3 ms·
That's fair! But you need far more than just the crypto code to create a client, I think open source protocol specs would already achieve this. And my main co
by ryanlol 11y ago
That's fair!
But you need far more than just the crypto code to create a client, I think open source protocol specs would already achieve this.
And my main complaint was with the claim that open sourcing their crypto code would somehow make a meaningful difference to the security of these applications to the extent where you could consider all applications that haven't done so "insecure".
- CaptSpify 11y agoI don't think I get your complaint Without open-sourcing the crypto, they could be just doing rot16($message) for all we know. Open-source is a requirement for being considered secure. It doesn't mean they aren't secure if they aren't open-source, but that you shouldn't consider it so, because you don't know if it is or not.
- CiPHPerCoder 11y ago> I don't think I get your complaint > Without open-sourcing the crypto, they could be just doing rot16($message) for all we know. There are two things you can do: 1. Watch the outbound traffic and attempt known-plaintext attacks 2. Reverse engineer the app Neither is particularly difficult. Most Android apps are trivial to break apart using Lobotomy. A large swath of software security folks specialize in binary auditing.
- ikeboy 11y agoHas anyone done that and produced a fully open source app to connect to whatsapp?
- ryanlol 11y agoLots of people. https://github.com/tgalal/yowsup https://github.com/tgalal/yowsup for example
- ikeboy 11y agoLooks like WhatsApp isn't so happy about that ... https://gigaom.com/2015/01/20/whatsapp-cracks-down-on-people-using-unofficial-clients/ https://gigaom.com/2015/01/20/whatsapp-cracks-down-on-people... Do you know if the clients work with the new encryption?
- ryanlol 11y agoYes, axolotl is open source. (However I can't comment on how much it's been modified for the official client)