Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp backdoor allows snooping on encrypted messages

theguardian.com

Post reply on HN
Print view View original

61–70 of 334 posts

Re: WhatsApp backdoor allows snooping on encrypted messages

#61

Post by qznc »

guidovranken wrote: post #31

From the outset I've always expected that a backdoor was present in Whatsapp. In fact, I'd be surprised if they hadn't granted themselves some special capabilities with regards to the content of the communications. Touting their end-to-end encryption has enticed many people to trust the product, sometimes with strong conviction, while giving themselves a monopoly on access to communication perceived as secure by the…

There is no technical way to defend against the app itself (so WhatsApp/Facebook) and the operating system (Android/Google, iOS/Apple, etc). Transitively, this means no real defense against the US government when they can invoke the "national security" card.

Also, hardware and manufacturer cannot be defended against with software-only. This means Intel, Qualcomm, FoxConn, etc. Transitively, the Chinese Government.

I see no other possibility but trust them or don't use them.

(There is a technical way to fight the OS, but it is not mature/available yet. See Intel SGX.)

Re: WhatsApp backdoor allows snooping on encrypted messages

#62

Post by tinus_hn »

The complaint here seems similar to complaining ssl is insecure because the certificate authorities can create certificates at will.

Whatsapp can't do this without leaving traces and if they did this on a larger scale without only doing it with people that don't care to look for the signs, someone is bound to find out.

Re: WhatsApp backdoor allows snooping on encrypted messages

#63

Post by thinkloop »

therealmarv wrote: post #51

The biggest security issue on WhatsApp are the backups, especially the cloud backups not the protocol and this so called "backdoor" itself. Pictures not encrypted on backups, encryption keys of backups stored on WhatsApp side which might or might not (???) have access to your cloud backups on Google Drive and iCloud. If a government (USA?) gets access to one of your or your friends backups and the encryption key it c…

Agree.

Aside, anyone know why facebook backups on google? That always struck me as strange.

Re: WhatsApp backdoor allows snooping on encrypted messages

#66

Post by qznc »

lucb1e wrote: post #23
pilif wrote: post #14

Earlier quoted context omitted.

> Signal is bad as explained previously, it requires Google on your phone to even work. only for notification delivery. The message payload is not part of the push notification.

He never said it was. Google services aren't isolated like normal apps either, as far as I know they can access other app's data (when installing cyanogenmod, I had to install google apps in some weird way from the bootloader because it has to change protected things on the phone). His point of requiring google's stuff to be installed is valid, even if he wrote it thinking payload gets sent over it.

Even if you don't install Gapps, large parts of Android/CyanogenMod are from Google as well. How does installing Gapps make the security worse?

Re: WhatsApp backdoor allows snooping on encrypted messages

#69

Post by feral »

jstanley wrote: post #40
feral wrote: post #35

I am flagging this article, as the headline and first few paragraphs are very misleading, based on my understanding from: https://tobi.rocks/2016/04/whats-app-retransmission-vulnerab... They make it sound like an intentional backdoor has been introduced to WhatsApp to facilitate monitoring. Rather, it seems like there's a weakness in the implementation, where if a message is undelivered, an attacker could trick the s…

> They make it sound like an intentional backdoor has been introduced to WhatsApp to facilitate monitoring. Rather, it seems like there's a weakness in the implementation If I wanted to install an intentional backdoor, I would do my best to make it look like merely a weakness in the implementation.

Therefore any time we see an implementation weakness it should be reported as an intentional backdoor? Is this really what we want?

What would we then say if we got proof that they actually put an intentional backdoor in? That's clearly a much more serious scenario (if the vendor is surreptitiously working against you, you are much more screwed than the one bug youve found), and it would be nice to be able to communicate it.

I thought that was why we had a word like 'backdoor' vs 'security bug'.

Re: WhatsApp backdoor allows snooping on encrypted messages

#70

Post by FabHK »

wirelessest wrote: post #59
mattcoles wrote: post #49

Earlier quoted context omitted.

As I mentioned in my comment, any exploit that can only be performed by the server is essentially irrelevant as we already can't have perfect trust in the server. edit: I'll respond to everyone as I worded this poorly. What I mean is that an attack that can only be performed by Facebook/WhatsApp(depending on if you believe they are kept separate) is mostly irrelevant as they could always push an update to the App/Pla…

I thought that was the whole point of end-to-end. That you don't need trust in the server because the messages are opaque. If this is an exploit that can be performed by a compromised server, it's very much relevant

So, just to clarify my understanding:

Basically, what we have here is a weakness in the client, namely a provision that allows the server to send the client a fresh key and ask for re-encryption and re-sending with the new key. This, in turn, would allow for a good old MITM attack if the server were to be compromised.

This re-encryption and re-sending of messages would be without intervention by the user, though a message "new key" would be displayed to the user provided they had chosen the option to display such notifications (which are disabled by default).

What's unclear to me is whether only messages that have not yet been delivered would be affected, or all.

Post reply on HN