Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering WhatsApp Web

github.com

Post reply on HN
Print view View original

91–100 of 127 posts

Re: Reverse Engineering WhatsApp Web

#91

Post by gsich »

hazelnut wrote: post #25
salqadri wrote: post #8

Wow that's impressive. But I would imagine WhatsApp/Facebook can just change their protocol at any time since it is easy to redeploy a new version of the WhatsApp Web client, thus breaking any 3p clients built on the original protocol. That would require yet another reverse engineering effort that can take a while. And by the time its reverse engineered again, they can yet again change the protocol. So the only relia…

they still have to support older clients. so it is not that easy to just change the protocol.

You can always screenscrape.

Re: Reverse Engineering WhatsApp Web

#92

Post by gsich »

chocolatkey wrote: post #32
salqadri wrote: post #8

Wow that's impressive. But I would imagine WhatsApp/Facebook can just change their protocol at any time since it is easy to redeploy a new version of the WhatsApp Web client, thus breaking any 3p clients built on the original protocol. That would require yet another reverse engineering effort that can take a while. And by the time its reverse engineered again, they can yet again change the protocol. So the only relia…

I've wanted to create my own WhatsApp client that's and actual native desktop application. If this reverse-engineering process continues, it might now be possible. It's irritating when people say "Signal/WhatsApp has a desktop app!" because technically, they're right, but I have enough web browsers on my system already, thank you very much

look at yowsup

Re: Reverse Engineering WhatsApp Web

#94

Post by kirillseva »

raarts wrote: post #40
lxglv wrote: post #10

Earlier quoted context omitted.

Out of curiosity: I’ve noticed a long-term sceptical attitude to telegram in HN audience and have seen multiple arguments against it. Something like that their crypto can’t be trusted, that it’s not time-proven. Don’t you know any good source with some sort of domain expert explanation, why shouldn’t it be used or trusted? No intention to start any flame against Signal, only curiosity regarding telegram flaws. Person…

It's Russian. You know, like: hand over the encryption keys or you, or someone you love will disappear.

Telegram is actually fighting the Russian government over the encryption keys, saying that it is impossible to hand them over (I assume this is for e2e encrypted secret chats). The consequence of this action is that they'll likely get banned (i.e. removed from app store). How much of this is a farce remains to be seen, since the whole nation, from casual users to small businesses to government employees use the app daily.

As a Russian, I do appreciate the fear that the "russki" brand instills in your soul, but I think you are rightly being downvoted for jumping to conclusions simply based on nationality.

Re: Reverse Engineering WhatsApp Web

#95

Post by kirillseva »

madeofpalk wrote: post #80
pmlnr wrote: post #54

Earlier quoted context omitted.

After playing around with federated XMPP (on my own server): XMPP with OMEMO is brilliant. No battery drain (Conversations and Astrachat tested on android), multi-client e2e encryption, even voice/video is possible. And, being federated, I finally own my identity.

What's the benefit of end-to-end encryption if you don't have anyone on the other end?

Nobody can read your secrets if you don't have anyone to send them to.

Re: Reverse Engineering WhatsApp Web

#96

Post by detuur »

paxy wrote: post #83
saurik wrote: post #26

Earlier quoted context omitted.

No, because it is a website.

They also have native apps on most mobile platforms (including Windows Phone, Blackberry and even Nokia Series 40). It isn't as easy to update all of them as one would think.

But those are the apps themselves. This is about the WhatsApp Web protocol which allows you to use WhatsApp from a browser window by pairing it with a live session on your phone. Since the API endpoint are their own servers and the client is literally just a website, they can update whenever they want however much they want.

Re: Reverse Engineering WhatsApp Web

#97

Post by letslightafire »

sigalor wrote: post #69
letslightafire wrote: post #47

I'm wondering how they actually reverse engineered WhatsApp in the first place. Is there a specific type of software that does this or was it just built from scratch using already available information?

Hi, I'm sigalor, the original creator of the project. The reverse engineering was almost entirely done using the Chrome debugging tools. That is, pretty-printing the JS source files, setting breakpoints and stepping through the code for hours. When I started, all of this was incredibly difficult, but the longer you do it, the more you get used to it. Additionally, the debugging tools also provide you with looking at…

That must've taken forever. Do you have any plans to reverse engineer other apps? I know people like you are in short supply and high demand.

Re: Reverse Engineering WhatsApp Web

#98

Post by aylons »

alerighi wrote: post #85
aylons wrote: post #7

Earlier quoted context omitted.

Signal. It is at least as secure as Whats App by design, has pratically the same interface and also a Chrome-based desktop app that works untethered from the phone app.

Signal has most of the problems that has WhatsApp: mainly the fact that it's dependent on a smartphone, yes you have a Chrome-based application that is the same as WhatsApp web, it's only a remote interface that connects to your phone. Telegram in my opinion is far better, it's completely cloud based, you can use it from whatever device you want, it has real desktop apps, you can send files, you have bots, channels,…

No, Signal Desktop is NOT the same as WhatsApp web. You still need your phone for the initial setup (same as Telegram), but after that, the desktop app is untethered until de-authentication.

Also, it has a much more praised security and cryptography than Telegram, is always encrypted (Telegram is only encrypted in secret chats) and has a much more secure codebase, with more open development (Telegram sometimes takes weeks to release source code), reproducible builds and a more transparent history.

I do use Telegram (mainly for group chats), but I treat everything posted in it as I would treat a public forum like HN.

Re: Reverse Engineering WhatsApp Web

#99

Post by naasking »

gustavmarwin wrote: post #18

I'm very hopeful this reverse engineering effort will enable the creation of a tool to export my conversations (WhatsApp can do email export, which let's be real, doesn't cut it for most cases). A point to those that support migrating to alternatives such as Signal. Signal is good, but far from great for a single reason: you need a phone number. This is very bad in necsec and reliability terms, my case: Reliability:…

Sounds like you could get a stable VoIP number and just use that. One time cost and has its uses for cheap long distance calling.

Re: Reverse Engineering WhatsApp Web

#100

Post by stordoff »

niklasrde wrote: post #53
gustavmarwin wrote: post #18

I'm very hopeful this reverse engineering effort will enable the creation of a tool to export my conversations (WhatsApp can do email export, which let's be real, doesn't cut it for most cases). A point to those that support migrating to alternatives such as Signal. Signal is good, but far from great for a single reason: you need a phone number. This is very bad in necsec and reliability terms, my case: Reliability:…

This may sound like an advert, but it's not - I used "Backuptrans Android WhatsApp to iPhone Transfer for Mac" last year when I moved from Android to iPhone, and surprisingly it actually worked! I could export all my Android (Nougat) messages and media, and restore it onto my iPhone (iOS 11). It was a bit dodgy though - it asked me to install an old (custom?) APK first to export my messages, and the iPhone restore pr…

I wonder if it's easier to manipulate a backup than to inject data into an app actually on the phone -- make a backup, replace the app's data, then restore the backup. You (presumably) have root on the Mac, so finding any needed encryption keys is probably easier, and adding data to an app on the phone doesn't sound easy unless the app/phone provides an interface for it.
Post reply on HN