Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp backdoor allows snooping on encrypted messages

theguardian.com

Post reply on HN
Print view View original

291–300 of 334 posts

Re: WhatsApp backdoor allows snooping on encrypted messages

#291

Post by wyldfire »

pmoriarty wrote: post #260
EGreg wrote: post #190

Earlier quoted context omitted.

Can you make an unblockable app?

An app that effectively used steganography[1] would probably come the closest to being an "unblockable app". As long as they don't detect that communication is going on, they can't usually block it -- short of blocking everything, which is rarely practical for long. Some other interesting reading is: [2], [3], and [4] [1] - https://en.wikipedia.org/wiki/Steganography [2] - https://en.wikipedia.org/wiki/Covert_channel…

It would quickly reveal itself either by overtly disclosing its purpose on the app store it's indexed in or through a HUMINT/leaks.

Re: WhatsApp backdoor allows snooping on encrypted messages

#292

Post by jgaa »

MichaelGG wrote: post #264
jgaa wrote: post #192

Earlier quoted context omitted.

You can get some idea by looking at where the packages are going - but in todays ipv4 space, most p2p packages have to transit trough some public IP addresses. That means that, unless you are able to decrypt the traffic, it will be difficult to know if someone is listening in on the conversation. Also, just by looking at the packages, you will not have any means to detect back-doors, unless they are accessed while yo…

So just look at the actual code executing. Should be fairly easy to tell if there's some huge secret function in the binary.

Well - you know, when you strip the symbols from the optimized binaries, the "huge_exploit_nsa_hook()" function kind of morphs into 0x66666666 or some other seemingly random number. Besides, I knew only one programmer who could read binary dumps of a program and instantly tell what id did. That was 30 years ago, when executables were measured in kilobytes.

Re: WhatsApp backdoor allows snooping on encrypted messages

#293

Post by breatheoften »

I think it is worth changing the behavior of the client to fix this. At time of sending the recipient's key is known -- there should be no circumstances where the message is re-encrypted for a different recipient without the sender's explicit involvement...

Re: WhatsApp backdoor allows snooping on encrypted messages

#294

Post by hughes »

frabbit wrote: post #265
mentat wrote: post #259

Earlier quoted context omitted.

Yes, well done.

I feel bad now. I'm just highly frustrated that everyone is not actuated by the idea "if they _can_ spy on you, then they _will_". Any appeal to morals/integrity/laws are essentially moot in this area. We have the ability to protect ourselves and we should be using it. https://www.eff.org/deeplinks/2017/01/obama-expands-surveill...

"They have no reason to look" is to me equivalent to "I have nothing to hide".

Both may be true, but both willfully surrender control of the situation.

Re: WhatsApp backdoor allows snooping on encrypted messages

#295

Post by anoother »

> The recipient is not made aware of this change in encryption, while the sender is only notified if they have opted-in to encryption warnings in settings, and only after the messages have been re-sent.

Surely this is backwards. It's the recipient who is notified about key changes when the relevant setting is enabled.

Re: WhatsApp backdoor allows snooping on encrypted messages

#296

Post by pmoriarty »

wyldfire wrote: post #291
pmoriarty wrote: post #260

Earlier quoted context omitted.

An app that effectively used steganography[1] would probably come the closest to being an "unblockable app". As long as they don't detect that communication is going on, they can't usually block it -- short of blocking everything, which is rarely practical for long. Some other interesting reading is: [2], [3], and [4] [1] - https://en.wikipedia.org/wiki/Steganography [2] - https://en.wikipedia.org/wiki/Covert_channel…

It would quickly reveal itself either by overtly disclosing its purpose on the app store it's indexed in or through a HUMINT/leaks.

First, just because an adversary understands how a given steganography app works, or knows that it exists doesn't mean that they can detect the specific communication that's occurring, or will move to block that communication.

The canonical image hiding stego applications are a case in point, where the applications are widely distributed and understood, but in principle (if not in practice due to steganalysis[1]) one could know of their existence and how they work but still be unable to detect that covert communication through them was going on, nor be able to block that communication short of blocking all image posting.

Second, they need not be on any app store.

Third, any leaks about their existence, if they come at all, may come too late. As Napoleon said, it's not necessary to censor the news -- it's sufficient to delay it until it no longer matters.

[1] - https://en.wikipedia.org/wiki/Steganalysis

Re: WhatsApp backdoor allows snooping on encrypted messages

#297

Post by arghIdontwantto »

Sgt_Apone wrote: post #257
Moyamo wrote: post #207

Earlier quoted context omitted.

I've noticed this as well, do they even encrypt the backups the upload to google drive and if so with what key? If they use one key then the advantages of perfect forward and perfect future secrecy that the double-ratchet protocol provides is lost.

Messages and media backed up to Google Drive are "not protected by WhatsApp end-to-end encryption while in Google Drive" according the app.

Hey

You replied to me about a month ago concerned about my health when I was dealing with issues with my wife: https://news.ycombinator.com/item?id=13039203

I couldn't reply to that as it is too old, but wanted to tell you that we talked and we ended up parting ways. While things are still in a turmoil, it seems like some kind of window opened and hope is out there again.

Just wanted to thank you for the concern showed then.

Happy new year!!

Re: WhatsApp backdoor allows snooping on encrypted messages

#298

Post by drdaeman »

whyever wrote: post #270
drdaeman wrote: post #195

Earlier quoted context omitted.

Ahem. Don't they also have contact information? From https://whispersystems.org/blog/contact-discovery/ and lack of future follow-ups on the subject, I believe they do. Possibly, hashed or obfuscated, but still recoverable. Which must mean either I'm misunderstanding something (e.g. things had changed since the blog post was published and relevant GitHub issues were closed), or they had not disclosed some information…

You can look at the published court documents: https://www.documentcloud.org/documents/3120046-Open-Whisper... The page I linked was the full data they disclosed.

Thanks.

Seems that they either somehow don't have contact info (but then - how contact discovery's working?) or they had failed to comply with court order. Or I'm really not getting something, which is also well possible (and quite probable) explanation.

Upd: Hmm... or maybe the user had no contacts.

Re: WhatsApp backdoor allows snooping on encrypted messages

#299

Post by detaro »

drdaeman wrote: post #298
whyever wrote: post #270

Earlier quoted context omitted.

You can look at the published court documents: https://www.documentcloud.org/documents/3120046-Open-Whisper... The page I linked was the full data they disclosed.

Thanks. Seems that they either somehow don't have contact info (but then - how contact discovery's working?) or they had failed to comply with court order. Or I'm really not getting something, which is also well possible (and quite probable) explanation. Upd: Hmm... or maybe the user had no contacts.

I think they just don't keep the contact list. It is uploaded, but only matched against the list of subscribed users at the time of the upload and then deleted. Only downside is that if a contact joins later and does not have you in its contact list you don't get notified, or only when you recheck your contact list.

Your link above says at the end:

For TextSecure, however, we've grown beyond the size where that remains practical, so the only thing we can do is write the server such that it --- doesn't store the transmitted contact information ---, inform the user, and give them the choice of opting out.

Post reply on HN