Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering WhatsApp Web

github.com

Post reply on HN
Print view View original

41–50 of 127 posts

Re: Reverse Engineering WhatsApp Web

#41

Post by lozenge »

lxglv wrote: post #10
aylons wrote: post #7

Earlier quoted context omitted.

Signal. It is at least as secure as Whats App by design, has pratically the same interface and also a Chrome-based desktop app that works untethered from the phone app.

Out of curiosity: I’ve noticed a long-term sceptical attitude to telegram in HN audience and have seen multiple arguments against it. Something like that their crypto can’t be trusted, that it’s not time-proven. Don’t you know any good source with some sort of domain expert explanation, why shouldn’t it be used or trusted? No intention to start any flame against Signal, only curiosity regarding telegram flaws. Person…

They rolled their own crypto. Just Google "telegram security" and you'll find explanations of why that's a red flag.

Re: Reverse Engineering WhatsApp Web

#42

Post by Analemma_ »

lxglv wrote: post #10
aylons wrote: post #7

Earlier quoted context omitted.

Signal. It is at least as secure as Whats App by design, has pratically the same interface and also a Chrome-based desktop app that works untethered from the phone app.

Out of curiosity: I’ve noticed a long-term sceptical attitude to telegram in HN audience and have seen multiple arguments against it. Something like that their crypto can’t be trusted, that it’s not time-proven. Don’t you know any good source with some sort of domain expert explanation, why shouldn’t it be used or trusted? No intention to start any flame against Signal, only curiosity regarding telegram flaws. Person…

> Don’t you know any good source with some sort of domain expert explanation, why shouldn’t it be used or trusted?

People like tptacek have talked here at length about why Telegram is not trustworthy, you can see a history of his comments with a simple search: https://hn.algolia.com/?query=tptacek%20telegram&sort=byPopu.... Moxie Marlinspike has also pointed out a bunch of problems with Telegram, and even if you don't consider him a trustworthy source because he runs a competing service, the technical reasoning behind his opinions is sound.

If you want a personal POV, here are three reasons why Telegram is a bad idea:

1) The large number of unsound technical decisions. See Thomas and Moxie's many comments for details, or the "Security" section on its Wikipedia page.

2) Within days of launching, they had a critical security vulnerability: https://news.ycombinator.com/item?id=6948742. Frankly, this alone should have discredited them forever, especially considering how much boasting they were doing beforehand, but people are stupid.

3) They have a consistent pattern of responding to criticism not with technical defenses, but with ad hominem attacks and conspiracy theories ("You're paid by the US Government!")

Re: Reverse Engineering WhatsApp Web

#43

Post by lima »

throwafk81 wrote: post #3
anonu wrote: post #2

Impressive work. Obviously, WhatsApp/Facebook would want to avoid a bunch of third party apps connecting to their service. How long until they make changes to make this more difficult/impossible?

Let's hope it does not take them much, because I don't like spam.

There are much easier methods to spam, and they're very good at dealing with them.

This is only useful for real users who want to write custom applications that connect to their phones.

Re: Reverse Engineering WhatsApp Web

#45

Post by eitland »

StudentStuff wrote: post #16
soziawa wrote: post #11

Earlier quoted context omitted.

It's not even end to end encrypted by default. That's the main reason why you shouldn't use it.

This right here, how can such a basic step to protect your users be skipped?

Same way as in email, banking etc?

Also I find it puzzling that so many people here keeps on recommending WhatsApp over Telegram after all the lies from WhatsApps owner.

Edit: While I have no way to verify this, AFAIK both Telegram and Gmail stores data and keys in ways that makes them hard to access by everyone except for the user.

Telegram in particular say they do this by storing data and keys in different datacenters in different jurisdictions.

Add to this that WhatsApp has had their fair share of issues as well before they started working with Moxie.

Re: Reverse Engineering WhatsApp Web

#46

Post by kome »

spullara wrote: post #34
kome wrote: post #23

Earlier quoted context omitted.

I would like to use Signal, but I am forced to use Telegram for the same reason. (I have also to say that Telegram mac client is pretty awesome). It makes no sense to create a "secure" chat app, and then to force your users to use cellphones, which is the most unsafe technology I can imagine... Why this cellphone fetish?

Cellphones are far more safe than your computer - especially iPhones. All apps are run in a sandboxed environment and are vetted before being released. Further, the secure enclave is far better at protecting secrets than anything on a typical laptop/desktop machine.

but:

- you are tracked everywhere - you don't control the software for real - you have almost no control on connectivity - it's super difficult to kill a process

etc.

Re: Reverse Engineering WhatsApp Web

#48

Post by detaro »

Thaxll wrote: post #5
anonu wrote: post #2

Impressive work. Obviously, WhatsApp/Facebook would want to avoid a bunch of third party apps connecting to their service. How long until they make changes to make this more difficult/impossible?

If you have a web API it's impossible to secure it, especially when you have many platforms that access it ( web / mobile ect ... )

You can change it often enough to be really annoying though. And Whatsapp bans users of third-party clients it can detect. At least the users I know stopped trying these things after a while.
Post reply on HN