9 ms·
WhatsApp Just Switched on Encryption for a Billion People
- ibejoeb 11y agoMy understanding of this situation is that, previously, E2E encryption was enabled between Android clients[1]. Now, it is claimed that all clients, for all media types, do it. 1. http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ http://www.wired.com/2014/11/whatsapp-encrypted-messaging/
- pjs_ 11y agoFuck yeah Moxie Marlinspike. Global capitalist crypto anarchy! I wonder what this means for Signal...
- subliminalpanda 11y agoMy question is, how can this be verified?
- mordocai 11y agoWatch the traffic go by with a packet sniffer? Verifying that it is done securely is a lot harder, but you can at least verify that things are not being sent as plain text/data.
- fweespee_ch 11y agoYeah but that just shows its https.
- arcticfox 11y agoCan't you MITM yourself fairly easily to decrypt the https and see what's being passed? Assuming you have full control of your device.
- dogma1138 11y agoWatching traffic is irrelevant, the encryption of the transport (WhatsUp always used TLS for that) is not in question here, this is about end to end encryption and if WhatsUp can either decrypt the data for users or switch them off E2EE at any point without it being noticeable to either end.
- M4v3R 11y agoThey have released a whitepaper [1] where they go into details of how the encryption works, so using this knowledge in theory one should be able to verify that the encryption is legitimate. [1] https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...
- subliminalpanda 11y agoNice! Thank you
- motdiem 11y agoLooks great, but I find it a bit weird that there's no Whatsapp announcement - I also wonder if it'll slow down the ability to have the same whatsapp account on multiple devices.
- Slippery_John 11y agohttps://blog.whatsapp.com/10000618/End-to-end-encryption https://blog.whatsapp.com/10000618/End-to-end-encryption
- neerdowell 11y agoWhisper System's announcement of this: https://whispersystems.org/blog/whatsapp-complete/ https://whispersystems.org/blog/whatsapp-complete/
- motdiem 11y agoand whatsapp https://blog.whatsapp.com/10000618/End-to-end-encryption https://blog.whatsapp.com/10000618/End-to-end-encryption (from the other hn thread)
- distances 11y ago> This includes chats, group chats, attachments, voice notes, and voice calls across Android, iPhone, Windows Phone, Nokia S40, Nokia S60, Blackberry, and BB10. Wow. I'm genuinely impressed. The Nokia app store closed over two years ago, and they still implemented this for those old, trusty devices. That's some dedication for serving the users!
- wcummings 11y ago>And that’s true on any phone that runs the app, from iPhones to Android phones to Windows phones to old school Nokia flip phones. Woo! Props to the WhatsApp team for supporting these features for dumbphone users like me. Does anyone know if/how/where you can verify a users fingerprint?
- raulk 11y agoThe article says: "With end-to-end encryption in place, not even WhatsApp’s employees can read the data that’s sent across its network." But according to the diagram: http://www.wired.com/wp-content/uploads/2016/04/Whatsapp_Encryption_Proxima-1024x600.jpg http://www.wired.com/wp-content/uploads/2016/04/Whatsapp_Enc... ... A's message is encrypted with Whatsapp's public key, which means that Whatsapp's private key can (and has to) decrypt it on the server side to encrypt it in turn with B's public key. If the diagram is truthful, the claims the article makes are incorrect.
- sajid 11y agoThe message is encrypted with the public key belonging to user B.
- wcummings 11y agoWhat in the diagram gives you the impression the public key belongs to WhatsApp? Presumably WhatsApp is handling PKI.
- raulk 11y ago"Public key from server" is an ambiguous phrase. I took "from" to denote possession, not source. After reading the other sources of information, it's clear it is a secure protocol. More so when designed by the Snowden-approved Open Whisper Systems team.
- codemac 11y agoIt's the user's public key, not WhatsApp's.
- jmilum 11y agoit use the public key of the other user, not whatsapp. in effect, whatsapp is just acting as a key server. now they could have that users private key, but that's another matter
- sickbeard 11y ago
- jonalmeida 11y agoI'd like to know how backing up data on Google Drive will be done now. Does it remain encrypted, so that when you re-import it to your phone only then it'll be readable?
- envy2 11y agoWhatsApp have published further details for users[1], as well as a technical whitepaper[2] explaining the implementation. There's also a blog post[3]. [1]: https://www.whatsapp.com/security/ https://www.whatsapp.com/security/ [2]: https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf https://www.whatsapp.com/security/WhatsApp-Security-Whitepap... [3]: https://blog.whatsapp.com/10000618/End-to-end-encryption https://blog.whatsapp.com/10000618/End-to-end-encryption
- visarga 11y ago>“The encryption genie is out of the bottle” ... > There was a middle period where the government had a broad ability to surveil, but if you look at human history in total, people evolved and civilizations evolved with private conversations and private speech. If anything, we’re bringing that back to individuals. I think on the contrary, the surveillance demon is out of the bottle. It's impossible to hide metadata (ip addresses) in communications, we depend on auto-updated operating systems that might be backdoored in the future or are already backdoored and even if we have an "untraceable" system, we can't possibly use our old accounts were we logged in with our real name, or which can be traced to our IP address.
- delinka 11y agodelete your dupe to revive some karma
- visarga 11y ago> The encryption genie is out of the bottle > There was a middle period where the government had a broad ability to surveil, but if you look at human history in total, people evolved and civilizations evolved with private conversations and private speech. If anything, we’re bringing that back to individuals. I think on the contrary, the surveillance demon is out of the bottle. It's too hard to hide metadata such as ip addresses in communications; in many places Tor is blocked, browsers can be fingerprinted, typing style and writing style can be identified by statistical methods; we depend on auto-updated operating systems that might be backdoored in the future or are already backdoored and even if we have an "untraceable" system, we can't possibly use our old accounts were we logged in with our real name, or using our real IP address in the past. So, anonymous web use is not as social as plain web use. Besides, we already leak too much data through our GSM phones, at least to the carrier and the state agencies that log the user data.
- mtrimpe 11y agoThere is no reason why we can't create an entire new computing paradigm that does respect our historic conventions around privacy though. I gave a talk about such conversational languages [1] at ClojureD last month if you're interested... [1] https://www.youtube.com/watch?v=CD-Dtr9j0f4 https://www.youtube.com/watch?v=CD-Dtr9j0f4
- ThrustVectoring 11y agoSocial network graphs are also a huge surveillance leak. If you use an otherwise anonymous way to talk to all your friends, and someone knows who those friends are, they have a pretty good idea who owns that "anonymous" communication channel. This is tragic, since the most interesting and private uses of the internet are in interacting with friends, family, and loved ones.
- aorth 11y agoBravo to moxie, and the WhatsApp guys actually sound really cool. So, assuming you're using WhatsApp Web, does that mean you have end-to-end encryption there too? I recall the web version used your phone somehow.
- harigov 11y agoApparently it does. I just opened whatsapp web and it greeted me with a message that any messages and calls through it are now encrypted.
- Propen 11y agoI can't believe that no one ever mentions Signal in any of these articles.
- deleted 11y ago[deleted]
- mfringel 11y agoSo, now we have a billion people who think they're communications are secure, as opposed to just encrypted.
- techthroway443 11y agoAre you implying WhatsApp designed an insecure encryption?
- sickbeard 11y agohow do you know it's secure other than what you read from the press release?
- techthroway443 11y agoI have no idea how secure it is, I was asking for clarification. Side note, I noticed your account is still green and 13 days old. Are new accounts green only for two weeks?
- aorth 11y agoSo now WhatsApp is finally on par with iMessage and Signal, and shares the same weakness: public key distribution. Key distribution is controlled by a centralized server that could, for malicious or other reasons, send you new fake keys for people you communicate with. For iMessage, this is explained in this 2015 post by Matthew Green: http://blog.cryptographyengineering.com/2015/09/lets-talk-about-imessage-again.html http://blog.cryptographyengineering.com/2015/09/lets-talk-ab... At least with Signal you can compile your own client (though that doesn't help if the server is going to send you fake public keys!).
- x1798DE 11y agoIs there no UI notifying you that a user's keys have changed in Signal? If so, the central server would need to send compromised keys on day 1, which would be detectable when you check the key signature.
- aorth 11y agoThere is a UI. It doesn't even show (decrypt) the new messages until you add the new key.
- TillE 11y agoIf you go to Settings -> Account -> Security, you can enable the option that will notify you in case the key changes. You do have to trust the client and opt in, but the feature exists.
- aorth 11y agoYou're right. So when you get a notification of a key change (for malicious or other reasons) it is up to you to verify that the user did indeed have a key change — preferably out of band, or at least over another medium.
- sidcool 11y agoHow does this compare with Telegram? Same, better or worse?
- Nekit1234007 11y agoBasically Telegram is _nothing_ compared to this.
- sidcool 11y agoReally? How so? I can understand from scale perspective, but is it more secure than Telegram?
- Nekit1234007 11y agoTelegram received quite a backlash from crypto community for rolling out nonsensical throw-a-bunch-of-crypto-algorithms-together homebrew protocol that was designed by Math PhD™ students and having an audacity of conducting a contest to break it. This OTOH uses peer reviewed, strong, modern crypto that was designed by people who know how to do these things.
- alias240 11y agoThe crypto might be superior, but we do not know for sure that Whatsapp/Facebook is not covertly decrypting the messages and funneling through some Prism v2 NSA surveillance operation.
- Nekit1234007 11y agoYou can say say the same about Telegram, can you not?
- jonny_eh 11y ago> WhatsApp has no way of complying with a court order demanding access to the content of any message, phone call, photo, or video traveling through its service Unless the NSA/FBI/CIA secretly orders WhatApp to release compromised app update with a backdoor.
- SteveNuts 11y agoIt's only a matter of time
- d0ugie 11y agoDid they roll this out to their Mainland Chinese users?
- dang 11y agohttps://news.ycombinator.com/item?id=11431108 https://news.ycombinator.com/item?id=11431108
- deleted 11y ago[deleted]