Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering WhatsApp Web

github.com

Post reply on HN
Print view View original

61–70 of 127 posts

Re: Reverse Engineering WhatsApp Web

#61

Post by pmlnr »

lozenge wrote: post #41
lxglv wrote: post #10

Earlier quoted context omitted.

Out of curiosity: I’ve noticed a long-term sceptical attitude to telegram in HN audience and have seen multiple arguments against it. Something like that their crypto can’t be trusted, that it’s not time-proven. Don’t you know any good source with some sort of domain expert explanation, why shouldn’t it be used or trusted? No intention to start any flame against Signal, only curiosity regarding telegram flaws. Person…

They rolled their own crypto. Just Google "telegram security" and you'll find explanations of why that's a red flag.

Someone has to roll new crypto, otherwise we're stuck. That said, I know about the potential issues with Telegram's encryption.

Re: Reverse Engineering WhatsApp Web

#62

Post by pmlnr »

blueplanet200 wrote: post #12
StavrosK wrote: post #9

Earlier quoted context omitted.

It's also exactly as open as WhatsApp, but not as usable.

Signal is open source both client and server. To my knowledge the same isn't true for WhatsApp.

Open Source, relies only on Twilio, AWS, GMC, and Apple Push. https://github.com/signalapp/Signal-Server/blob/master/confi...

Re: Reverse Engineering WhatsApp Web

#63

Post by pmlnr »

Vinnl wrote: post #35
StavrosK wrote: post #20

Earlier quoted context omitted.

It's open source, but Moxie has said he doesn't want federation. I don't think he'd be okay with someone writing a third-party client, for example.

He doesn't, but only because of the maintenance burden that would bring: https://github.com/LibreSignal/LibreSignal/issues/37#issueco... I'm sure if a third-party client would contribute to support the maintenance (both financially and in terms of the time and effort investment) he might be open to that, but obviously that's not going to happen.

Sure, burden. Like say, Pidgin is a burden to [x network]. Not allowing 3rd party is bad, it always is. It takes away choice.

Re: Reverse Engineering WhatsApp Web

#64

Post by gsich »

alpb wrote: post #49

FWIW Repos like these that reverse engineer a proprietary API that post stuff on GitHub are usually taken down with a DMCA enforcement. The same thing happened multiple times when folks reverse engineered and documented the Snapchat API. https://news.ycombinator.com/item?id=6083812

yowsup has been online for years.

Re: Reverse Engineering WhatsApp Web

#65

Post by ce4 »

pmlnr wrote: post #58
aylons wrote: post #7

Earlier quoted context omitted.

Signal. It is at least as secure as Whats App by design, has pratically the same interface and also a Chrome-based desktop app that works untethered from the phone app.

Signal relies on GCM, and needs a smartphone app. I'm failing to see the win.

Not anymore since 3.30.0. Also CopperheadOS maintained a fork on their fdroid repo without the hard Google Play store dependency.

https://copperhead.co/android/docs/usage_guide#signal

Re: Reverse Engineering WhatsApp Web

#66

Post by firefoxd »

I see a lot of "just use X instead."

Unfortunately, unlike the old chat protocols, switching to any other platform means convincing your contacts to use a new platform. They like you and all, but that means they also have to use a special app just to talk with you now.

Re: Reverse Engineering WhatsApp Web

#67

Post by pmlnr »

ce4 wrote: post #65
pmlnr wrote: post #58

Earlier quoted context omitted.

Signal relies on GCM, and needs a smartphone app. I'm failing to see the win.

Not anymore since 3.30.0. Also CopperheadOS maintained a fork on their fdroid repo without the hard Google Play store dependency. https://copperhead.co/android/docs/usage_guide#signal

The more I dig into Signal, the more complicated everything with it is.

Just go XMPP with OMEMO, so no hard smartphone dependency, no electron app monsters. Thankfully XMPP doesn't have a problem with 3rd party and federation.

https://omemo.top/

Re: Reverse Engineering WhatsApp Web

#68

Post by alien1993 »

pmlnr wrote: post #61
lozenge wrote: post #41

Earlier quoted context omitted.

They rolled their own crypto. Just Google "telegram security" and you'll find explanations of why that's a red flag.

Someone has to roll new crypto, otherwise we're stuck. That said, I know about the potential issues with Telegram's encryption.

You don't roll a new crypto and use it the day after, it must be tested for vulnerabilities, reviewed by expert cryptoanalysts.

It can take years, much like a car has to be crash tested, a new crypto algorithm must go through a certain process to be considered good enough.

Re: Reverse Engineering WhatsApp Web

#69

Post by sigalor »

letslightafire wrote: post #47

I'm wondering how they actually reverse engineered WhatsApp in the first place. Is there a specific type of software that does this or was it just built from scratch using already available information?

Hi, I'm sigalor, the original creator of the project. The reverse engineering was almost entirely done using the Chrome debugging tools. That is, pretty-printing the JS source files, setting breakpoints and stepping through the code for hours. When I started, all of this was incredibly difficult, but the longer you do it, the more you get used to it. Additionally, the debugging tools also provide you with looking at what is sent through websockets, which makes it rather easy to see which JSON data is sent (e.g. for login).

Re: Reverse Engineering WhatsApp Web

#70

Post by sigalor »

0x0 wrote: post #60

Curious to know why they chose to require python in addition to node, wouldn't node with npmjs/yarn be sufficient and require less setup? Does python/pip provide any benefits here?

Hi, I'm sigalor, the original creator of the project. Actually, now I also regret using Python in addition to NodeJS. When I started all of this back in November, I originally chose Python, because it's, well, "quick and dirty". Especially trimming arrays and working with byte strings requires a lot more code in JS than it does in Python. I even wrote a reimplementation of the decryption routines in JavaScript, but it's not working entirely (the HMAC authentication of received messages fails, though login works).
Post reply on HN