7 ms·

This article glosses over a few important details. The reason that end to end encryption exists is precisely because man in the middle attacks are possible, an

by moxie 10y ago

This article glosses over a few important details. The reason that end to end encryption exists is precisely because man in the middle attacks are possible, and always will be. This kind of attack is devastating for Telegram, because by default they don't use end to end encryption, and instead store the entire plaintext history of every message you've ever sent or received, all of which an attacker instantly gets access to. For WhatsApp, everything is end to end encrypted by default, so the attacker doesn't get any message history. All of the contacts for the MITM'd user also get a notice that their contact's security code changed, and a comparison will fail to match. This is exactly what E2E was built to protect against.

ultramancool 10y ago
Yeah, I don't see how this is devastating for WhatsApp - you simply verify the other party's key once and then good to go, if it ever changes you'll get a big scary warning (you'll get that anyways but you should still verify the key in case your initial session was compromised). Admittedly I've only worked with Signal, but I'm assuming WhatsApp offers similar as they hired the same devs. Am I missing something here? I don't see how this attack would be useful against end-to-end encrypted messaging apps (well, properly implemented ones at least).
- dingaling 10y ago
  > you simply verify the other party's key once and then good to go Against what, though? The key that Whatsapp asserts is valid for the other user? As far as I am aware there's no way to access and visually eyeball-compare the raw keys in Whatsapp, just what the app presents as a signature or QR code. Open to correction.
  - ultramancool 10y ago
    > Against what, though? The key that Whatsapp asserts is valid for the other user? No, against the other person sitting at the table with you via QR code scanning. Or their voice speaking the public key via another channel. > just what the app presents as a signature or QR code. Open to correction. What's wrong with the QR code? That QR code is a hash of the public key and exactly what you need for this identity verification purpose. If the pubkey changes after you've scanned it, you know you've got to verify that person again before sharing anything private over that channel.
    - geocar 10y ago
      > What's wrong with the QR code? That QR code is a hash of the public key I have no way to verify that. If WhatsApp is trustworthy and secure, then the QR code might be a hash of the public key, but to be completely frank, it could be anything. * I don't have the source code. * Nobody I know has the source code * Nobody I know has bothered to jailbreak their device and/or decompile the binary. I just got an update recently, and my friends are busy. If I had access to my own public and private key, I (or someone I know) could conceivably verify that I'm using it by decrypting my messages using another device (e.g. using wireshark). I appreciate that you might have the source code, or know someone with the source code, or might have reverse engineered the most recent update and have more confidence than I do, but you cannot transmit that confidence to me by simply insisting that it is the hash of the public key.
      - ultramancool 10y ago
        > If WhatsApp is trustworthy and secure, then the QR code might be a hash of the public key, but to be completely frank, it could be anything. Sure, but we're talking about this specific attack's effect on WhatsApp, if you want to debate the relative merits of open source vs closed source End-To-End encryption tools, you may have a point, but it's not one that's relevant here as it has nothing to do with this attack. Unless the attack can be used to update the app or something with a modified malicious version. Say it were Signal instead of WhatsApp if you must. Is there any effect made by this attack?
        geocar 10y ago
        > Say it were Signal instead of WhatsApp if you must. Is there any effect made by this attack? This is what's known as a false dichotomy. Both systems are as implemented not secure from this attack for the reason I just said.
      - moxie 10y ago
        The source code is for generating the QR code is online here: https://github.com/WhisperSystems/libsignal-protocol-java/blob/master/java/src/main/java/org/whispersystems/libsignal/fingerprint/ScannableFingerprint.java https://github.com/WhisperSystems/libsignal-protocol-java/bl...
  - moxie 10y ago
    Check out the image at the top of the post: https://whispersystems.org/blog/whatsapp-complete/ https://whispersystems.org/blog/whatsapp-complete/
- williamscales 10y ago
  I think WhatsApp has the big scary warning when keys change disabled by default. You can enable it for yourself but it's buried in the settings.
  - avar 10y ago
    For anyone looking for it: Settings -> Account -> Security -> "Show security notifications = on".
    - mtgx 10y ago
      I hope Moxie can share with us why this feature is disabled by default. Does Whatsapp really think the notification would quickly become very annoying for regular users? How often would someone's closest friends really change their phones or uninstall Whatsapp? I imagine not that often for this to be a huge inconvenience, which is why I don't understand why the setting is off by default. Maybe it's something else I'm missing, which is why it would be good for Moxie or Whatsapp to clear up this puzzling choice. Also I hope both the Whatsapp and Signal teams think of ways to encourage security code authentication through better UI. Viber, for instance, has taken an interesting approach to encouraging easier authentication. It probably still doesn't go far enough to make it easy enough for just about anyone to want to authenticate their contacts, but I'd like to see more of this sort of UI experimentation: https://support.viber.com/customer/portal/articles/2017401-viber-security-faq https://support.viber.com/customer/portal/articles/2017401-v...
      - sievebrain 10y ago
        He has said before that key changes in the wild are an extremely common event. I imagine even just the notification that chats are now encrypted caused a lot of confusion and upset given the enormous size of the userbase. Spamming users with warnings that 99.9999% of the time will not be understandable let alone actionable is a quick way to get another SSL warning dialog scenario.
        feld 10y ago
dang 10y ago
Ok, we changed the title in an attempt to make it less misleading. If anybody suggests a better (more accurate and neutral) title, we can change it again.
maesho 10y ago
And that is why Telgram offers two factor authentication. https://twitter.com/durov/status/726104566899609600 https://twitter.com/durov/status/726104566899609600
- wglb 10y ago
  How does two factor authentication address they don't use end to end encryption, and instead store the entire plaintext history of every message you've ever sent or received?
Fry-kun 10y ago
So many people confuse encryption with authentication... Suppose you're a whistleblower trying to contact a reporter using WhatsApp. You've never met in person, so you send a message over WhatsApp, "Hello!" The reporter replies, "Hi!" You now have a big problem -- you don't KNOW that it was the reporter who replied to you, it might've been a nefarious 3rd party who already intercepted your original message and is now replying. WhatsApp's only mechanism for checking if that's the case is comparing some numbers out-of-band (e.g. in person, with QR codes). What's even more tragic is that WhatsApp doesn't track/show which contacts you may have already authenticated.. good luck remembering which of your 100 contacts are verified
- Royalaid 10y ago
  Just curious, how would you solve the authentication problem? I worked on a semester long project building decentralized chat and found this as well as bootstrapping to a node that you could trust be some of that hardest problems to solve because it always boiled down to just trust.
  - sigmar 10y ago
    I'd offer up keybase.io as a workable way to solve this authentication problem. On keybase I can authenticate my identify by leveraging social media and public identify proofs across multiple services.
  - ashitlerferad 10y ago
    There are several ways: Central authorities: SSL, DNSSEC TOFU: SSH, OTR etc Web of trust: OpenPGP Not sure, but I think Signal/WhatsApp a combination of central authority, TOFU and in-person 2 party verification, but no web of trust.
  - baby 10y ago
    As he said, first you should encourage your users to authenticate one others by out-of-bands means. Then display who you truly authenticated. This can be gamified to encourage users doing it. Now to authenticate a user out of band you can just have a shared secret that both users need to enter. You can share that secret via another channel in hope that it is not man-in-the-middled (or at least not by the same attacker). But then it is close to a trust on first use (TOFU) security: often "good enough", sometimes not (SMS). Now if you're looking for cool ways to force the user to do it IRL, there are things like Bluetooth and NFC that would help. There are also easier ways to do that, as ashitlerferad says, that we use for larger problems like mail and www: web of trust (WOT) and public key infrastructure (PKI).
snowpanda 10y ago
>This kind of attack is devastating for Telegram Security flaws are found with any software on a regular basis. To say that it will 'devastate' a project is completely blown out of proportion. The first TrueCrypt had a lot of flaws and it still were to become the most popular encryption software. The whole point of updates is that something can be improved when flaws are found. >For WhatsApp, everything is end to end encrypted by default, so the attacker doesn't get any message history. All of the contacts for the MITM'd user also get a notice that their contact's security code changed, and a comparison will fail to match. This is exactly what E2E was built to protect against. All of this 'safety' is rendered false hope when we can't conclude that WhatsApp isn't backdoored. Trusting a closed source project by Facebook is completely nonsensical imo.
nebulous1 10y ago
Actually the changed identity notification in WhatsApp is turned off by default, so make sure you turn it on.

by moxie 10y ago

ultramancool 10y ago

Yeah, I don't see how this is devastating for WhatsApp - you simply verify the other party's key once and then good to go, if it ever changes you'll get a big scary warning (you'll get that anyways but you should still verify the key in case your initial session was compromised). Admittedly I've only worked with Signal, but I'm assuming WhatsApp offers similar as they hired the same devs. Am I missing something here? I don't see how this attack would be useful against end-to-end encrypted messaging apps (well, properly implemented ones at least).

dingaling 10y ago
> you simply verify the other party's key once and then good to go Against what, though? The key that Whatsapp asserts is valid for the other user? As far as I am aware there's no way to access and visually eyeball-compare the raw keys in Whatsapp, just what the app presents as a signature or QR code. Open to correction.
- ultramancool 10y ago
  > Against what, though? The key that Whatsapp asserts is valid for the other user? No, against the other person sitting at the table with you via QR code scanning. Or their voice speaking the public key via another channel. > just what the app presents as a signature or QR code. Open to correction. What's wrong with the QR code? That QR code is a hash of the public key and exactly what you need for this identity verification purpose. If the pubkey changes after you've scanned it, you know you've got to verify that person again before sharing anything private over that channel.
  - geocar 10y ago
    > What's wrong with the QR code? That QR code is a hash of the public key I have no way to verify that. If WhatsApp is trustworthy and secure, then the QR code might be a hash of the public key, but to be completely frank, it could be anything. * I don't have the source code. * Nobody I know has the source code * Nobody I know has bothered to jailbreak their device and/or decompile the binary. I just got an update recently, and my friends are busy. If I had access to my own public and private key, I (or someone I know) could conceivably verify that I'm using it by decrypting my messages using another device (e.g. using wireshark). I appreciate that you might have the source code, or know someone with the source code, or might have reverse engineered the most recent update and have more confidence than I do, but you cannot transmit that confidence to me by simply insisting that it is the hash of the public key.
    - ultramancool 10y ago
      > If WhatsApp is trustworthy and secure, then the QR code might be a hash of the public key, but to be completely frank, it could be anything. Sure, but we're talking about this specific attack's effect on WhatsApp, if you want to debate the relative merits of open source vs closed source End-To-End encryption tools, you may have a point, but it's not one that's relevant here as it has nothing to do with this attack. Unless the attack can be used to update the app or something with a modified malicious version. Say it were Signal instead of WhatsApp if you must. Is there any effect made by this attack?
      - geocar 10y ago
        > Say it were Signal instead of WhatsApp if you must. Is there any effect made by this attack? This is what's known as a false dichotomy. Both systems are as implemented not secure from this attack for the reason I just said.
    - moxie 10y ago
      The source code is for generating the QR code is online here: https://github.com/WhisperSystems/libsignal-protocol-java/blob/master/java/src/main/java/org/whispersystems/libsignal/fingerprint/ScannableFingerprint.java https://github.com/WhisperSystems/libsignal-protocol-java/bl...
- moxie 10y ago
  Check out the image at the top of the post: https://whispersystems.org/blog/whatsapp-complete/ https://whispersystems.org/blog/whatsapp-complete/
williamscales 10y ago
I think WhatsApp has the big scary warning when keys change disabled by default. You can enable it for yourself but it's buried in the settings.
- avar 10y ago
  For anyone looking for it: Settings -> Account -> Security -> "Show security notifications = on".
  - mtgx 10y ago
    I hope Moxie can share with us why this feature is disabled by default. Does Whatsapp really think the notification would quickly become very annoying for regular users? How often would someone's closest friends really change their phones or uninstall Whatsapp? I imagine not that often for this to be a huge inconvenience, which is why I don't understand why the setting is off by default. Maybe it's something else I'm missing, which is why it would be good for Moxie or Whatsapp to clear up this puzzling choice. Also I hope both the Whatsapp and Signal teams think of ways to encourage security code authentication through better UI. Viber, for instance, has taken an interesting approach to encouraging easier authentication. It probably still doesn't go far enough to make it easy enough for just about anyone to want to authenticate their contacts, but I'd like to see more of this sort of UI experimentation: https://support.viber.com/customer/portal/articles/2017401-viber-security-faq https://support.viber.com/customer/portal/articles/2017401-v...
    - sievebrain 10y ago
      He has said before that key changes in the wild are an extremely common event. I imagine even just the notification that chats are now encrypted caused a lot of confusion and upset given the enormous size of the userbase. Spamming users with warnings that 99.9999% of the time will not be understandable let alone actionable is a quick way to get another SSL warning dialog scenario.
      - feld 10y ago

dang 10y ago

Ok, we changed the title in an attempt to make it less misleading. If anybody suggests a better (more accurate and neutral) title, we can change it again.

maesho 10y ago

And that is why Telgram offers two factor authentication. https://twitter.com/durov/status/726104566899609600 https://twitter.com/durov/status/726104566899609600

wglb 10y ago
How does two factor authentication address they don't use end to end encryption, and instead store the entire plaintext history of every message you've ever sent or received?

Fry-kun 10y ago

So many people confuse encryption with authentication... Suppose you're a whistleblower trying to contact a reporter using WhatsApp. You've never met in person, so you send a message over WhatsApp, "Hello!" The reporter replies, "Hi!" You now have a big problem -- you don't KNOW that it was the reporter who replied to you, it might've been a nefarious 3rd party who already intercepted your original message and is now replying. WhatsApp's only mechanism for checking if that's the case is comparing some numbers out-of-band (e.g. in person, with QR codes). What's even more tragic is that WhatsApp doesn't track/show which contacts you may have already authenticated.. good luck remembering which of your 100 contacts are verified

Royalaid 10y ago
Just curious, how would you solve the authentication problem? I worked on a semester long project building decentralized chat and found this as well as bootstrapping to a node that you could trust be some of that hardest problems to solve because it always boiled down to just trust.
- sigmar 10y ago
  I'd offer up keybase.io as a workable way to solve this authentication problem. On keybase I can authenticate my identify by leveraging social media and public identify proofs across multiple services.
- ashitlerferad 10y ago
  There are several ways: Central authorities: SSL, DNSSEC TOFU: SSH, OTR etc Web of trust: OpenPGP Not sure, but I think Signal/WhatsApp a combination of central authority, TOFU and in-person 2 party verification, but no web of trust.
- baby 10y ago
  As he said, first you should encourage your users to authenticate one others by out-of-bands means. Then display who you truly authenticated. This can be gamified to encourage users doing it. Now to authenticate a user out of band you can just have a shared secret that both users need to enter. You can share that secret via another channel in hope that it is not man-in-the-middled (or at least not by the same attacker). But then it is close to a trust on first use (TOFU) security: often "good enough", sometimes not (SMS). Now if you're looking for cool ways to force the user to do it IRL, there are things like Bluetooth and NFC that would help. There are also easier ways to do that, as ashitlerferad says, that we use for larger problems like mail and www: web of trust (WOT) and public key infrastructure (PKI).

snowpanda 10y ago

>This kind of attack is devastating for Telegram Security flaws are found with any software on a regular basis. To say that it will 'devastate' a project is completely blown out of proportion. The first TrueCrypt had a lot of flaws and it still were to become the most popular encryption software. The whole point of updates is that something can be improved when flaws are found. >For WhatsApp, everything is end to end encrypted by default, so the attacker doesn't get any message history. All of the contacts for the MITM'd user also get a notice that their contact's security code changed, and a comparison will fail to match. This is exactly what E2E was built to protect against. All of this 'safety' is rendered false hope when we can't conclude that WhatsApp isn't backdoored. Trusting a closed source project by Facebook is completely nonsensical imo.

nebulous1 10y ago

Actually the changed identity notification in WhatsApp is turned off by default, so make sure you turn it on.