Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any Android app can read your WhatsApp database

bas.bosschert.nl

Post reply on HN
Print view View original

51–60 of 140 posts

Re: Any Android app can read your WhatsApp database

#51

Post by sentenza »

acchow wrote: post #36
pinaceae wrote: post #31

19bn $. No way anyone else at FB could have built this app and given it away for free for years for that price. No way. Totally worth it. 19bn $. Sequoia's deck on the amazing sclaing of 32 devs supporting that many users? well, guess what, they did it through taking shortcuts. Who would have guessed. Totally flabbergasted.

It's also a highly-simplified backend. No multisession (synchronization is hard), no back-end message history searching (search and graphs are hard). They took a lot of shortcuts, which turned out really well for them. Simplification made for a very fast client and a low-latency, low-bandwidth protocol.

Being slim to deliver only essential functionality is one thing, but playing fast and loose with user data is not a shortcut that should be rewarded so lavishly.

Re: Any Android app can read your WhatsApp database

#52

Post by mahyarm »

higherpurpose wrote: post #16
kllrnohj wrote: post #9

Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?

That's why you use TextSecure instead of insecure proprietary "popular" apps. Whatsapp could also use TextSecure's ratcheting protocol, too. Why aren't they? Beats me. Maybe they prefer weaker security for their users.

No it isn't 'prefer'. It's that users don't care about this kind of security in practice, they only care about the kind of security from other people in their personal lives, which is more about privacy controls than actual security.

Because of this, they get no reward from the market if they actually focus on security. Instead they focus on things the market DOES reward them for, which is being fast, never being down, being available everywhere, for the cheapest price, with no annoying ads.

They only have 35 engineers, what they could do is limited. So security becomes priority #50 like for most start ups and only a few token hours efforts are put into place. That single AES key was probably implemented 3.5 years ago.

Re: Any Android app can read your WhatsApp database

#53

Post by Pxtl »

css771 wrote: post #45
Pxtl wrote: post #29

Earlier quoted context omitted.

Honestly, the more I tinker with Android, the more I'm terribly disappointed in Google. I mean, around Android 2 we were all excited by the potential of a first-class big-money supported open-source OS to really shake up the industry. It had so much potential. Now? Well, it still has a lot of potential. Even Google seems kind of embarrassed by it, compared to the Chrome brand.

I've never seen Google put out that vibe. If anything they're proud of it. I'm not sure what you mean. Can you elaborate?

I just mean how they use the "Chrome" branding on everything, even Android-based devices like the Chromecast.

Re: Any Android app can read your WhatsApp database

#54

Post by nathancahill »

sentenza wrote: post #15
kllrnohj wrote: post #9

Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?

What's troubling is, that their security track record has been abysmal from the start. In that regard, the acquisition sends entirely the wrong message.

Sure, the message was sent. But does it have a read receipt?

Re: Any Android app can read your WhatsApp database

#55

Post by acchow »

sentenza wrote: post #51
acchow wrote: post #36

Earlier quoted context omitted.

It's also a highly-simplified backend. No multisession (synchronization is hard), no back-end message history searching (search and graphs are hard). They took a lot of shortcuts, which turned out really well for them. Simplification made for a very fast client and a low-latency, low-bandwidth protocol.

Being slim to deliver only essential functionality is one thing, but playing fast and loose with user data is not a shortcut that should be rewarded so lavishly.

Whoops, I was probably confusing. I meant to say they got to $19bn with shortcuts that worked. A leaky DB is bad and reprehensible corner-cutting.

Re: Any Android app can read your WhatsApp database

#56

Post by kllrnohj »

jcampbell1 wrote: post #43
eropple wrote: post #37

Earlier quoted context omitted.

There is no "tradeoff" here for a reasonably vertebrate hominid. When you demand user trust, security is core. If it's not core, go home because you cannot be trusted to make adult decisions. The people using your software are more important than your fucking term sheets, man.

You do realize all desktop software has this same vulnerability. I think you are being a tad hyperbolic. WhatsApp has some blame, but Google should have figured out how to let applications sandbox data on the SD card without having to do roll your own AES key management system. It could have been as simple as put the data in a folder named "private/appname/".

> Google should have figured out how to let applications sandbox data on the SD

It's called put your data in /data. You get a private app data folder by default. /sdcard and /data are both internal storage on the majority of phones, neither points at a physical sd card slot.

And seriously, who wants their messages stored on /sdcard anyway? You pop out the sdcard and all your text messages vanish? What kind of brain dead decision is that?

Re: Any Android app can read your WhatsApp database

#58

Post by jcampbell1 »

eropple wrote: post #47
jcampbell1 wrote: post #43

Earlier quoted context omitted.

You do realize all desktop software has this same vulnerability. I think you are being a tad hyperbolic. WhatsApp has some blame, but Google should have figured out how to let applications sandbox data on the SD card without having to do roll your own AES key management system. It could have been as simple as put the data in a folder named "private/appname/".

OS X doesn't have that problem when using sandboxed applications. I choose to opt out by installing non-sandboxed applications, but I know that I'm doing so and I don't install non-sandboxed stuff from people I don't trust. I also have much more accessible tools for inspecting the behaviors of applications, should I want to do so, on OS X than Android - I can do my own homework if I have a notion. (I don't expect end…

For what it is worth, I wasn't interested in a privacy debate, but rather technical advice.

I have come to the conclusion after a bit of research, the only way to make this backup work is to require a passphrase, or for the OS to provide sandboxing. Android 4.4 provides the necessary sandboxing. I am sure WhatsApp will use it.

I don't agree with WhatsApp's choice to not require a passphrase, but I at least understand their thinking. They chose frictionless backups with the risk that malicious apps would be able to read you text messages. That is not the choice I would like, but it is not a choice made by an invertebrate.

Hacker News at times reminds me of this scene from the Princess Bride:

http://www.youtube.com/watch?v=18ulbI9k5eA

Re: Any Android app can read your WhatsApp database

#59

Post by baby »

> if the user allows it to access the SD card. And since majority of the people allows everything on their Android device

1. So basically, if you're installing an app AND you're allowing the app to access all of your phone (and its dirty secrets)

2. I don't see why whatsapp would encrypt the chats (I might be very wrong on this one), isn't it better if we can access them offline through a computer if the phone crashes?

3. Bigger picture: at first, dividing permissions and asking for the user to accept them was a good idea, but now we tend to accept anything because in the end, we want to use the app. Same problem with facebook login, google login, where we tend to accept whatever info websites request just to get to the app.

Re: Any Android app can read your WhatsApp database

#60

Post by danielweber »

mahyarm wrote: post #52
higherpurpose wrote: post #16

Earlier quoted context omitted.

That's why you use TextSecure instead of insecure proprietary "popular" apps. Whatsapp could also use TextSecure's ratcheting protocol, too. Why aren't they? Beats me. Maybe they prefer weaker security for their users.

No it isn't 'prefer'. It's that users don't care about this kind of security in practice, they only care about the kind of security from other people in their personal lives, which is more about privacy controls than actual security. Because of this, they get no reward from the market if they actually focus on security. Instead they focus on things the market DOES reward them for, which is being fast, never being dow…

Every security researcher goes through this phase when it dawns on them no one gives a shit about security. It leads to a few years of depression, and then going to work for people who, for whatever reason, really do care about security.
Post reply on HN