WhatsApp backdoor allows snooping on encrypted messages

Post by Jarwain » Fri, Jan 13, 2017, 7:24 PM UTC

FabHK wrote: post #70

wirelessest wrote: post #59

Earlier quoted context omitted.

I thought that was the whole point of end-to-end. That you don't need trust in the server because the messages are opaque. If this is an exploit that can be performed by a compromised server, it's very much relevant

So, just to clarify my understanding: Basically, what we have here is a weakness in the client , namely a provision that allows the server to send the client a fresh key and ask for re-encryption and re-sending with the new key. This, in turn, would allow for a good old MITM attack if the server were to be compromised. This re-encryption and re-sending of messages would be without intervention by the user, though a m…

Post by WillPostForFood » Fri, Jan 13, 2017, 7:38 PM UTC

kordless wrote: post #228

MrsPeaches wrote: post #128

Earlier quoted context omitted.

Simple explanation would be that activists use Signal. [1] They don't trust WhatsApp and rely on Signal for secure messaging. Blocking Signal means they are able to target activists without impacting much of the rest of the population. [1] Many of the people I know who are activists in countries where they need to protect their identities use Signal

There is no logical way to verify that all activists (or even a majority of them) use Signal over WhatsApp. The perception that activists use Signal may have been enough to block them, but having a huge backdoor in WhatsApp is reason enough to not take action.

Post by rhizome » Fri, Jan 13, 2017, 7:46 PM UTC

OJFord wrote: post #284

rhizome wrote: post #280

Earlier quoted context omitted.

but we must be careful not to think it immediately makes the code sound nobody is saying it's automatically sound, but open is the only option that makes any security analysis possible.

> open is the only option that makes any security analysis possible I'm not disputing that. Let me repeat myself: > Open beats closed All I'm saying is that it doesn't stop there. Too often there's this complacent 'great, it's open source!' - I'm as guilty of it as anyone.

Post by pvg » Fri, Jan 13, 2017, 7:55 PM UTC

geocar wrote: post #130

I remember receiving the downvote brigade[1], when Moxie himself said that I should trust WhatsApp without having the source code and the ability to put it on my device. We (even a "smart" community like HN) clearly do not have the ability to think critically about security, and even when our leaders are sincere -- and I really don't mean to suggest Moxie/Signal was complicit in this move -- we still rush to defend o…

Post by swegg » Fri, Jan 13, 2017, 8:03 PM UTC

jyrkesh wrote: post #261

seppin wrote: post #155

Earlier quoted context omitted.

> You're implying that WhatsApp, Inc. gave the Egyptian government the ability to remotely retrigger this backdoor whenever they want to (for those who haven't actually read the article: this backdoor only works when WhatsApp issues a key change for a conversation, and only then in certain circumstances). In other words, you imply that Egypt said "Hey WhatsApp, please actively hack into your Egyptian users' messages…

Yeah, but that's not how the exploit would work. If you read the article, the "backdoor" is that WhatsApp could "generate" a new private key without your knowledge. Except that instead of generating a key, they'd use a well-known key. From there, they could give that key to state actors, or they could decrypt the traffic themselves and give it to state actors. Either way, you need server side control of WhatsApp.