There was some discussion here: https://news.ycombinator.com/item?id=16114809
Attack of the Week: Group Messaging in WhatsApp and Signal
31–36 of 36 posts
Re: Attack of the Week: Group Messaging in WhatsApp and Signal
#32I wrote a brain dump about my thoughts on that here: https://www.cryptologie.net/article/437/on-real-world-crypto... tl;dr is "I'd say the problem is in the reaction, not in the published analysis."
The problem once again are the journalists making up stuff for clicks. Remove the journalists from the equation and you will see there's no problem.
The article is by a cryptographer at Johns Hopkins, not a journalist.
Re: Attack of the Week: Group Messaging in WhatsApp and Signal
#33I have been subject of a probing attack on Signal. The attacker put a collection of messages into a group chat and see which ones made it in. Randomly, I am in a group Signal chat with 8-9 other people in my area code.
Re: Attack of the Week: Group Messaging in WhatsApp and Signal
#34Seems like this could be fixed fairly easily with a set of gatekeeper options. When a group gets created, you could have the option of making the group Public (anyone can join), Invite-Only (anyone can join with an invitation from someone already in the group), or Vetted (requires an invitation to join and the person who made the group must approve each person who tries to join).
That way, you account for varying levels of paranoia.
Re: Attack of the Week: Group Messaging in WhatsApp and Signal
#35"This means the privacy of your end-to-end encrypted group chat is only guaranteed if you actually trust the WhatsApp server." "This undermines the entire purpose of end-to-end encryption." "And yet, the entire point of end-to-end encryption is to remove the server from the trusted computing base." "The challenge here is that since WhatsApp itself determines who the administrators are, this isn't quite so simple." No…
Hyperbolic much? This is a weakness that not only requires WhatsApp to be malicious but to not care about the trivial visibility of an exploit (the client would still display the extra person being added to the group chat).
Malicious can happen through server compromise, too.
Re: Attack of the Week: Group Messaging in WhatsApp and Signal
#36It seems like all signal has to do is to take the step of validating that the member sending the "group management" message is already in the group first.