retransmission Vulnerability" [1] from April last year. [1] https://tobi.rocks/2016/04/whats-app-retransmission-vulnerab...

This should be the top post - exactly this vulnerability was announced last year April; it's just that the Guardian picked it up now (with a somewhat clickbait-y headline, to boot).

I'm going to have to come to the Guardian's defence here. We may take issue with the term "backdoor" but, for a general readership, their headline is a good summary of the issue using appropriate language.

Re: WhatsApp backdoor allows snooping on encrypted messages

#207

Post by Moyamo »

therealmarv wrote: post #51

The biggest security issue on WhatsApp are the backups, especially the cloud backups not the protocol and this so called "backdoor" itself. Pictures not encrypted on backups, encryption keys of backups stored on WhatsApp side which might or might not (???) have access to your cloud backups on Google Drive and iCloud. If a government (USA?) gets access to one of your or your friends backups and the encryption key it c…

I've noticed this as well, do they even encrypt the backups the upload to google drive and if so with what key? If they use one key then the advantages of perfect forward and perfect future secrecy that the double-ratchet protocol provides is lost.

Re: WhatsApp backdoor allows snooping on encrypted messages

#208

Post by [deleted] »

whyever wrote: post #142
geocar wrote: post #130

I remember receiving the downvote brigade[1], when Moxie himself said that I should trust WhatsApp without having the source code and the ability to put it on my device. We (even a "smart" community like HN) clearly do not have the ability to think critically about security, and even when our leaders are sincere -- and I really don't mean to suggest Moxie/Signal was complicit in this move -- we still rush to defend o…

> when Moxie himself said that I should trust WhatsApp without having the source code and the ability to put it on my device. What are you talking about? All I can see there is that you asked for the source code of the QR generator and he delivered. He does not say you should trust WhatsApp.

[deleted]

Re: WhatsApp backdoor allows snooping on encrypted messages

#209

Post by benoliver999 »

whyever wrote: post #160
yoo1I wrote: post #112

Earlier quoted context omitted.

I am currently trying out tox with a small number of friends (ok, one friend). I am curious as to what your criticism of tox is. While it seems it's still a bit new, it seems it does all that it claims to do.

It is completely unusable on mobiles because it drains bandwidth and battery.

I use it all the time on desktop. Couldn't even get the mobile app to start.
Post reply on HN