9 ms·

WhatsApp Rolls Out End-To-End Encryption to Its Over 1B Users

330 points by randomname2 11y ago

_wmd 11y ago
This is quite a cavalier recommendation for proprietary unaudited (for the public at least) spyware that uploads your phone book to a company participating in PRISM.
- evgen 11y ago
  The word "participating" there implies intention, which is a lie. Care to re-phrase?
  - _wmd 11y ago
    > The PRISM program collects stored internet communications based on demands made to internet companies such as Google Inc. under Section 702 of the FISA Amendments Act of 2008 to turn over any data that match court-approved search terms I can't imagine it's a simple task for a large company to unintentionally comply with a court demand, there needed to be some wilful choice between attempting to fight it or rolling over
    - antihero 11y ago
      So if you're using literally any messaging app on Android, you're using software by a company cooperating with PRISM?
      - hosay123 11y ago
        Yes, and consequently the platform should not (and in practice does not) receive declarations of high security in its default state. Ignoring PRISM, this is true of every major smart phone platform as they all have remote install and update abilities that excepting Android aren't generally straightforward to disable. Argumentum ad populum is not an excuse for doing something even when you know it's wrong.
- deleted 11y ago
  [deleted]
- kccqzy 11y ago
  WhatsApp doesn't upload your phone book. All contact info resolution is done locally.
  - _wmd 11y ago
    How does the app figure out another telephone number has a WhatsApp account? How does it fetch profile information for that telephone number without communicating the desire to fetch it to WhatsApp? Perhaps WhatsApp ships their entire profile photo and telephone number database to every phone
    - kccqzy 11y ago
      There are two things here: a) the app can take a snapshot of your phone book, upload it, associate it with your own WhatsApp account, and then keep the remote version synchronised; and b) the app can periodically perform disparate requests to the central directory server to query the profile information for each number. As far as I know, WhatsApp uses approach b. These two may seem similar but in approach b, WhatsApp the service wouldn't learn of any contact removals. WhatsApp the app would, of course, but the service wouldn't. Now, with some simple filtering and statistics, WhatsApp the service can deduce your phone book with some certainty, but I believe most would agree that it is materially different from actually uploading your phone book.
      - pfg 11y ago
        > Now, with some simple filtering and statistics, WhatsApp the service can deduce your phone book with some certainty, but I believe most would agree that it is materially different from actually uploading your phone book. No, not really. Both implementations give WhatsApp a complete list of all my contacts. The fact that one of those implementations might not be 100% accurate because of deleted contacts changes nothing - if you're someone who's worried about a third party having your contact list, it doesn't make sense to think "but hey, they don't know I removed $FOO last week, so their list isn't 100% accurate!". Both implementations mean you'll have to take their word on what they will and won't do with the data, so there's really not much of a practical difference.
lazyjones 11y ago
It's an improvement, but proper end-to-end encryption on unsafe devices is about as useful as seat belts on an airplane.
- decasteve 11y ago
  So it protects you from bad turbulence but in a catastrophe you are still screwed.
ekianjo 11y ago
EFF recommending closed source clients, erm they just drop in my esteem.
- rileymat2 11y ago
  They gave it a deduction in their rating and said to prefer open source.
  - evgen 11y ago
    Open source does not mean your binary is secure. There are too many counter-examples of this fallacy to even bother enumerating. These widely- distributed binaries will be torn apart and inspected instruction by instruction. That is the only way we will know for sure, and you can bet people will be watching closely going forward. In this case I think lack of open source is not an issue given the reality of the distribution system.
    - pdkl95 11y ago
      > Open source does not mean your binary is secure. Open source is necessary - not sufficient - for security. Other work has to be done. With closed binaries you can't even begin that work.
  - nxzero 11y ago
    Is the backend for the Signal's messaging server open source? If so, they should open source the build script too.
    - subliminalpanda 11y ago
      I believe so: https://github.com/WhisperSystems/TextSecure-Server https://github.com/WhisperSystems/TextSecure-Server
- vulpino 11y ago
  They deduct points as it's still open source. And they are more applauding the fact that WhatsApp - probably the most widely used messaging app currently - has adopted strong end to end encryption, something which other clients have been loathe to do. This is a win. To disregard everything that WhatsApp and Signal have accomplished because WhatsApp isn't open source is silly.
jfindley 11y ago
Doesn't appear to mention metadata at all. While metadata is somewhat tangential to the actual encryption, it's still a vital part of a truly secure messaging platform - who we talk to reveals quite a lot about us. I'm not sure how solvable this is without sacrificing the usability that makes whatsapp as nice to use as it is, and I certainly don't want to take away from how great it is that they've done this - but it is important not to lose sight of the fact that encrypting the contents of your messages is only one part of the puzzle.
- edhelas 11y ago
  It's the same problem with Signal actually ;) All the communications of the official clients are sent to some "official" Signal Amazon servers (see https://github.com/WhisperSystems/Signal-Android/blob/master/build.gradle#L166-172 https://github.com/WhisperSystems/Signal-Android/blob/master...). Doing end to end encryption is nice, but I really think that having a decentralized AND standard architecture is also very important.
- nxzero 11y ago
  Agree. Reluctant to be critical of the topic, given how much those involved have managed to get done, but it is very concerning to me from what I'm able to tell how low priorty this issue appears to be. Second issue that to me is pressing given the volume of users is that in my opinion a commitment to execute an audit of the code/crypto/workflow/etc needs to be made; I'd start a campaign to fund this, but such a campaign would be much more likely to succeed if offically acknowledged and more importantly, resources are provide internally to enable it.
sickbeard 11y ago
What? How can you give it 6/7 stars if you don't even know what holes are in the code?
- evgen 11y ago
  Perhaps by knowing that the distributed binaries will be disassembled and inspected? The same way it would have to be examined even if there was a GitHub repo out there claiming to be the code used?
  - osweiller 11y ago
    You've made this claim multiple times now. Do you really honestly believe that disassembled binary code sees the same scrutiny or gained confidence that open source code does? Have you ever analyzed disassembled code? It is non-trivial. No one is going to disassemble this and say "Yup, it passes". That doesn't happen.
    - evgen 11y ago
      As a matter of fact I am certain they will be dissassembled and examined. For the bounty, for the PR and noteriety if you can find a bug or be the one to star in the "<big company> screwed up or lied to us" story of the week. In general, for lots of reasons that seem to motivate a select crowd who have the skills to actually pull this off. If you have the source code it makes the disassembly and examination of whatis distributed a lot easier, but it is not a necessary pre-requisite.
- deleted 11y ago
  [deleted]
confusedjs 11y ago
This is a bit weird. I don't believe WhatsApp are lying but there's absolutely no proof they're not. I could release a closed source app with a bunch of padlocks in it and copy/paste their white paper and have exactly the same level of proof of security. Would I get a 7/10 from EFF?
- ikeboy 11y ago
  If you had the credibility of a billion dollar company behind you saying that you're not making it up, then probably.
  - noahbradley 11y ago
    Because Facebook is known so well for their respect of privacy.
    - ikeboy 11y ago
      They're known for not lying through their teeth about what features they've implemented, like most large companies.
      - lunula 11y ago
        There are a lot of generalizations there. Do you have example of an audit showing that they have never misguided their users or represented their product and motivations?
        ikeboy 11y ago
        No, and the burden of proof would be on you if you're claiming it's likely that they're lying. Edit: my broad claim is basically that companies won't lie about what their products do, if their claims are specific. In this case, they released a whitepaper with technical details. If a company makes a broad unspecific claim, it's possible to be wrong or misleading without the implication of a deliberate lie by the company. In this scenario, it's not possible for it be wrong without a direct decision to lie, and therefore I think the reputational damage would be great if exposed, and it would be easily exposed by analysing network traffic before long. What I'm claiming in the specific here is that "the system implemented matches what the whitepaper says". I wouldn't put it beyond facebook to backdoor it in a way that's hard to figure out (with the backdoor included in the whitepaper ala Dual_EC_DRBG), but I'd consider that to be unlikely (firstly because there are actual humans behind it at the end of the day, and I'd hope that they would feel that "claim to release encryption but put a backdoor in" is morally worse than just not releasing encryption at all, and secondly because Whisper systems is involved). But all of that could arise in an open source system as well. What I have high confidence in is that the system matches the whitepaper. (There's also the possibility of an implementation problem that preserves plausible deniability for them, which I also consider unlikely.) All in all, reducing their grade by 1 point to account for additional risk in closed source seems reasonable to me.
sschueller 11y ago
I hope I can get my friends to switch to actor IM [1] or some other open source solution that doesn't suck. In the end all these chat systems turn into crap full of ads even if they aren't spying on you. [1] https://actor.im/ https://actor.im/
- edhelas 11y ago
  Seems centralized and doesn't rely on a standard. If I were you, I would forget this solution as well.
  - sschueller 11y ago
    What else is there with a decent client that is open source?
    - edhelas 11y ago
      On Android you have Conversations (https://conversations.im/ https://conversations.im/) based on XMPP, good looking, nice battery optimizations, and supporting E2E encryption. And you have the XMPP federation behind.
  - nickik 11y ago
    You can set up your own server. They want to devlop a federated protocol. So they are the only ones that actually have stated a goal to devlop something like that. OWS would probebly do it as well if they had the time and money. They already have the best clients in the buissness, if they manage to get the crypto and the federation right, it would be fantastic. They also have some support for using their web and desktop clients with email. I wish the Actor guys the best of luck.
    - edhelas 11y ago
      "They want to develop a federated protocol". There is already one, it's a IETF standard, deployed accross the globe and have already hundreds of clients and several serious servers : XMPP.
SeanDav 11y ago
I am so cynical (or is that realistic?) these days, that I would not trust the encryption on WhatsApp as far as I can throw a large, adult saltwater crocodile.
- kasey_junk 11y ago
  They implemented a known & vetted encryption protocol with expert consultation from the outside. Its one of the most widely distributed apps in the world & thus likely to have lots of people looking at it. If you don't trust it, is there any possible encryption scheme you would trust?
  - darklajid 11y ago
    I think the general trust issues people have are - metadata / contact lists in the hand of Facebook - a proprietary binary that _claims_ to use said encryption schemes Scenarios that you could come up with: The next version of WhatsApp sends unencrypted data again. WhatsApp encrypts for your recipient just fine, but also encrypts the same message for the great Facebook skeleton key. Basically trust is a bigger problem than you acknowledge here, I think. If you trust the encryption scheme, even the specific encryption implementation, then you still need to trust the (binary, closed) application. Ignoring the metadata issue completely for now.
    - rtkwe 11y ago
      >The next version of WhatsApp sends unencrypted data again. >WhatsApp encrypts for your recipient just fine, but also encrypts the same message for the great Facebook skeleton key. Both of these can and would show up in an analysis of the code.
ianpurton 11y ago
It's great that WhatsApp can't see my cat pictures anymore. But there are 2 privacy and free speech issues that are not met. Firstly META DATA. They know who I contact, when I contact them and how frequently. So people could derive information about me based on who I talk to. Secondly, they can ban me. Perhaps the EFF need to add more criteria to their secure message score card. https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard But on the whole, a positive move.
- nxzero 11y ago
  Agree. Reluctant to be critical of the topic, given how much those involved have managed to get done, but it is very concerning to me from what I'm able to tell how low priorty this issue appears to be. Second issue that to me is pressing given the volume of users is that in my opinion a commitment to execute an audit of the code/crypto/workflow/etc needs to be made; I'd start a campaign to fund this, but such a campaign would be much more likely to succeed if offically acknowledged and more importantly, resources are provide internally to enable it.
  - ianpurton 11y ago
    True, forgot about that. Even if we could see the code, it might be possible for google or apple to send certain groups of people modified software updates?
- maxerickson 11y ago
  When the client is a phone and the service is rapid messaging, how do you even begin to solve the metadata problem? Even with opaque routing the phone company can correlate activity times.
  - ianpurton 11y ago
    You could use a decentralised network such as Bitcoin to send messages. I would also implement Bloom filters to lower my network usage and confuse the nodes. https://en.wikipedia.org/wiki/Bloom_filter https://en.wikipedia.org/wiki/Bloom_filter I would choose random nodes to cause a bit more noise. And finally my messages would have some sort of Bloom filter derived destination address. So as to confuse it all a bit more.
nxzero 11y ago
Get the sense that EFF didn't even talk to any of the parties involved before posting their review, and to me, given how much weight they carry in the community, it's unclear why they didn't.
tptacek 11y ago
EFF should stop with this silly scorecard. I hate the thing because it's inaccurate and incoherent (arguments I've made ad nauseam elsewhere on HN), but on this thread you can see another good reason: it makes EFF the ref, and crowds always try to work the ref. So whatever "score" WhatsApp gets, it's the wrong score, because: not open source; because: runs on iPhones; because: metadata; because: Facebook is evil, &c.
- nxzero 11y ago
  What then is good for the masses?
  - Loque 11y ago
    IMHO it really depends on what you are doing; - Chatting with friends? = Whatsapp - International drug deals? != Whatsapp
    - nxzero 11y ago
      Goal should be mass adoption of universal turnkey state-level OPSEC for everyday use.
  - tptacek 11y ago
    I like the idea of a three-tier threat model: Tier 1: potentially inconvenient but maximally secure, in an OPSEC sense (PGP, for instance, though I would personally put Signal here too). Use carefully for security against state-level adversaries. Tier 2: convenient mainstream applications with strong security but some tradeoffs. Your default choice, security against criminal adversaries. I'd put WhatsApp and iMessage here (but not many others). Tier 3: unencrypted or dubiously encrypted mainstream applications, unsafe against any adversary, but potentially useful as an endpoint to (cautiously) bootstrap communications. Google Talk and AIM would go here for me.
    - eru 11y ago
      PGP doesn't have plausible deniability. It actually has `you can prove anyone else what I said to you', if you sign anything. That's dangerous, so shouldn't be on tier 1. (Or at least that's how it used to be.)
shaggy 11y ago
It's important to point out that all the Whisper Systems code is open source (https://github.com/whispersystems/ https://github.com/whispersystems/). So if you have concerns, go read their code. Some of the best minds in security have, and they've come away with good things to say. There's a desktop version of Signal coming, which I'd personally be inclined to use over WhatsApp, but this is still a fantastic move.
qetuo 11y ago
That's nice. What I really want to know is, can Mark Zuckerberg read my messages? Do WhatsApp servers have access to the private keys needed to decrypt my communications? If the answer to those questions is "yes", then it's great that we are now protected from most cybercriminals, but the NSA is probably monitoring our messages. If the answer to those questions is "no", I may actually decide to start using WhatsApp.
- deleted 11y ago
  [deleted]
- rmellow 11y ago
  They cannot read your messages. The entire idea behind this is to give them a claim of technical infeasability if they are served with a warrant. However, if there is/will be some sort of back door to cease encryption without the user's knowledge, that's another matter which really would require it being open source.
  - efdee 11y ago
    How will it being open source guarantee you that the app you downloaded from the platform's store is using the exact same code?
    - rmellow 11y ago
      Jailbroken iPhones or Androids that have an accessible filesystem would give access to the installed executable. Having this, Whatsapp would be subject to having their app disassembled and checked against the source. Sure, they could modify the executable, but it's a PR liability for them.
    - dingo_bat 11y ago
      You can compile the binary yourself and match the SHA1 against the binary downloaded from the store. It seems quite trivial.
      - 11y ago
darkhorn 11y ago
What happens when I log on to WhatsApp Web? How they send my private key from my phone to my web browser?
- nickik 11y ago
  They do not. They create a e2e connection between your phone and your browser. Everything goes threw the phone.
  - osweiller 11y ago
    To post a follow-up comment, what happens when you lose your phone, or simply move to a new phone? Presumably you've lost all of your private keys (I mean...obviously they must not upload them or this would all be farce), message history, etc, right?
    - nickik 11y ago
      Well, the phone number is the identifier. What would happen is that you get a new phone, idenftify via phone number. It would generate new keys but your contacts are still around. You contacts all the notifications (if they have turned them on) that you have new keys. I am not sure about chat history, you think its moved to the cloud if you have that activated. Im not 100% on any of this, but I think that is how it works. If you want something that is not bound to your phone, Threema is pretty nice. If you lose your phone and you have no backup, its gone.
    - pfg 11y ago
      WhatsApp allows you to (optionally) backup your chat history to iCloud or Google Drive. Moving to a new device involves restoring that backup. Your contacts will also have to re-verify your fingerprint. This, of course, is also a way for adversaries to get to your chat history. The backups are not encrypted using a key under your control, so law enforcement could force WhatsApp, Google or Apple to hand over any backups.
    - tinus_hn 11y ago
      Your message history is lost unless you back it up yourself. Your contacts receive a message stating you changed the key once you send them a message or they send you one. I'd presume any messages that were sent before you activated the new key, but not received yet, cannot be decrypted any more. I do not know how this works with push messages though; it used to be such that these can only be sent as-is so the server would need the key.
darkhorn 11y ago
Why some people got "you are end to end encrypted with your friend" while their same friend got "the connection is not end to end encrypted with your friend"?
- mrSugar 11y ago
  Because one end in this "end-to-end" is you, and the other is Facebook's government-facing data storage.
lrei 11y ago
Apps that force you to give them (and everyone else) your phone numbers for .. ummm ... "contact discovery" and yet talk about privacy are a bit of a contradiction. No plausible reason for why apps like WhatsApp (and Signal) couldn't use e-mail addresses for this. Or at least provide it as an alternative. It's even problematic for people who change phone numbers, have multiple phones, want to use desktop clients, etc My opinion: if it requires a phone number, it's not really interested in privacy. Move on.
- BhavdeepSethi 11y ago
  I feel there is no relation to privacy here. It's also the practical choice. Emails can be easily created to by people pretending to be someone else. If you have someone's number on your phone, there is a good chance you have communicated with them before and have thus done some authentication. You can keep creating new email ids to spam people. That becomes very difficult with numbers.
  - lrei 11y ago
    Sure there is. My phone number is private information. And it can trivially be traced back to me (no possibility of anonymity). I don't necessarily want to share it with everyone I want to talk to. Or every company that makes a chat app. I'm pretty sure Snowden didn't start out by giving his phone number around... Plus every successful chat app before WhatsApp (from ICQ, XMPP apps, MS Messenger, Google Chat, Facebook Messenger) was fine without this requirement. Is the hypothesis that it is now impossible to have a successful chat app without it being tied to a phone number? We are not discussing a convenience "option" the user can skip but rather a requirement for these apps to work.
    - pfg 11y ago
      WhatsApp is a mobile messaging app. It's a drop-in replacement for SMS. There would be absolutely no reason for anyone to use WhatsApp if they were just another chat app with their own contact discovery that's not based on phone numbers. Their market share would be miniscule. No one is forcing you to use a messaging app which is using your phone number as an identifier to contact anyone you don't want to see your phone number.
gcr 11y ago
How does the WhatsApp encryption model differ from Apple's iMessage encryption model? - In iMessage, Apple handles key distribution, so if I'm in your contacts, I know the keys for all of your Apple devices. (I'm guessing the private key stays on the device, but I'm not sure). - iMessage seems to provide no way of verifying someone's key fingerprint. - On the other hand, whatsApp seems to force you and your contacts to meet at a Starbucks so you can distribute and sign each other's public keys. Interesting. What other differences are there? (to make this easier, let's assume that both companies implemented the system the way they claim they did)
- pfg 11y ago
  There's really not much of a difference, except that WhatsApp allows you to verify the fingerprint and will notify you if your chat partner's public key changes. WhatsApp doesn't force to you meet your contacts, and there's no "signing each other's public keys" involved at all. There are two levels of authentication or verification - with iMessage, you only get the first one: - The first is WhatsApp telling you "Hey, this is +555 0100. Their public key is 12345. Once upon a time, I sent an SMS to that number, and the device with this key was able to read a code in that message. Looks like the owner to me. Good luck! PS: I might be lying." - (Optional) You compare the fingerprint by meeting in person or communicating through some other secure channel. This will ensure that WhatsApp is not lying to you¹, and that you're actually encrypting messages with a key belonging to the recipient (and vice-versa). ¹ Unless your client has a backdoor, of course.
- osweiller 11y ago
  The app automatically distributes public keys, to my knowledge, and the QR code is merely a validation mechanism to ensure that no MITM is substituting keys. The EFF seems to think the QR code thing is the bee's knees. In practice, I would wager less than 0.1% of users will make use of that functionality. It's more of a placebo.
  - tinus_hn 11y ago
    If there is widespread snooping even a small percentage of users verifying their keys will expose it.
lifeisstillgood 11y ago
I am still trying to wrap my head around privacy in the modern age, and this triggered something for me - this is the end of the privacy-at-a-distance problem. There is a large body of law around making distance communication private ("secure in ones papers" I think is the phrase from American law. Not allowing people to steam open your letters etc) This move, which I am including the inevitable "pgp emails using whatsapp collected public/private keys" seems destined to end the problem - two hundred years of law, one code release. Really sure an email app will be next now they are building a base of secure keys Edit: it's now the purview of regulation to require me to keep / handover private conversations as pre-Snowden and that seems a good thing. It forces surveillance to be active and open once again
eeturunen 11y ago
Too bad 8/10 of your contacts have automatic backups to iCloud or Google Drive enabled. Kind of defeats the idea of "end-to-end". More like end-to-end-to-cloud.
- rtkwe 11y ago
  Apps can control the content that they backup to Google, I'm going to guess Apple has something similar. http://developer.android.com/training/backup/autosyncapi.html http://developer.android.com/training/backup/autosyncapi.htm...
antihero 11y ago
Has the WhatsApp code been audited by trusted third parties? I know it's not quite as good as it being open source, but if we had people we trust audit it, that seems like a good step. Also, disassembly and teardown. I think something this big needs people to really really scrutinise it.
tinus_hn 11y ago
This is quite a big win for privacy. If you use Whisper, Tor or most of the other privacy minded communications mediums, you are in a small minority so you stand out. Because a very large part of the population is using Whatsapp this allows you to communicate privately without standing out.
sleepychu 11y ago
web.whatsapp.com still works, so clearly it's possible for something outside my phone to gain access to my phone generated keys. That doesn't seem backdoorable to me /s.
- pfg 11y ago
  WhatsApp Web communicates directly with your phone. You have to authorize the session from within the app. Communication between your browser and the app is end-to-end encrypted.
  - sleepychu 11y ago
    I hadn't thought about re-encrypting the messages for end to end communication with the browser so it's a plus that the phone doesn't have to give away its keys but there exists a mechanism for the phone to retransmit the messages, because we can't see the source we have no idea if there's a way for WhatsApp to trigger this remotely and as such create a back door.
    - pfg 11y ago
      The existence of this feature has no implications on the question of whether or not there's a backdoor in the client. The current implementation requires approval by the client. A hypothetical backdoor could be anywhere, and you wouldn't know about it unless you check the bytecode.
1024core 11y ago
But WhatsApp requires a phone number, and requires that the recipient (of your message) have your number in their contacts list (or at least you should have their number in your contacts). Once your number (and your contacts') have been leaked to WhatsApp, enough metadata has been leaked to make communication risky. Why doesn't WhatsApp allow anonymous communication? I should be able to create ephemeral WhatsApp "IDs", and anyome who knows my "ID" should be able to communicate with me anonymously and securely, no strings attached.
jsprogrammer 11y ago
Is there a way to build and deploy whatsapp from source?
daveloyall 11y ago
Garden path questions: What's the easiest way to get a copy of your own WhatsApp private key from your phone? What's the easiest way to get a copy of your friend's WhatsApp private key from their phone? What if the phone is rooted, or you can root it? What if they won't hand you the phone? What if they are on your specially built wifi? What if you have a fake cell tower? What if you have a real cell tower? What if you have a different makes/models of phone? for fun: s/phone/debian laptop/g
mark_l_watson 11y ago
Fantastic news - gets us closer to most Internet traffic being encrypted. I have seen complaints that meta data is not hidden, that is, there is a record with who you communicate with. I might have an unpopular opinion here, but I don't think that having the meta data unhidden is in general such a bad thing. I am happy having my communications secure but having who I communicate with potentially public knowledge. Fair compromise. For whistleblowers, protecting metadata is important, so use something else.

330 points by randomname2 11y ago

_wmd 11y ago

This is quite a cavalier recommendation for proprietary unaudited (for the public at least) spyware that uploads your phone book to a company participating in PRISM.

evgen 11y ago
The word "participating" there implies intention, which is a lie. Care to re-phrase?
- _wmd 11y ago
  > The PRISM program collects stored internet communications based on demands made to internet companies such as Google Inc. under Section 702 of the FISA Amendments Act of 2008 to turn over any data that match court-approved search terms I can't imagine it's a simple task for a large company to unintentionally comply with a court demand, there needed to be some wilful choice between attempting to fight it or rolling over
  - antihero 11y ago
    So if you're using literally any messaging app on Android, you're using software by a company cooperating with PRISM?
    - hosay123 11y ago
      Yes, and consequently the platform should not (and in practice does not) receive declarations of high security in its default state. Ignoring PRISM, this is true of every major smart phone platform as they all have remote install and update abilities that excepting Android aren't generally straightforward to disable. Argumentum ad populum is not an excuse for doing something even when you know it's wrong.
deleted 11y ago
[deleted]
kccqzy 11y ago
WhatsApp doesn't upload your phone book. All contact info resolution is done locally.
- _wmd 11y ago
  How does the app figure out another telephone number has a WhatsApp account? How does it fetch profile information for that telephone number without communicating the desire to fetch it to WhatsApp? Perhaps WhatsApp ships their entire profile photo and telephone number database to every phone
  - kccqzy 11y ago
    There are two things here: a) the app can take a snapshot of your phone book, upload it, associate it with your own WhatsApp account, and then keep the remote version synchronised; and b) the app can periodically perform disparate requests to the central directory server to query the profile information for each number. As far as I know, WhatsApp uses approach b. These two may seem similar but in approach b, WhatsApp the service wouldn't learn of any contact removals. WhatsApp the app would, of course, but the service wouldn't. Now, with some simple filtering and statistics, WhatsApp the service can deduce your phone book with some certainty, but I believe most would agree that it is materially different from actually uploading your phone book.
    - pfg 11y ago
      > Now, with some simple filtering and statistics, WhatsApp the service can deduce your phone book with some certainty, but I believe most would agree that it is materially different from actually uploading your phone book. No, not really. Both implementations give WhatsApp a complete list of all my contacts. The fact that one of those implementations might not be 100% accurate because of deleted contacts changes nothing - if you're someone who's worried about a third party having your contact list, it doesn't make sense to think "but hey, they don't know I removed $FOO last week, so their list isn't 100% accurate!". Both implementations mean you'll have to take their word on what they will and won't do with the data, so there's really not much of a practical difference.

lazyjones 11y ago

It's an improvement, but proper end-to-end encryption on unsafe devices is about as useful as seat belts on an airplane.

decasteve 11y ago
So it protects you from bad turbulence but in a catastrophe you are still screwed.

ekianjo 11y ago

EFF recommending closed source clients, erm they just drop in my esteem.

rileymat2 11y ago
They gave it a deduction in their rating and said to prefer open source.
- evgen 11y ago
  Open source does not mean your binary is secure. There are too many counter-examples of this fallacy to even bother enumerating. These widely- distributed binaries will be torn apart and inspected instruction by instruction. That is the only way we will know for sure, and you can bet people will be watching closely going forward. In this case I think lack of open source is not an issue given the reality of the distribution system.
  - pdkl95 11y ago
    > Open source does not mean your binary is secure. Open source is necessary - not sufficient - for security. Other work has to be done. With closed binaries you can't even begin that work.
- nxzero 11y ago
  Is the backend for the Signal's messaging server open source? If so, they should open source the build script too.
  - subliminalpanda 11y ago
    I believe so: https://github.com/WhisperSystems/TextSecure-Server https://github.com/WhisperSystems/TextSecure-Server
vulpino 11y ago
They deduct points as it's still open source. And they are more applauding the fact that WhatsApp - probably the most widely used messaging app currently - has adopted strong end to end encryption, something which other clients have been loathe to do. This is a win. To disregard everything that WhatsApp and Signal have accomplished because WhatsApp isn't open source is silly.

jfindley 11y ago

Doesn't appear to mention metadata at all. While metadata is somewhat tangential to the actual encryption, it's still a vital part of a truly secure messaging platform - who we talk to reveals quite a lot about us. I'm not sure how solvable this is without sacrificing the usability that makes whatsapp as nice to use as it is, and I certainly don't want to take away from how great it is that they've done this - but it is important not to lose sight of the fact that encrypting the contents of your messages is only one part of the puzzle.

edhelas 11y ago
It's the same problem with Signal actually ;) All the communications of the official clients are sent to some "official" Signal Amazon servers (see https://github.com/WhisperSystems/Signal-Android/blob/master/build.gradle#L166-172 https://github.com/WhisperSystems/Signal-Android/blob/master...). Doing end to end encryption is nice, but I really think that having a decentralized AND standard architecture is also very important.
nxzero 11y ago
Agree. Reluctant to be critical of the topic, given how much those involved have managed to get done, but it is very concerning to me from what I'm able to tell how low priorty this issue appears to be. Second issue that to me is pressing given the volume of users is that in my opinion a commitment to execute an audit of the code/crypto/workflow/etc needs to be made; I'd start a campaign to fund this, but such a campaign would be much more likely to succeed if offically acknowledged and more importantly, resources are provide internally to enable it.

sickbeard 11y ago

What? How can you give it 6/7 stars if you don't even know what holes are in the code?

evgen 11y ago
Perhaps by knowing that the distributed binaries will be disassembled and inspected? The same way it would have to be examined even if there was a GitHub repo out there claiming to be the code used?
- osweiller 11y ago
  You've made this claim multiple times now. Do you really honestly believe that disassembled binary code sees the same scrutiny or gained confidence that open source code does? Have you ever analyzed disassembled code? It is non-trivial. No one is going to disassemble this and say "Yup, it passes". That doesn't happen.
  - evgen 11y ago
    As a matter of fact I am certain they will be dissassembled and examined. For the bounty, for the PR and noteriety if you can find a bug or be the one to star in the "<big company> screwed up or lied to us" story of the week. In general, for lots of reasons that seem to motivate a select crowd who have the skills to actually pull this off. If you have the source code it makes the disassembly and examination of whatis distributed a lot easier, but it is not a necessary pre-requisite.
deleted 11y ago
[deleted]

confusedjs 11y ago

This is a bit weird. I don't believe WhatsApp are lying but there's absolutely no proof they're not. I could release a closed source app with a bunch of padlocks in it and copy/paste their white paper and have exactly the same level of proof of security. Would I get a 7/10 from EFF?

ikeboy 11y ago
If you had the credibility of a billion dollar company behind you saying that you're not making it up, then probably.
- noahbradley 11y ago
  Because Facebook is known so well for their respect of privacy.
  - ikeboy 11y ago
    They're known for not lying through their teeth about what features they've implemented, like most large companies.
    - lunula 11y ago
      There are a lot of generalizations there. Do you have example of an audit showing that they have never misguided their users or represented their product and motivations?
      - ikeboy 11y ago
        No, and the burden of proof would be on you if you're claiming it's likely that they're lying. Edit: my broad claim is basically that companies won't lie about what their products do, if their claims are specific. In this case, they released a whitepaper with technical details. If a company makes a broad unspecific claim, it's possible to be wrong or misleading without the implication of a deliberate lie by the company. In this scenario, it's not possible for it be wrong without a direct decision to lie, and therefore I think the reputational damage would be great if exposed, and it would be easily exposed by analysing network traffic before long. What I'm claiming in the specific here is that "the system implemented matches what the whitepaper says". I wouldn't put it beyond facebook to backdoor it in a way that's hard to figure out (with the backdoor included in the whitepaper ala Dual_EC_DRBG), but I'd consider that to be unlikely (firstly because there are actual humans behind it at the end of the day, and I'd hope that they would feel that "claim to release encryption but put a backdoor in" is morally worse than just not releasing encryption at all, and secondly because Whisper systems is involved). But all of that could arise in an open source system as well. What I have high confidence in is that the system matches the whitepaper. (There's also the possibility of an implementation problem that preserves plausible deniability for them, which I also consider unlikely.) All in all, reducing their grade by 1 point to account for additional risk in closed source seems reasonable to me.

sschueller 11y ago

I hope I can get my friends to switch to actor IM [1] or some other open source solution that doesn't suck. In the end all these chat systems turn into crap full of ads even if they aren't spying on you. [1] https://actor.im/ https://actor.im/

edhelas 11y ago
Seems centralized and doesn't rely on a standard. If I were you, I would forget this solution as well.
- sschueller 11y ago
  What else is there with a decent client that is open source?
  - edhelas 11y ago
    On Android you have Conversations (https://conversations.im/ https://conversations.im/) based on XMPP, good looking, nice battery optimizations, and supporting E2E encryption. And you have the XMPP federation behind.
- nickik 11y ago
  You can set up your own server. They want to devlop a federated protocol. So they are the only ones that actually have stated a goal to devlop something like that. OWS would probebly do it as well if they had the time and money. They already have the best clients in the buissness, if they manage to get the crypto and the federation right, it would be fantastic. They also have some support for using their web and desktop clients with email. I wish the Actor guys the best of luck.
  - edhelas 11y ago
    "They want to develop a federated protocol". There is already one, it's a IETF standard, deployed accross the globe and have already hundreds of clients and several serious servers : XMPP.

SeanDav 11y ago

I am so cynical (or is that realistic?) these days, that I would not trust the encryption on WhatsApp as far as I can throw a large, adult saltwater crocodile.

kasey_junk 11y ago
They implemented a known & vetted encryption protocol with expert consultation from the outside. Its one of the most widely distributed apps in the world & thus likely to have lots of people looking at it. If you don't trust it, is there any possible encryption scheme you would trust?
- darklajid 11y ago
  I think the general trust issues people have are - metadata / contact lists in the hand of Facebook - a proprietary binary that _claims_ to use said encryption schemes Scenarios that you could come up with: The next version of WhatsApp sends unencrypted data again. WhatsApp encrypts for your recipient just fine, but also encrypts the same message for the great Facebook skeleton key. Basically trust is a bigger problem than you acknowledge here, I think. If you trust the encryption scheme, even the specific encryption implementation, then you still need to trust the (binary, closed) application. Ignoring the metadata issue completely for now.
  - rtkwe 11y ago
    >The next version of WhatsApp sends unencrypted data again. >WhatsApp encrypts for your recipient just fine, but also encrypts the same message for the great Facebook skeleton key. Both of these can and would show up in an analysis of the code.

ianpurton 11y ago

It's great that WhatsApp can't see my cat pictures anymore. But there are 2 privacy and free speech issues that are not met. Firstly META DATA. They know who I contact, when I contact them and how frequently. So people could derive information about me based on who I talk to. Secondly, they can ban me. Perhaps the EFF need to add more criteria to their secure message score card. https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard But on the whole, a positive move.

nxzero 11y ago
Agree. Reluctant to be critical of the topic, given how much those involved have managed to get done, but it is very concerning to me from what I'm able to tell how low priorty this issue appears to be. Second issue that to me is pressing given the volume of users is that in my opinion a commitment to execute an audit of the code/crypto/workflow/etc needs to be made; I'd start a campaign to fund this, but such a campaign would be much more likely to succeed if offically acknowledged and more importantly, resources are provide internally to enable it.
- ianpurton 11y ago
  True, forgot about that. Even if we could see the code, it might be possible for google or apple to send certain groups of people modified software updates?
maxerickson 11y ago
When the client is a phone and the service is rapid messaging, how do you even begin to solve the metadata problem? Even with opaque routing the phone company can correlate activity times.
- ianpurton 11y ago
  You could use a decentralised network such as Bitcoin to send messages. I would also implement Bloom filters to lower my network usage and confuse the nodes. https://en.wikipedia.org/wiki/Bloom_filter https://en.wikipedia.org/wiki/Bloom_filter I would choose random nodes to cause a bit more noise. And finally my messages would have some sort of Bloom filter derived destination address. So as to confuse it all a bit more.

nxzero 11y ago

Get the sense that EFF didn't even talk to any of the parties involved before posting their review, and to me, given how much weight they carry in the community, it's unclear why they didn't.

tptacek 11y ago

EFF should stop with this silly scorecard. I hate the thing because it's inaccurate and incoherent (arguments I've made ad nauseam elsewhere on HN), but on this thread you can see another good reason: it makes EFF the ref, and crowds always try to work the ref. So whatever "score" WhatsApp gets, it's the wrong score, because: not open source; because: runs on iPhones; because: metadata; because: Facebook is evil, &c.

nxzero 11y ago
What then is good for the masses?
- Loque 11y ago
  IMHO it really depends on what you are doing; - Chatting with friends? = Whatsapp - International drug deals? != Whatsapp
  - nxzero 11y ago
    Goal should be mass adoption of universal turnkey state-level OPSEC for everyday use.
- tptacek 11y ago
  I like the idea of a three-tier threat model: Tier 1: potentially inconvenient but maximally secure, in an OPSEC sense (PGP, for instance, though I would personally put Signal here too). Use carefully for security against state-level adversaries. Tier 2: convenient mainstream applications with strong security but some tradeoffs. Your default choice, security against criminal adversaries. I'd put WhatsApp and iMessage here (but not many others). Tier 3: unencrypted or dubiously encrypted mainstream applications, unsafe against any adversary, but potentially useful as an endpoint to (cautiously) bootstrap communications. Google Talk and AIM would go here for me.
  - eru 11y ago
    PGP doesn't have plausible deniability. It actually has `you can prove anyone else what I said to you', if you sign anything. That's dangerous, so shouldn't be on tier 1. (Or at least that's how it used to be.)

shaggy 11y ago

It's important to point out that all the Whisper Systems code is open source (https://github.com/whispersystems/ https://github.com/whispersystems/). So if you have concerns, go read their code. Some of the best minds in security have, and they've come away with good things to say. There's a desktop version of Signal coming, which I'd personally be inclined to use over WhatsApp, but this is still a fantastic move.

qetuo 11y ago

That's nice. What I really want to know is, can Mark Zuckerberg read my messages? Do WhatsApp servers have access to the private keys needed to decrypt my communications? If the answer to those questions is "yes", then it's great that we are now protected from most cybercriminals, but the NSA is probably monitoring our messages. If the answer to those questions is "no", I may actually decide to start using WhatsApp.

deleted 11y ago
[deleted]
rmellow 11y ago
They cannot read your messages. The entire idea behind this is to give them a claim of technical infeasability if they are served with a warrant. However, if there is/will be some sort of back door to cease encryption without the user's knowledge, that's another matter which really would require it being open source.
- efdee 11y ago
  How will it being open source guarantee you that the app you downloaded from the platform's store is using the exact same code?
  - rmellow 11y ago
    Jailbroken iPhones or Androids that have an accessible filesystem would give access to the installed executable. Having this, Whatsapp would be subject to having their app disassembled and checked against the source. Sure, they could modify the executable, but it's a PR liability for them.
  - dingo_bat 11y ago
    You can compile the binary yourself and match the SHA1 against the binary downloaded from the store. It seems quite trivial.
    - 11y ago

darkhorn 11y ago

What happens when I log on to WhatsApp Web? How they send my private key from my phone to my web browser?

nickik 11y ago
They do not. They create a e2e connection between your phone and your browser. Everything goes threw the phone.
- osweiller 11y ago
  To post a follow-up comment, what happens when you lose your phone, or simply move to a new phone? Presumably you've lost all of your private keys (I mean...obviously they must not upload them or this would all be farce), message history, etc, right?
  - nickik 11y ago
    Well, the phone number is the identifier. What would happen is that you get a new phone, idenftify via phone number. It would generate new keys but your contacts are still around. You contacts all the notifications (if they have turned them on) that you have new keys. I am not sure about chat history, you think its moved to the cloud if you have that activated. Im not 100% on any of this, but I think that is how it works. If you want something that is not bound to your phone, Threema is pretty nice. If you lose your phone and you have no backup, its gone.
  - pfg 11y ago
    WhatsApp allows you to (optionally) backup your chat history to iCloud or Google Drive. Moving to a new device involves restoring that backup. Your contacts will also have to re-verify your fingerprint. This, of course, is also a way for adversaries to get to your chat history. The backups are not encrypted using a key under your control, so law enforcement could force WhatsApp, Google or Apple to hand over any backups.
  - tinus_hn 11y ago
    Your message history is lost unless you back it up yourself. Your contacts receive a message stating you changed the key once you send them a message or they send you one. I'd presume any messages that were sent before you activated the new key, but not received yet, cannot be decrypted any more. I do not know how this works with push messages though; it used to be such that these can only be sent as-is so the server would need the key.

darkhorn 11y ago

Why some people got "you are end to end encrypted with your friend" while their same friend got "the connection is not end to end encrypted with your friend"?

mrSugar 11y ago
Because one end in this "end-to-end" is you, and the other is Facebook's government-facing data storage.

lrei 11y ago

Apps that force you to give them (and everyone else) your phone numbers for .. ummm ... "contact discovery" and yet talk about privacy are a bit of a contradiction. No plausible reason for why apps like WhatsApp (and Signal) couldn't use e-mail addresses for this. Or at least provide it as an alternative. It's even problematic for people who change phone numbers, have multiple phones, want to use desktop clients, etc My opinion: if it requires a phone number, it's not really interested in privacy. Move on.

BhavdeepSethi 11y ago
I feel there is no relation to privacy here. It's also the practical choice. Emails can be easily created to by people pretending to be someone else. If you have someone's number on your phone, there is a good chance you have communicated with them before and have thus done some authentication. You can keep creating new email ids to spam people. That becomes very difficult with numbers.
- lrei 11y ago
  Sure there is. My phone number is private information. And it can trivially be traced back to me (no possibility of anonymity). I don't necessarily want to share it with everyone I want to talk to. Or every company that makes a chat app. I'm pretty sure Snowden didn't start out by giving his phone number around... Plus every successful chat app before WhatsApp (from ICQ, XMPP apps, MS Messenger, Google Chat, Facebook Messenger) was fine without this requirement. Is the hypothesis that it is now impossible to have a successful chat app without it being tied to a phone number? We are not discussing a convenience "option" the user can skip but rather a requirement for these apps to work.
  - pfg 11y ago
    WhatsApp is a mobile messaging app. It's a drop-in replacement for SMS. There would be absolutely no reason for anyone to use WhatsApp if they were just another chat app with their own contact discovery that's not based on phone numbers. Their market share would be miniscule. No one is forcing you to use a messaging app which is using your phone number as an identifier to contact anyone you don't want to see your phone number.

gcr 11y ago

How does the WhatsApp encryption model differ from Apple's iMessage encryption model? - In iMessage, Apple handles key distribution, so if I'm in your contacts, I know the keys for all of your Apple devices. (I'm guessing the private key stays on the device, but I'm not sure). - iMessage seems to provide no way of verifying someone's key fingerprint. - On the other hand, whatsApp seems to force you and your contacts to meet at a Starbucks so you can distribute and sign each other's public keys. Interesting. What other differences are there? (to make this easier, let's assume that both companies implemented the system the way they claim they did)

pfg 11y ago
There's really not much of a difference, except that WhatsApp allows you to verify the fingerprint and will notify you if your chat partner's public key changes. WhatsApp doesn't force to you meet your contacts, and there's no "signing each other's public keys" involved at all. There are two levels of authentication or verification - with iMessage, you only get the first one: - The first is WhatsApp telling you "Hey, this is +555 0100. Their public key is 12345. Once upon a time, I sent an SMS to that number, and the device with this key was able to read a code in that message. Looks like the owner to me. Good luck! PS: I might be lying." - (Optional) You compare the fingerprint by meeting in person or communicating through some other secure channel. This will ensure that WhatsApp is not lying to you¹, and that you're actually encrypting messages with a key belonging to the recipient (and vice-versa). ¹ Unless your client has a backdoor, of course.
osweiller 11y ago
The app automatically distributes public keys, to my knowledge, and the QR code is merely a validation mechanism to ensure that no MITM is substituting keys. The EFF seems to think the QR code thing is the bee's knees. In practice, I would wager less than 0.1% of users will make use of that functionality. It's more of a placebo.
- tinus_hn 11y ago
  If there is widespread snooping even a small percentage of users verifying their keys will expose it.

lifeisstillgood 11y ago

I am still trying to wrap my head around privacy in the modern age, and this triggered something for me - this is the end of the privacy-at-a-distance problem. There is a large body of law around making distance communication private ("secure in ones papers" I think is the phrase from American law. Not allowing people to steam open your letters etc) This move, which I am including the inevitable "pgp emails using whatsapp collected public/private keys" seems destined to end the problem - two hundred years of law, one code release. Really sure an email app will be next now they are building a base of secure keys Edit: it's now the purview of regulation to require me to keep / handover private conversations as pre-Snowden and that seems a good thing. It forces surveillance to be active and open once again

eeturunen 11y ago

Too bad 8/10 of your contacts have automatic backups to iCloud or Google Drive enabled. Kind of defeats the idea of "end-to-end". More like end-to-end-to-cloud.

rtkwe 11y ago
Apps can control the content that they backup to Google, I'm going to guess Apple has something similar. http://developer.android.com/training/backup/autosyncapi.html http://developer.android.com/training/backup/autosyncapi.htm...

antihero 11y ago

Has the WhatsApp code been audited by trusted third parties? I know it's not quite as good as it being open source, but if we had people we trust audit it, that seems like a good step. Also, disassembly and teardown. I think something this big needs people to really really scrutinise it.

tinus_hn 11y ago

This is quite a big win for privacy. If you use Whisper, Tor or most of the other privacy minded communications mediums, you are in a small minority so you stand out. Because a very large part of the population is using Whatsapp this allows you to communicate privately without standing out.

sleepychu 11y ago

web.whatsapp.com still works, so clearly it's possible for something outside my phone to gain access to my phone generated keys. That doesn't seem backdoorable to me /s.

pfg 11y ago
WhatsApp Web communicates directly with your phone. You have to authorize the session from within the app. Communication between your browser and the app is end-to-end encrypted.
- sleepychu 11y ago
  I hadn't thought about re-encrypting the messages for end to end communication with the browser so it's a plus that the phone doesn't have to give away its keys but there exists a mechanism for the phone to retransmit the messages, because we can't see the source we have no idea if there's a way for WhatsApp to trigger this remotely and as such create a back door.
  - pfg 11y ago
    The existence of this feature has no implications on the question of whether or not there's a backdoor in the client. The current implementation requires approval by the client. A hypothetical backdoor could be anywhere, and you wouldn't know about it unless you check the bytecode.

1024core 11y ago

But WhatsApp requires a phone number, and requires that the recipient (of your message) have your number in their contacts list (or at least you should have their number in your contacts). Once your number (and your contacts') have been leaked to WhatsApp, enough metadata has been leaked to make communication risky. Why doesn't WhatsApp allow anonymous communication? I should be able to create ephemeral WhatsApp "IDs", and anyome who knows my "ID" should be able to communicate with me anonymously and securely, no strings attached.

jsprogrammer 11y ago

Is there a way to build and deploy whatsapp from source?

daveloyall 11y ago

Garden path questions: What's the easiest way to get a copy of your own WhatsApp private key from your phone? What's the easiest way to get a copy of your friend's WhatsApp private key from their phone? What if the phone is rooted, or you can root it? What if they won't hand you the phone? What if they are on your specially built wifi? What if you have a fake cell tower? What if you have a real cell tower? What if you have a different makes/models of phone? for fun: s/phone/debian laptop/g

mark_l_watson 11y ago

Fantastic news - gets us closer to most Internet traffic being encrypted. I have seen complaints that meta data is not hidden, that is, there is a record with who you communicate with. I might have an unpopular opinion here, but I don't think that having the meta data unhidden is in general such a bad thing. I am happy having my communications secure but having who I communicate with potentially public knowledge. Fair compromise. For whistleblowers, protecting metadata is important, so use something else.