3 ms·
I don't think I get your complaint Without open-sourcing the crypto, they could be just doing rot16($message) for all we know. Open-source is a requirement for
by CaptSpify 11y ago
I don't think I get your complaint
Without open-sourcing the crypto, they could be just doing rot16($message) for all we know. Open-source is a requirement for being considered secure. It doesn't mean they aren't secure if they aren't open-source, but that you shouldn't consider it so, because you don't know if it is or not.
- CiPHPerCoder 11y ago> I don't think I get your complaint > Without open-sourcing the crypto, they could be just doing rot16($message) for all we know. There are two things you can do: 1. Watch the outbound traffic and attempt known-plaintext attacks 2. Reverse engineer the app Neither is particularly difficult. Most Android apps are trivial to break apart using Lobotomy. A large swath of software security folks specialize in binary auditing.
- ikeboy 11y agoHas anyone done that and produced a fully open source app to connect to whatsapp?
- ryanlol 11y agoLots of people. https://github.com/tgalal/yowsup https://github.com/tgalal/yowsup for example
- ikeboy 11y agoLooks like WhatsApp isn't so happy about that ... https://gigaom.com/2015/01/20/whatsapp-cracks-down-on-people-using-unofficial-clients/ https://gigaom.com/2015/01/20/whatsapp-cracks-down-on-people... Do you know if the clients work with the new encryption?
- ryanlol 11y agoYes, axolotl is open source. (However I can't comment on how much it's been modified for the official client)