Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

281–290 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#281

Post by tptacek »

digiown wrote: post #262
palata wrote: post #241

Earlier quoted context omitted.

Right, I get what you mean. But in a way, I feel like sometimes it makes sense to not completely open everything. Say a messaging app, it makes sense to not just make it free for all. As a company, if I let you interoperate with my servers that I pay and maintain, I guess it makes sense that I may want to check who you are before. I think?

We probably can't make it free for all, but for something like a messaging app, we also need to recognize that it isn't optional to function in society. It should be regulated more like a utility: - Facebook can still control the identity, but there needs to be a legal recourse for getting banned, and their policies can't discriminate against viewpoints, for example - The client specs should be open so that an altern…

Telegram isn't E2EE by default in the first place (and isn't E2EE for group messages at all).

Re: US has investigated claims WhatsApp chats aren't private

#282

Post by Forgeties79 »

gruez wrote: post #221
Forgeties79 wrote: post #200

Earlier quoted context omitted.

If you have to do a thing that obscures your act it doesn’t change the fact that there are rules for me and not them. We know for a fact they did it. Did their ISP threaten them? Did they get their internet service shut off? Edit: they already won their first case in June against authors. I am very curious to see how that lawsuit goes. Obviously we don’t know the results yet but I would be incredibly surprised to see…

>If you have to do a thing that obscures your act it doesn’t change the fact that there are rules for me and not them. We know for a fact they did it. Did their ISP threaten them? Did they get their internet service shut off? Is there any indication they didn't use a VPN? If they did use a VPN, how is it "there are rules for me and not them", given that anyone can also use VPN to pirate with impunity?

I don’t understand what you’re doing here. They were caught. We know they did it. There are several articles about it. They have been sued over it because it happened. I don’t think anything will come of it, but they clearly did it. It is public knowledge.

Re: US has investigated claims WhatsApp chats aren't private

#283

Post by maqp »

vimda wrote: post #189
vbezhenar wrote: post #87

Whatsapp is considered insecure and banned from use for military in Russia. Telegram, on the other hand, is widely used. Of course that's not something definitive, but just a food for thought.

Telegram which famously didn't have _any_ end to end encryption for ages, and even now only has very limited opt-in "secret chats"?

Yeah Telegram only has 1:1 opt-in E2EE, that you can't use across your devices, so either you or your buddy quickly gets tired of whipping out their phone when they're sitting at their laptop, and just replies you through Telegram's non-E2EE cloud chats, and that's the backdoor. The user activated it. It's "their fault".

Re: US has investigated claims WhatsApp chats aren't private

#284

Post by oofbey »

mike_d wrote: post #272
prakashn27 wrote: post #177

Ex-WhatsApp engineer here. WhatsApp team makes so much effort to make this end to end encrypted messages possible. From the time I worked I know for sure it is not possible to read the encrypted messages. From business standpoint they don’t have to read these messages, since WhatsApp business API provide the necessary funding for the org as a whole.

I have no doubt that that rank and file engineers were not aware of the underlying functionality that allowed for plain text content to be read. Nobody would ever create a SendPlainTextToZuck() function that had to be called on every message. It would be as simple as using a built in PRNG for client side key generation and then surreptitiously leaking the initial state (dozens of bytes) once in a nonce signing or som…

I’ve often thought one of Zuck’s superpowers is in finding ways to get smart and moral people to do truly evil things. Sometimes it’s mind games. Sometimes it’s careful layers of obfuscation.

Here it might be: This analytics package is dynamically loaded at runtime because reasons. This abuse flagging and review system is bundled with analytics because reasons. This add on for reconfiguring how the analytics package behaves at runtime, and has a bunch of switches nobody remembers why they’re here but don’t touch them they’re fragile.

Re: US has investigated claims WhatsApp chats aren't private

#285

Post by palata »

digiown wrote: post #262
palata wrote: post #241

Earlier quoted context omitted.

Right, I get what you mean. But in a way, I feel like sometimes it makes sense to not completely open everything. Say a messaging app, it makes sense to not just make it free for all. As a company, if I let you interoperate with my servers that I pay and maintain, I guess it makes sense that I may want to check who you are before. I think?

We probably can't make it free for all, but for something like a messaging app, we also need to recognize that it isn't optional to function in society. It should be regulated more like a utility: - Facebook can still control the identity, but there needs to be a legal recourse for getting banned, and their policies can't discriminate against viewpoints, for example - The client specs should be open so that an altern…

> but there needs to be a legal recourse for getting banned

Agreed.

> The client specs should be open so that an alternate client can be implemented

An example that comes to mind is Signal, where they don't want that. They get a lot of criticism for it of course, but I think it the reasoning actually makes sense: in terms of security, allowing third-party clients is a security risk. If your threat model is "people who risk their life using it", it makes sense, right?

Under the EU's Digital Markets Act, WhatsApp is considered a gatekeeper (Signal is not) and has to be open to interoperability. It seems like they do audit the implementations in order to make sure that the security is not too bad. Which makes sense again, but has a cost. For Meta, that's fine. For Signal... I don't know.

Also WhatsApp will - if I understand correctly - make it very clear that you are talking to someone on a third-party client (and again they get a lot of criticism for that). But I think it makes sense... If WhatsApp was so open that every second client was pretty much a spyware, that would defeat the purpose of E2EE messaging.

Not that I strongly disagree, but just saying that it seems... complicated.

Re: US has investigated claims WhatsApp chats aren't private

#287

Post by yarauuta »

prakashn27 wrote: post #177

Ex-WhatsApp engineer here. WhatsApp team makes so much effort to make this end to end encrypted messages possible. From the time I worked I know for sure it is not possible to read the encrypted messages. From business standpoint they don’t have to read these messages, since WhatsApp business API provide the necessary funding for the org as a whole.

So how was Andreas Schjelderup caught sharing minor content?

Re: US has investigated claims WhatsApp chats aren't private

#288

Post by maqp »

hiprob wrote: post #114

I know the default assumption with Telegram is that they can read all your messages, but unlike WhatsApp they seem less cooperative and I never got the notion that they ever read private messages until the Macron incident, and even then they do if the other party reports them. How come they are able to be this exception despite not having end to end encryption by default?

>I know the default assumption with Telegram is that they can read all your messages

The client is open source. It's trivial to verify this is 100% factually happening. They have access to every group message. Every desktop message. Every message by default. If you enable secret chats for 1:1 mobile chats, you are now disclosing to Telegram you're actively trying to hide something from them, and if there ever was metadata worth it for Keith Alexander to kill someone over, it's that.

>they seem less cooperative and I never got the notion that they ever read private messages until the Macron incident

We have no way to verify Telegram isn't a Russian OP. I'd love to say Pavel Durov fled for his life into exile https://www.nytimes.com/2014/12/03/technology/once-celebrate...

But the "fugitive" has since visited Russia over SIXTY times https://kyivindependent.com/kremlingram-investigation-durov/

Thus, I wouldn't be as much concerned about what they're handing EUROPOL, but what they're handing FSB/SVR.

Even if Telegram never co-operated with Russian intelligence, who here thinks Telegram team, that can't pull off the basic thing of "make everything E2EE" that ~all of its competition has successfully done, can harden their servers against Russian state sponsored hackers like Fancy Bear, who obviously would never make noise about successful breach and data exfiltration.

>How come they are able to be this exception despite not having end to end encryption by default?

They've pushed out lie about storing cloud chats across different servers in different jurisdictions. Maybe that scared some prosecutors off. Or maybe FVEY is inside TG's servers too, and they don't like the idea of going after users as that would incentivize deployment of usable E2EE.

Who knows. Just use Signal.

Re: US has investigated claims WhatsApp chats aren't private

#289

Post by anonymars »

refulgentis wrote: post #243
JasonADrury wrote: post #237

Earlier quoted context omitted.

>Expalin how you detect a branched/flaged sendKey (or whatever it would be called) call in the compiled WhatsApp iOS app? Vastly easier than spotting a clever bugdoor in the source code of said app.

Putting it all on the table: do you agree with the claim that binary analysis is just as good as source code analysis?

Empirically it doesn't look like there's a meaningful difference, does it?

Not having the source code hasn't stopped people from finding exploits in Windows (or even hardware attacks like Spectre or Meltdown). Having source code didn't protect against Heartbleed or log4j

I'd conclude it comes down to security culture (look how things changed after the Trustworthy Computing initiative, or OpenSSL vs LibreSSL) and "how many people are looking" -- in that sense, maybe "many eyes [do] make bugs shallow" but it doesn't seem like "source code availability" is the deciding factor. Rather, "what are the incentives" -- both on the internal development side and the external attacker side

Re: US has investigated claims WhatsApp chats aren't private

#290

Post by zatertip »

yarauuta wrote: post #287
prakashn27 wrote: post #177

Ex-WhatsApp engineer here. WhatsApp team makes so much effort to make this end to end encrypted messages possible. From the time I worked I know for sure it is not possible to read the encrypted messages. From business standpoint they don’t have to read these messages, since WhatsApp business API provide the necessary funding for the org as a whole.

So how was Andreas Schjelderup caught sharing minor content?

According to Kristeligt Dagblad in Denmark, he was using Snapchat: https://www.kristeligt-dagblad.dk/tidligere-superligaspiller...
Post reply on HN