4 ms·

I had a similar thought with WhatsApp's Signal announcement. I believe that on iOS, by default all WhatsApp messages are backed up to iCloud Drive. So that woul

by yalooze 11y ago

I had a similar thought with WhatsApp's Signal announcement. I believe that on iOS, by default all WhatsApp messages are backed up to iCloud Drive. So that would seem to be an easier attack vector.

ikeboy 11y ago
http://blog.elcomsoft.com/2015/11/a-new-tool-for-whatsapp-acquisition/ http://blog.elcomsoft.com/2015/11/a-new-tool-for-whatsapp-ac...
endymi0n 11y ago
Not just the messages - the key too. Just imagine the outcry from someone breaking his iPhone not being able to restore his messages because of the introduction of end-to-end. That way, you don't even have to attack WhatsApp itself and they have all the plausible deniability they needed.
- mtgx 11y ago
  Why would the key be backed up to iCloud? Do you have a source for this?
  - wyldfire 11y ago
    Does iOS have a way to designate parts of app data as secret/transient/do_not_back_up? I suspect not. EDIT: It appears that I was incorrect.
    - ctz 11y ago
      Yes, the NSURLIsExcludedFromBackupKey file property.
- sneak 11y ago
  The cryptosystem in use by Signal and now WhatsApp does not work this way. It offers forward secrecy, where recovery of the long-term keys will not allow decryption of past intercepted encrypyed messages.
- eeeeeeeeeeeee 11y ago
  Would love to see a source on this. Every time I restore an iOS device, I need to manually re-enter anything secret like passwords.
biokoda 11y ago
The only text/voip app that securely stores its data is Biocoded (https://biocoded.com/home https://biocoded.com/home). Even if the local on-device database gets copied elsewhere, it will be undecryptable outside of that device.
- tetrep 11y ago
  What's wrong with Signal's encrypted storage? AFAIK if you set a password it will be used to encrypt local storage of your messages.
  - biokoda 11y ago
    It's not that difficult to break. Anything encrypted with a password is not all that secure. Someone can clone your device or by using a security hole in the device can get to that storage blob and eventually crack it in reasonable time.
    - caf 11y ago
      That entirely depends on how much entropy is in your passphrase. It's entirely possible to use one that cannot be cracked in reasonable time.
- Natanael_L 11y ago
  Signal on Android offers password protected encryption for chat logs

by yalooze 11y ago

I had a similar thought with WhatsApp's Signal announcement. I believe that on iOS, by default all WhatsApp messages are backed up to iCloud Drive. So that would seem to be an easier attack vector.

ikeboy 11y ago

http://blog.elcomsoft.com/2015/11/a-new-tool-for-whatsapp-acquisition/ http://blog.elcomsoft.com/2015/11/a-new-tool-for-whatsapp-ac...

endymi0n 11y ago

Not just the messages - the key too. Just imagine the outcry from someone breaking his iPhone not being able to restore his messages because of the introduction of end-to-end. That way, you don't even have to attack WhatsApp itself and they have all the plausible deniability they needed.

mtgx 11y ago
Why would the key be backed up to iCloud? Do you have a source for this?
- wyldfire 11y ago
  Does iOS have a way to designate parts of app data as secret/transient/do_not_back_up? I suspect not. EDIT: It appears that I was incorrect.
  - ctz 11y ago
    Yes, the NSURLIsExcludedFromBackupKey file property.
sneak 11y ago
The cryptosystem in use by Signal and now WhatsApp does not work this way. It offers forward secrecy, where recovery of the long-term keys will not allow decryption of past intercepted encrypyed messages.
eeeeeeeeeeeee 11y ago
Would love to see a source on this. Every time I restore an iOS device, I need to manually re-enter anything secret like passwords.

biokoda 11y ago

The only text/voip app that securely stores its data is Biocoded (https://biocoded.com/home https://biocoded.com/home). Even if the local on-device database gets copied elsewhere, it will be undecryptable outside of that device.

tetrep 11y ago
What's wrong with Signal's encrypted storage? AFAIK if you set a password it will be used to encrypt local storage of your messages.
- biokoda 11y ago
  It's not that difficult to break. Anything encrypted with a password is not all that secure. Someone can clone your device or by using a security hole in the device can get to that storage blob and eventually crack it in reasonable time.
  - caf 11y ago
    That entirely depends on how much entropy is in your passphrase. It's entirely possible to use one that cannot be cracked in reasonable time.
Natanael_L 11y ago
Signal on Android offers password protected encryption for chat logs