4 ms·

Is there any reasonable way to verify that end-to-end encryption is actually being used, and used correctly? From a user's point of view the app looks and works

by mjs 11y ago

Is there any reasonable way to verify that end-to-end encryption is actually being used, and used correctly? From a user's point of view the app looks and works exactly the same as before, except for the addition of a QR code which could be doing anything.

mike_hearn 11y ago
Define 'reasonable'. Essentially, no. You have to trust that the app is really doing what it claims to be doing. If it were open source, would it be different? Maybe. Signal Messenger is open source and the Android build is reproducible. However, the way you reproduce it is to run a Docker image, so that isn't really meaningful unless you audit the code that's used to build it. And then audit the code of the app itself. Fortunately, the Android app is written in Java, so you can easily do static analysis to narrow down what code needs to be audited. Unfortunately, it also includes native code that can reach into arbitrary parts of the heap if it were to try and steal keys. So you'd have to audit all of that. And then keep up with all the changes. Which you aren't going to do. Even if you did all of that, at some point the naughty thought will occur to you that all your effort can be undone by an operating system update that contains more than it claims to. And then you'll give up. In practice, it's impossible to really verify anything about how our modern computers work: there are too many people and companies who can silently access key material or just fool us in other ways. So it's best to understand this work in context - this is not about allowing you to use WhatsApp if your threat model is that WhatsApp is entirely malicious. It's about discouraging governments from going to WhatsApp and saying "you need to give us all your data" because it creates the same situation Apple has: WhatsApp would need to write new software to undo the encryption, and that can be legally argued to be "compelled speech", and thus it can fall outside the legal powers granted under wiretap orders.
- visarga 11y ago
  But can we still be sure of our privacy if we combine two or more such semi-secure systems? TOR does such a thing with the Onion Routing protocol by using intermediaries.
  - mike_hearn 11y ago
    No. There is no way to be completely sure of your privacy in any context when using modern computers, it simply isn't a problem that can be solved with technical tricks. Consider all the work I listed above. Imagine you actually did it. Great. But ... you're using WhatsApp to communicate with someone else. Did they do the same work? No? What if their device received a different binary to yours? You can't even solve this with clever auditing frameworks because then you're just shifting the trust to whoever writes and distributes the auditing tools. That's why it's so important to understand that you cannot solve political problems with cryptography. At most, you can reconfigure the set of people you need to trust (hopefully by making it smaller). But if those people can be forced to act by a political entity, then no crypto will save you.
Aoyagi 11y ago
Create a new domain, new site, send a link through whatsapp, see if it's pinged by their servers. That would be my first test.
jamesdwilson 11y ago
i'm with you on this. claims of e2e encryption are easy to make and without open source, impossible to prove.
StavrosK 11y ago
What's more, my client says "You aren't secure because X needs to upgrade WhatsApp", but the other party is seeing "you are secure", complete with fingerprint and everything. I wonder which of the two devices is lying.
- revertts 11y ago
  I hit the same thing - I think my client just had a stale view of what version the person I was talking to was running. I did a refresh of the Favorites list on iOS and it sorted it out.
  - dewey 11y ago
    Same issue and this resolved it. Thanks for posting that.
  - heine 11y ago
    thanks for the hint. that solved it for me too. what I'm wondering: My WhatsApp tells me it can't encrypt because the other person uses an outdated version. But the other person gets told the chat is encrypted. What is the truth then? Is it still doing crypto but my UI is denying it? Or is it not encrypted and the other person has a false sense of security? That's at least a bit strange...

by mjs 11y ago

mike_hearn 11y ago

Define 'reasonable'. Essentially, no. You have to trust that the app is really doing what it claims to be doing. If it were open source, would it be different? Maybe. Signal Messenger is open source and the Android build is reproducible. However, the way you reproduce it is to run a Docker image, so that isn't really meaningful unless you audit the code that's used to build it. And then audit the code of the app itself. Fortunately, the Android app is written in Java, so you can easily do static analysis to narrow down what code needs to be audited. Unfortunately, it also includes native code that can reach into arbitrary parts of the heap if it were to try and steal keys. So you'd have to audit all of that. And then keep up with all the changes. Which you aren't going to do. Even if you did all of that, at some point the naughty thought will occur to you that all your effort can be undone by an operating system update that contains more than it claims to. And then you'll give up. In practice, it's impossible to really verify anything about how our modern computers work: there are too many people and companies who can silently access key material or just fool us in other ways. So it's best to understand this work in context - this is not about allowing you to use WhatsApp if your threat model is that WhatsApp is entirely malicious. It's about discouraging governments from going to WhatsApp and saying "you need to give us all your data" because it creates the same situation Apple has: WhatsApp would need to write new software to undo the encryption, and that can be legally argued to be "compelled speech", and thus it can fall outside the legal powers granted under wiretap orders.

visarga 11y ago
But can we still be sure of our privacy if we combine two or more such semi-secure systems? TOR does such a thing with the Onion Routing protocol by using intermediaries.
- mike_hearn 11y ago
  No. There is no way to be completely sure of your privacy in any context when using modern computers, it simply isn't a problem that can be solved with technical tricks. Consider all the work I listed above. Imagine you actually did it. Great. But ... you're using WhatsApp to communicate with someone else. Did they do the same work? No? What if their device received a different binary to yours? You can't even solve this with clever auditing frameworks because then you're just shifting the trust to whoever writes and distributes the auditing tools. That's why it's so important to understand that you cannot solve political problems with cryptography. At most, you can reconfigure the set of people you need to trust (hopefully by making it smaller). But if those people can be forced to act by a political entity, then no crypto will save you.

Aoyagi 11y ago

Create a new domain, new site, send a link through whatsapp, see if it's pinged by their servers. That would be my first test.

jamesdwilson 11y ago

i'm with you on this. claims of e2e encryption are easy to make and without open source, impossible to prove.

StavrosK 11y ago

What's more, my client says "You aren't secure because X needs to upgrade WhatsApp", but the other party is seeing "you are secure", complete with fingerprint and everything. I wonder which of the two devices is lying.

revertts 11y ago
I hit the same thing - I think my client just had a stale view of what version the person I was talking to was running. I did a refresh of the Favorites list on iOS and it sorted it out.
- dewey 11y ago
  Same issue and this resolved it. Thanks for posting that.
- heine 11y ago
  thanks for the hint. that solved it for me too. what I'm wondering: My WhatsApp tells me it can't encrypt because the other person uses an outdated version. But the other person gets told the chat is encrypted. What is the truth then? Is it still doing crypto but my UI is denying it? Or is it not encrypted and the other person has a false sense of security? That's at least a bit strange...