20 ms·
The Next Front in the New Crypto Wars: WhatsApp
- rmc 11y agoIf cases like this go in the US Gov's favour, it'll further damage the US tech industry. It's already illegal for EU orgs to use US tech companies for personal data!
- throwaway0209 11y agoHere the local drug dealers encourage use of a app called Wickr. Does anyone know how the encryption compares to WhatsApp?
- CiPHPerCoder 11y agohttps://github.com/nylira/prism-break/issues/249#issuecomment-20631772 https://github.com/nylira/prism-break/issues/249#issuecommen... https://www.reddit.com/r/australia/comments/32hexp/a_secret_app_called_wickr_has_become_isiss_number/ https://www.reddit.com/r/australia/comments/32hexp/a_secret_... Don't use Wickr. Proprietary crypto + an interesting target for NSA because of its popularity among ISIS = probably snake oil and at the very least makes you a target "Career criminals recommend it" isn't a good indicator of security. Two things to consider: 1. Confidential informants exist 2. Being a high-risk individual doesn't make you a domain expert Ask your drug dealers to explain why RSA encryption with PKCS1v1.5 padding is bad. If they can't, disregard their opinion on cryptography and privacy technology.
- kough 11y agoYeah, I knew a dispensary owner who told me all about Telegram* and how it was "really secure" and how the feds couldn't get any of his messages. He was happy to switch to Signal once I told him a little more.
- some_furry 11y agohttps://twitter.com/SoatokDhole/status/691567507581341697 https://twitter.com/SoatokDhole/status/691567507581341697 I'm doing my part, too! :)
- ycmbntrthrwaway 11y ago> telegraph Telegram?
- kough 11y agocorrected, thanks
- throwaway0209 11y agoThanks a lot for the detailed answer. I will be sure the take the discussion on RSA encryption with PKCS1v1.5 padding the next time I see those guys. Probably without mentioning ISIS..
- CiPHPerCoder 11y agoI can almost guarantee their response will be, "WTF? Stop making words up, mate."
- themartorana 11y agoThe hi-tech application, known as Wickr, is the latest in the long list of tools the death cult is using to lure Australian jihadis to join their bloody campaign. Sure doesn't help when this is how the media describes a text messaging app.
- fweespee_ch 11y agohttp://www.nytimes.com/2016/03/13/us/politics/whatsapp-encryption-said-to-stymie-wiretap-order.html?_r=0 http://www.nytimes.com/2016/03/13/us/politics/whatsapp-encry... > The Justice Department and WhatsApp declined to comment. The government officials and others who discussed the dispute did so on condition of anonymity because the wiretap order and all the information associated with it were under seal. The nature of the case was not clear, except that officials said it was not a terrorism investigation. The location of the investigation was also unclear. Just in case anyone was wondering if this was terrorism related, it is not. I suppose next is OpenWhisperSystems / Signal, etc. I'm glad I've stuck with GnuPG for anything truly sensitive.
- ycmbntrthrwaway 11y agoGnuPG is great, but it is not for real-time messaging. Real-time messaging protocol should have forward secrecy, which OpenPGP can't have because it is not an interactive protocol. Related: http://www.thoughtcrime.org/blog/gpg-and-me/ http://www.thoughtcrime.org/blog/gpg-and-me/
- fweespee_ch 11y agoI'm aware but I don't need real time messaging for secure communication. It is really limited to things like security flaws, financial information, and things of that nature.
- jessegreathouse 11y agoIf the government wins any of these court battles, it's only a matter of time until one-way encryption is outlawed. It follows logically that if criminals/terrorists can't use iPhones to securely communicate, then they'll just move on to the next convenient encryption app. The government will continue to order companies to break their one-way encryption until the government realizes they're playing musical chairs and then they'll issue an executive order to ban one-way encryption outright. The precedent allowing them to do so, will be all of these initial court battles vs Apple, whatsapp, and whoever else gets defeated. In the wake of these events regular people, like you and me, will be harmed by hackers and commercial companies exploiting this new world without one-way encryption.
- schoen 11y agoI don't recognize your use of "one-way encryption". Did you mean something like end-to-end encryption?
- thavalai 11y agoLooks like it means that the encryption cannot be reverse-engineered: http://help.penzu.com/pro/what-is-one-way-encryption/ http://help.penzu.com/pro/what-is-one-way-encryption/
- CyberDildonics 11y agoI thought that was just called encryption.
- mirimir 11y agoRight. With decent end-to-end encryption, third parties can't circumvent without compromising devices or software. Systems where providers can secretly push compromised software aren't secure. Obviously. There are many eyes on the GnuPG code, for example. But even with Apple and Facebook, PR and financial consequences for backdoors would arguably be huge. Consider how much global business US providers have already lost, just over suspicion raised by Snowden's stuff.
- lordnacho 11y agoWhat does "undue burden" mean? Wouldn't it be very simple for WhatsApp to remove the encryption in the app? (Anyone can write an unencrypted app.) Could they be forced to do that? IMO that would be awful.
- ycmbntrthrwaway 11y agoIt is not that simple if you want to stay compatible with clients that are not updated yet and are not capable of receiving unencrypted messages. You also have a risk of breaking something, so you need to test compatibility of all versions etc. The company promised security for all other users, so it probably wants to remove security only for one specific user, otherwise it faces popularity loss. The cost of properly removing encryption from an established network protocol used almost constantly over time is really high.
- nickik 11y agoThe 'undue burden' is bot just the time to do it. Apple clearly argues this in their testemony before the justice commity and Im sure WhatsApp feels the same. The burde is the breaking of user expectation and trust in the security and trust of the companies products.
- ycmbntrthrwaway 11y agoPlease stop calling it crypto wars. Calling something a "war" justifies wartime measures, just as it happens with terrorism, drugs and things like that.
- deleted 11y ago[deleted]
- zeckalpha 11y agoThis isn't a new term: https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Crypto_Wars
- axihack 11y agoCan anyone point me to where WhatsApp app is actually confirming they are implementing E2E encryption and how? I couldn't find anything on the oficial web/blog, the single mention on security is this FAQ[1] which is about server/device encryption. A friend also told me E2E is only available for US users but unfortunatelly I can't confirm this because of the lack of communication from WhatsApp. [1] https://www.whatsapp.com/faq/en/general/21864047 https://www.whatsapp.com/faq/en/general/21864047 Edit: fixed typos
- ibejoeb 11y agoI've never seen any official confirmation, but Wired reported that it had been enabled between Android devices: http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ http://www.wired.com/2014/11/whatsapp-encrypted-messaging/. The implementations is reportedly based on TextSecure/Signal. Moxie says WhatsApp "is implementing" which is certainly distinct from "has implemented."
- trulyWasteful 11y agoNo one can stop me and my peers from sending meaningless garbage data to each other. So, if it simply looks encrypted, but acctually contains randomized meaningless shit, how can anyone prevent me from bahaving in this manner, and claim that I've done harm? I've paid for the service, and I can spam it with trash as I see fit.
- mlvljr 11y agoUntil in jail :/
- beeboop 11y agoThis is unfortunately not true in many places. In the UK you can be thrown in prison for failing to decrypt any data in your possession. This means someone can encrypt garbage on a USB drive and slip it in your pocket and make you rot in prison for years. In the US, you will be held in contempt for failing to decrypt data when ordered if they can show that you "probably" have access to it and it's relevant to the charges against you. This also means prison for many years for failure to decrypt, even if you can't.
- hifier 11y agoNot until they change the 5th amendment.
- 0xcde4c3db 11y agoI don't know what the accepted jurisprudence is on this, but there are interpretations of the 5th amendment saying that the protection only extends to the authorities being unable to legally compel you to reveal that you can decrypt the data (and, by extension, that you have some level of knowledge of or responsibility for it). That is, if they can somehow prove that the data is yours, a court can order you to decrypt it.
- john_reel 11y agoRandomized data does not have padding.
- 1024core 11y agoIf the USG can force Apple/Whatsapp to decrypt some communication, what prevents the PRC from doing the same? Will we see Tim Cook arrested the next time he goes to China?
- XorNot 11y agoWhat stops them now? I don't understand why people think this is an issue. While you could certainly imagine the PRC being emboldened, it's not like their history of human rights abuses has kept them in check. The only thing which does is how much they love trade with the west, but it would be entertaining the amount of blowback making a move against Foxconn would create (also worth considering: China, land of fake electronics components and seizing memory cards at the border, is where all your iPhones are being made...)
- 1024core 11y agoDon't you think that if they see Apple handing over iPhone contents to USG, they will now feel entitled to do the same in China?
- alias240 11y agoA part of me wonders if I should believe this, and the story about the Apple case. Or maybe it is all just a conspiracy to gain our trust.
- brudgers 11y agoThe important aspect of this and the Apple scenario is that the encryption requires a benevolent third party. Encryption that relies on Eve...well, she has three faces.
- eyeareque 11y agoThe only reason the government "gave up" in the previous crypto war was because they decided to find ways to break or weaken crypto to their needs. I don't think this time will be any different, one way or another they will get access to our data.
- nickik 11y agoThey have done a shitty job at it. Snowden revealed much but non of the real horror stories have turned out to be true. Modern standards like SHA3 are designed far better and in a way that make it way harder for anybody to build in a backdoor. This is one of the few areas we dont have to worry to much about. What we need to worry about is addoption of good defaults by the large majority.
- rsync 11y agoAll computer code can be rephrased in common written (english, perhaps) language. I'm not talking about pseudocode, I mean an actual translation layer from, say, C to english phrasing that specifically describes the computer code to be written. And at that point it's just speech. I don't mean "like speech", or "something sophisticated people should recognize as speech", or "code is speech" ... I mean, it's just plain old speech. Just very boring, long-winded (and extremely precise) descriptions of computer source code. So perhaps there will be some pain and perhaps there will be some years before it finally gets to the supreme court, but in the end, it's just speech. Will they change the 1A ? Would they ?
- sesutton 11y agoThe source code for PGP 5 was made legally available outside the US in a similar method though without translating it. https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_investigation https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i...
- rmc 11y agoNot every country has the USA's "Free speech über alles" interpretation of "right to free speech"
- sandra_saltlake 11y agoPlease stop calling it crypto wars..
- JackuB 11y agoBut headlines love it!
- venamresm__ 11y agoThere are alternatives to one way encryptions. Think of steganography and communication between the parties being indirect.
- krylon 11y agoI find it disturbing how the intelligence and law enforcement community seem to think there is some kind of natural right for them to snoop on people. In case of the good old phone system, the very way that worked maked wiretapping very easy. The same was true for physical mail (one major reason why most states created and held on to the monopoly on mail for so long). With email and IM this is - again due to the way this works - a lot more difficult. Artificially restricting encryption just so they can keep on doing things the way they're used to is a bad idea, and kind of naive, too.
- edraferi 11y agoYou're correct to point out that this debate is about a change in the staus quo: law enforcement used to be able to access the dominant communications system with a lawful order, proper crypto removes that capability. It is inevitable that this change, lwft unchecked, will increase citizen privacy AND decrease law enforcement effectiveness. The HN community is very aware of these privacy benefits, but skeptical about the security costs. I wonder how far security must slip before those costs become apparent. Until that happens, we basically have two camps of experts talking past eachother. The tech community sees the privacy cost, the law enforcement sees the security cost. Both back up their claims with "trust us, this is what we do for a living." This makes it very difficult to create a policy solution.
- nickik 11y agoActually the availabitly of data has massivly increased. They have access to far more thing then they ever had. We have few ways to hide metadata and those are of major imprtance. Investigating crime is now far easier the it was at any time beore 1995 and the world did go to shit then.