41–50 of 437 posts
Earlier quoted context omitted.
You'd also have to make sure they were the only user that received that binary. Otherwise you'd have to hope that no one reverse engineered the binary and noticed the oddly specific comparison there.
Are reverse engineering techniques currently greater than known ability to obfuscate compiled iOS code?
Earlier quoted context omitted.
You'd also have to make sure they were the only user that received that binary. Otherwise you'd have to hope that no one reverse engineered the binary and noticed the oddly specific comparison there.
Are reverse engineering techniques currently greater than known ability to obfuscate compiled iOS code?
> That would leak information to the server about who has enabled safety number change notifications and who hasn't , effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully. I am not convinced. Why should this option exist at all? Even worse, it is disabled by default. Just enable notifications for everyone and demand verification. If you…
> That would leak information to the server about who has enabled safety number change notifications and who hasn't , effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully. I am not convinced. Why should this option exist at all? Even worse, it is disabled by default. Just enable notifications for everyone and demand verification. If you…
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
51:82:00:1c:7e:6f:ac:ac:de:f1:53:08:1c:7d:55:68.
Please contact your system administrator.
Add correct host key in /Users/user/.ssh/known_hosts to get rid of this message.
Offending RSA key in /Users/user/.ssh/known_hosts:12
RSA host key for 8.8.8.8 has changed and you have requested strict checking.
Host key verification failed.I don't user whatsapp, but a general question to these that do: Can the server change keys twice? Change once to server keys, ask for the entire history retransmission. Change again to revert to original receipient keys. Will the receipient be prompted in that case?
"The WhatsApp clients have been carefully designed so that they will not re-encrypt messages that have already been delivered. Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. This prevents anyone who compromises the server from being able to selectively target previously delivered messages for re-encryption."
Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which u…
He does address this: Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. That means a user is able to verify visually that the end-to-end is working. "users might not notice" doesn't seem to me as a strong argument to state this as a backdoor. This would imply not noticing that you don't have a green padlock on chrome is a backdoor too, and it clearly is not.
There seems to be a pretty clear war going on between engineers and journalists lately. - Chris Latter [1] vs Business Insider [2] - Elon Musk vs (Bunch of outlets) - Moxie vs The Guardian I feel like journalists want to write a compelling story and engineers are on the other side like "No, those aren't facts!" I don't follow a lot of media outlets but it seems like journalists either lack the skills or don't care ab…
Let's avoid our own bias of automatically believing the engineers are in the right; they are fallible people, no more or less honest or prone to error than journalists.
Every news story that breaks, involving any person or industry, gets the same response: It's false, they didn't ask us, etc. etc. Therefore, that response is not an indication that something is wrong (or right); the response tells us nothing in itself.
There seems to be a pretty clear war going on between engineers and journalists lately. - Chris Latter [1] vs Business Insider [2] - Elon Musk vs (Bunch of outlets) - Moxie vs The Guardian I feel like journalists want to write a compelling story and engineers are on the other side like "No, those aren't facts!" I don't follow a lot of media outlets but it seems like journalists either lack the skills or don't care ab…
We can learn one important thing here - it is not possible to trust closed source software. Enough said, next issue please.
What is the user supposed to do when they get notified of a "safety number changed" message? How do they verify they've not just been MITM? Honest question... I don't use whatsapp or signal at all.