61–70 of 71 posts
Earlier quoted context omitted.
For the overwhelming majority of people, it would just lead to alert fatigue, where users start ignoring the alerts because 99% of the time they're not actually indicative of a problem.
As much as I agree that alert fatigue is a problem this shouldn't trigger it.
If your threat model is the government compelling Facebook, then you should be using a different product that's geared specifically towards security, such as Signal. WhatsApp is a mass-market product aimed at the whole world, which means it makes different tradeoffs, providing a less comprehensive threat model in favor of higher usability. And that's a perfectly fine thing for this app to do.
What the security community has spent the last 20 or so years coming to grips with is that it's very hard to cover every attack surface, and not wind up with a product that nobody outside of a select few are smart or dedicated enough to use (e.g., GPG), or that people don't just blindly click through endless warnings (e.g., the not-so-distant days of TLS). What we can do is make incremental improvement over the existing tools that people use by covering more in the threat model or improving the usability such that more people use it and/or fewer people ignore important concerns.
As a mass-market anti-surveillance and privacy-enabling chat app, WhatsApp is an incredible success. It's not replacing GPG with a carefully-curated web of trust. It's replacing plaintext SMS.
There are better tools if you know your threat model includes targeted, high-budget attacks the FSB, NSA, or CIA.
Earlier quoted context omitted.
As much as I agree that alert fatigue is a problem this shouldn't trigger it.
[citation needed]
That said, my reasoning went along the lines of:
Where I live at least people rarely switch phone numbers and I have yet to hear about a single person that I know or have worked with who have had their phone number hijacked.
So, lets say that other people are less lucky than me and this warning will pop up twice a year, -will that be enough to trigger warning fatigue?
IMO, probably not.
Will we still have a problem with warning fatigue? Yes. Why? Because of the sticker and warning requirements created by American lawsuits and EU cookie law. (Oh, and IIRC my country isn't much better in this regard, just smaller so less of a problem.)
While not a citation I hope this explains my reasoning.
Earlier quoted context omitted.
[citation needed]
I wrote shouldn't instead of won't. That said, my reasoning went along the lines of: Where I live at least people rarely switch phone numbers and I have yet to hear about a single person that I know or have worked with who have had their phone number hijacked. So, lets say that other people are less lucky than me and this warning will pop up twice a year, -will that be enough to trigger warning fatigue? IMO, probably…
First, it's not about people switching phone numbers. It's about switching devices. This can be something as innocuous as uninstalling/reinstalling the WhatsApp app. Or upgrading their phone on a one or two year cycle. Or because they broke their phone and are using a friend's old phone for a few weeks. Or wanting to send and read messages on their laptop too. And their work laptop. Except they also had their work laptop reinstalled because of a virus, or because IT needed to do an upgrade, or whatever.
This shit happens all the time.
> …and I have yet to hear about a single person that I know or have worked with who have had their phone number hijacked.
I think this proves my point. The signal-to-noise ratio for this type of message is precisely zero for greater than 99.999% of WhatsApp users who are not being singled out by a nation-state for surveillance. And he number of these users who actually bothers to confirm keys out-of-band is, while not precisely zero, near enough as to make no difference.
For users who do anticipate being singled out, there are two plausible options: they are savvy enough to look into the settings and ensure the toggle is enabled, or they're not savvy enough to look for this type of option, and they're probably screwed anyway because actually achieving practical privacy against a highly-funded and highly-motivated governmental adversary is brutally hard and requires significantly more active involvement than merely toggling a switch on a messaging app.
> So, lets say that other people are less lucky than me and this warning will pop up twice a year
Twice a year times fifty contacts adds up to seeing this message frequently enough that you learn to subconsciously ignore it. People still try to bypass virtually every TLS warning browsers throw at them even though that number for most people is less than once per year, and even though browsers have made it painfully difficult to do so.
I didn't quite grasp why attacking entity (e.g. government) has the ability to read messages. What does "WhatsApp has the ability to force the generation of new encryption keys for offline users" mean? Does it mean that WhatsApp backend has the ability to force sender to use pregenerated compromised key provided by attacker? In terms of WhatsApp security whitepaper, does that mean that attacker can force sender to us…
Let's say WhatsApp wants to read the next message sent to user X: 1) WhatsApp makes user X appear offline 2) User Y sends user X a message 3) WhatsApp sends user Y an indication that user X's key has changed, along with the public key for which they have the corresponding private key With these steps, user Y's message will be resent with the new key that WhatsApp knows, and so they can read the message. There is a co…
I didn't quite grasp why attacking entity (e.g. government) has the ability to read messages. What does "WhatsApp has the ability to force the generation of new encryption keys for offline users" mean? Does it mean that WhatsApp backend has the ability to force sender to use pregenerated compromised key provided by attacker? In terms of WhatsApp security whitepaper, does that mean that attacker can force sender to us…
WhatsApp has the ability to change the identity key associated with a user. That's the key they give anyone who wishes to send a message to that user. This is necessary in case the device is lost, wiped or replaced. Changing the identity key triggers a notification for other parties in a conversation if they have enabled that option. However, WhatsApp also automatically re-encrypts any messages that have not been mar…
I wasn't able to find proof for attacker's ability to provide pregenerated key, can you please provide link with/or quote? I also wasn't able to find description of WhatsApp key changing procedure, and intuitively it would be more than strange not to require new identity key be signed with previous one.
I didn't quite grasp why attacking entity (e.g. government) has the ability to read messages. What does "WhatsApp has the ability to force the generation of new encryption keys for offline users" mean? Does it mean that WhatsApp backend has the ability to force sender to use pregenerated compromised key provided by attacker? In terms of WhatsApp security whitepaper, does that mean that attacker can force sender to us…
They don't have the ability to flat out read messages. If they were to impersonate a contact, you would see that the key had changed (assuming you had this on) and you could choose not to talk to that contact until you verified.
Earlier quoted context omitted.
WhatsApp has the ability to change the identity key associated with a user. That's the key they give anyone who wishes to send a message to that user. This is necessary in case the device is lost, wiped or replaced. Changing the identity key triggers a notification for other parties in a conversation if they have enabled that option. However, WhatsApp also automatically re-encrypts any messages that have not been mar…
> to one under their control I wasn't able to find proof for attacker's ability to provide pregenerated key, can you please provide link with/or quote? I also wasn't able to find description of WhatsApp key changing procedure, and intuitively it would be more than strange not to require new identity key be signed with previous one.
The scenario is that someone changes the public key associated with the recipient on WhatsApp's server, which then causes the re-transmission "vulnerability" I described. This could be done either because the government forces them to, or because the server is compromised.
> it would be more than strange not to require new identity key be signed with previous one.
This would not work in practice. Phones can be lost, stolen and/or broken. There would be no way to sign the new key with the old one in any of these scenarios, since the key is only stored on the (lost) device. Forcing the users to back up the keys is not practical either for an app that wants to be an easy replacement for SMS, and depending on how users store those keys, might be less secure.
Earlier quoted context omitted.
> to one under their control I wasn't able to find proof for attacker's ability to provide pregenerated key, can you please provide link with/or quote? I also wasn't able to find description of WhatsApp key changing procedure, and intuitively it would be more than strange not to require new identity key be signed with previous one.
The key is generated on device. WhatsApp acts as a kind of key server (if we want to compare it to GPG) where a sender can look up the public (identity) key of the recipient, which is then used to encrypt the message for the recipient. I'm simplifying a bit here, but the details are not important in this context. The scenario is that someone changes the public key associated with the recipient on WhatsApp's server, w…