WhatsApp is using your IMEI number as password • Hacker News Board

Re: WhatsApp is using your IMEI number as password

#31

Post by ariannahsimpson » Wed, Sep 05, 2012, 9:51 PM UTC

LaGrange wrote: post #30

namuorg wrote: post #20

From your post, it seems like you didn't contact WhatsApp before publishing this post. What was your reasoning for going public with this vulnerability before at least trying to contact them and giving them a chance to resolve the issue?

This is a well-known design decision on their side. This is not as much a discovery as bringing it up.

Is there a particular reason (that you're aware of) for this decision? I'm certainly no expert on the matter, but it seems risky to store everything like that, especially unsalted. LinkedIn, anyone?

Re: WhatsApp is using your IMEI number as password

#32

Post by shmerl » Wed, Sep 05, 2012, 10:12 PM UTC

Can anyone explain in general what is the point in WhatsApp which isn't compatible with anything except itself, vs normative XMPP/Jingle client through which one can communicate with any user from federated XMPP servers? I have hard time understanding why new closed (walled garden) IM networks appear in these day and age.

Re: WhatsApp is using your IMEI number as password

#33

Post by dutchbrit » Wed, Sep 05, 2012, 10:15 PM UTC

aw3c2 wrote: post #29

CrazyRobot wrote: post #28

This actually seems to me like a perfect solution (from WhatsApp's side). This way as long the user has the same phone number, he/she doesn't have to remember any credentials, which is probably the main reason (or one of the top 3) for people using WhatsApp in the first place. And as for the "security problem", if someone has access to your phone they can just maliciously use the app itself. I'm not saying that this…

An unsalted(!) md5(!) is never a perfect solution unless your goal is insecurity. The idea of using the IMEI as unique device dependant string for hash generation is good but you must make it impossible for anyone to find out how the hash is created or it is a glaring security hole (as demonstrated). Many many apps have permissions to read the IMEI. Just as many have access to the internet. Add whatever permission is…

Exactomundo!

Re: WhatsApp is using your IMEI number as password

#34

Post by gipsies » Wed, Sep 05, 2012, 10:18 PM UTC

rjzzleep wrote: post #21

mobweb wrote: post #16

If you installed WhatsApp on an Android device for example, your password is likely to be an inverse of your phones IMEI number with an MD5 encryption thrown on top of it (without salt). How does OP know this? Was there a leak of "passwords" or did he find this through trial & error? Edit: Just found out that's what it says even on the Wikipedia entry about WhatsApp[1]. [1]: http://en.wikipedia.org/wiki/WhatsApp

it's called reverse engineering though. it's much easier to use reverse ios code than that weirdass dex format though imho

You can convert .dex files back to .class files, and then use a java decompiler. Not all functions will be properly decompiled but overall it's still quite good. Knowing this, reversing Android apps is actually a lot easier.

Re: WhatsApp is using your IMEI number as password

#35

Post by mparlane » Wed, Sep 05, 2012, 10:23 PM UTC

eclipxe wrote: post #25

Small nitpick - MD5 is not technically "encryption" From the article: " likely to be an inverse of your phones IMEI number with an MD5 encryption thrown on top" MD5 is a digest...not encryption

He fixed it.

Re: WhatsApp is using your IMEI number as password

#36

Post by adthrelfall » Wed, Sep 05, 2012, 10:28 PM UTC

shmerl wrote: post #32

Can anyone explain in general what is the point in WhatsApp which isn't compatible with anything except itself, vs normative XMPP/Jingle client through which one can communicate with any user from federated XMPP servers? I have hard time understanding why new closed (walled garden) IM networks appear in these day and age.

It got traction because it worked simply with no config and was very cost effective in certain use cases.

I know it was used as a precursor to iMessage type eaperince to send 'texts' and images using only data, so was perfect for communicating across countries with no carrier charges.

Re: WhatsApp is using your IMEI number as password

#37

Post by antrix » Wed, Sep 05, 2012, 10:38 PM UTC

galadriel wrote: post #22

deltaqueue wrote: post #17

An "Ask HN" that's somewhat related: Is Facebook doing something similar on Android? I have left an application update pending for weeks because Facebook requires access to Phone Calls , which allows the application to "determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and the like." This does not sit well with me.

I also don't allow any app requiring those details (unless they are needed obviously, like VoIP), but I think what most companies want is the unique serial number, so they can keep a track of how many unique devices are used by them. But since Android does not gives permission at more granular level, I simply don't install any such app, or don't upgrade one which ask for it. As for Facebook, I am using Tinfoil for Fa…

> Tinfoil for Facebook

And Tinfoil is better integrated with the Android system than the official Facebook app. Click a Facebook link in an app or browser - you'll get Tinfoil as an option to view the link but not the official app.

Re: WhatsApp is using your IMEI number as password

#38

Post by shmerl » Wed, Sep 05, 2012, 10:39 PM UTC

adthrelfall wrote: post #36

shmerl wrote: post #32

Can anyone explain in general what is the point in WhatsApp which isn't compatible with anything except itself, vs normative XMPP/Jingle client through which one can communicate with any user from federated XMPP servers? I have hard time understanding why new closed (walled garden) IM networks appear in these day and age.

It got traction because it worked simply with no config and was very cost effective in certain use cases. I know it was used as a precursor to iMessage type eaperince to send 'texts' and images using only data, so was perfect for communicating across countries with no carrier charges.

So the only point was in avoiding one time step like adding an account to the client (like users do with e-mail too) / or registering on some XMPP server? Still it hardly justifies creating more walled networks (unless they allow federation and regular XMPP communication with their servers).

Re: WhatsApp is using your IMEI number as password

#39

Post by marquis » Wed, Sep 05, 2012, 11:15 PM UTC

shmerl wrote: post #32

Can anyone explain in general what is the point in WhatsApp which isn't compatible with anything except itself, vs normative XMPP/Jingle client through which one can communicate with any user from federated XMPP servers? I have hard time understanding why new closed (walled garden) IM networks appear in these day and age.

It's quite popular in countries where buying SMS credits is not always an afforded cost, but public wifi is everywhere. Basic Android phones are fairly popular and inexpensive given that they double as a web browser and communication device for many.

Re: WhatsApp is using your IMEI number as password

#40

Post by shmerl » Wed, Sep 05, 2012, 11:20 PM UTC

marquis wrote: post #39

shmerl wrote: post #32

Can anyone explain in general what is the point in WhatsApp which isn't compatible with anything except itself, vs normative XMPP/Jingle client through which one can communicate with any user from federated XMPP servers? I have hard time understanding why new closed (walled garden) IM networks appear in these day and age.

It's quite popular in countries where buying SMS credits is not always an afforded cost, but public wifi is everywhere. Basic Android phones are fairly popular and inexpensive given that they double as a web browser and communication device for many.

That's understandable, but my question was about creating WhatsApp vs making a regular conformant XMPP/Jingle client which also simply works through TCP and UDP. The later gives free choice of what XMPP server to use and allows communicating with users of other federated servers. WhatsApp allows communicating only with WhatsApp if I understand correctly.