13 ms·

The key part is this, and it was apparently reported back in April 2016 with Facebook replying it's "expected behavior", it's not something a general attacker c

The key part is this, and it was apparently reported back in April 2016 with Facebook replying it's "expected behavior", it's not something a general attacker can do but it would enable WhatsApp/Facebook to read conversations: > WhatsApp has the ability to force the generation of new encryption keys for offline users, unbeknown to the sender and recipient of the messages, and to make the sender re-encrypt messages with new keys and send them again for any messages that have not been marked as delivered. It's worth noting as the article says, that this is built on top of the Signal protocol. In Signal, a similar situation with a user changing key offline will result in failure of delivery. Within WhatsApp under Settings>Account>Security there is an option to Show Security Notifications which will notify you if a users key has changed.

joelhaasnoot 10y ago
According to the article however, the notification is given after the messages are resent. There is nothing the user can seemingly do to prevent retransmission on a forced key change. This prevents further information from being sent, but in case of undelivered messages, they could be snooped on.
- zymhan 10y ago
  Sure, this could certainly leak some information, but it's hard to argue that this is a "backdoor".
  - wlll 10y ago
    A way of exploiting it is talked about in the article which would effectively allow Facebook/Whatsapp, or whoever is coercing them, to read all messages sent by a particular device.
  - dromen 10y ago
    It makes WhatsApp effectively not E2E encrypted. All messages can be recovered by Facebook. How is that NOT a backdoor?
    - Johnny_Brahms 10y ago
      All messages, sent while a person is offline. It is bad, but not nearly as bad as "all messages"
      - foxylion 10y ago
        It is in fact all messages. They can simply not deliver the first message and force a resend record that mesaage. Afterwards force again a resend with the old encryption key and deliver that mesaage. No one would get a notification.
        morsch 10y ago
        I can see how you would leave the receiver in the dark by sending them the original, deferred message, but how would asking the sender's device to resend with a different key not result in a notification? Furthermore, as soon as the sender attempts to deliver another message to the recipient, they would get another notification (because the encryption key changed back to the real key); alternatively the attacker could continue blocking (and reading) messages to the recipient, but the lack of delivery would be noticeable. You could escalate it into a MITM rather easily, though, by attacking both ends; but again, a key change notification should be displayed to both parties. Assuming the closed sourced app works as advertised, obviously.
        foxylion 10y ago
        Yes, you are right. But I think most people did not enable the security option so they wouldn't detect any interception of messages.
        Johnny_Brahms 10y ago
        Well, what you are describing is a regular MITM attack. Unless you validate fingerprints, this is a risk with _all_ public key-based protocols.
      - adsche 10y ago
        Can't they (WhatsApp) simulate a user being offline?
mattcoles 10y ago
I don't think this is as serious as it seems, this exploit only applies to undelivered messages, which granted is not great, but is at least something. And any WhatsApp update could potentially include code to snoop on decrypted messages so exploits that can only be performed from the WhatsApp server side - i.e the example in the article about snooping entire conversations - are not really that relevant. Having said that, it's disappointing and they should adopt Signal's approach.
- bluesign 10y ago
  I suspect that, i think server has ability to request any individual message to be transmitted with new key.
  - mattcoles 10y ago
    As I mentioned in my comment, any exploit that can only be performed by the server is essentially irrelevant as we already can't have perfect trust in the server. edit: I'll respond to everyone as I worded this poorly. What I mean is that an attack that can only be performed by Facebook/WhatsApp(depending on if you believe they are kept separate) is mostly irrelevant as they could always push an update to the App/Play Store that sent all the decrypted messages to their servers anyway and we'd be none the wiser as it's all closed source. So why would they choose to use the vulnerability when this is fair simpler and could access far more messages with the update? I'll concede that it's worrying if their server somehow became compromised but I'm seeing that as being highly unlikely.
    - wirelessest 10y ago
      I thought that was the whole point of end-to-end. That you don't need trust in the server because the messages are opaque. If this is an exploit that can be performed by a compromised server, it's very much relevant
      - FabHK 10y ago
        So, just to clarify my understanding: Basically, what we have here is a weakness in the client, namely a provision that allows the server to send the client a fresh key and ask for re-encryption and re-sending with the new key. This, in turn, would allow for a good old MITM attack if the server were to be compromised. This re-encryption and re-sending of messages would be without intervention by the user, though a message "new key" would be displayed to the user provided they had chosen the option to display such notifications (which are disabled by default). What's unclear to me is whether only messages that have not yet been delivered would be affected, or all.
samsonradu 10y ago
I happened to have the Security Notifications on for a while now. I see the message: "X's security code has changed." pretty often. Under what circumstances does a new pair of encryption keys get generated?
- dmichulke 10y ago
  Maybe the very fact that you want to be notified of key change events got you marked as suspicious ;-)
- yomly 10y ago
  I think when people swap sims in their device it triggers a key change
- joopxiv 10y ago
  One circumstance is when you put your sim card in a different phone. The new phone recognises that you already have a WhatsApp account, as it's tied to your phone number, but it doesn't have your private key, so it will generate a new pair and start exchanging the public part.
- anotherboffin 10y ago
  A new pair of keys are also generated when a device is wiped and restored from backup (in my experience on iOS).
jish 10y ago
> "it's not something a general attacker can do but it would enable WhatsApp/Facebook to read conversations" So it downgrades "end-to-end encryption" to "transport layer security".

joelhaasnoot 10y ago

According to the article however, the notification is given after the messages are resent. There is nothing the user can seemingly do to prevent retransmission on a forced key change. This prevents further information from being sent, but in case of undelivered messages, they could be snooped on.

zymhan 10y ago
Sure, this could certainly leak some information, but it's hard to argue that this is a "backdoor".
- wlll 10y ago
  A way of exploiting it is talked about in the article which would effectively allow Facebook/Whatsapp, or whoever is coercing them, to read all messages sent by a particular device.
- dromen 10y ago
  It makes WhatsApp effectively not E2E encrypted. All messages can be recovered by Facebook. How is that NOT a backdoor?
  - Johnny_Brahms 10y ago
    All messages, sent while a person is offline. It is bad, but not nearly as bad as "all messages"
    - foxylion 10y ago
      It is in fact all messages. They can simply not deliver the first message and force a resend record that mesaage. Afterwards force again a resend with the old encryption key and deliver that mesaage. No one would get a notification.
      - morsch 10y ago
        I can see how you would leave the receiver in the dark by sending them the original, deferred message, but how would asking the sender's device to resend with a different key not result in a notification? Furthermore, as soon as the sender attempts to deliver another message to the recipient, they would get another notification (because the encryption key changed back to the real key); alternatively the attacker could continue blocking (and reading) messages to the recipient, but the lack of delivery would be noticeable. You could escalate it into a MITM rather easily, though, by attacking both ends; but again, a key change notification should be displayed to both parties. Assuming the closed sourced app works as advertised, obviously.
        foxylion 10y ago
        Yes, you are right. But I think most people did not enable the security option so they wouldn't detect any interception of messages.
      - Johnny_Brahms 10y ago
        Well, what you are describing is a regular MITM attack. Unless you validate fingerprints, this is a risk with _all_ public key-based protocols.
    - adsche 10y ago
      Can't they (WhatsApp) simulate a user being offline?

mattcoles 10y ago

I don't think this is as serious as it seems, this exploit only applies to undelivered messages, which granted is not great, but is at least something. And any WhatsApp update could potentially include code to snoop on decrypted messages so exploits that can only be performed from the WhatsApp server side - i.e the example in the article about snooping entire conversations - are not really that relevant. Having said that, it's disappointing and they should adopt Signal's approach.

bluesign 10y ago
I suspect that, i think server has ability to request any individual message to be transmitted with new key.
- mattcoles 10y ago
  As I mentioned in my comment, any exploit that can only be performed by the server is essentially irrelevant as we already can't have perfect trust in the server. edit: I'll respond to everyone as I worded this poorly. What I mean is that an attack that can only be performed by Facebook/WhatsApp(depending on if you believe they are kept separate) is mostly irrelevant as they could always push an update to the App/Play Store that sent all the decrypted messages to their servers anyway and we'd be none the wiser as it's all closed source. So why would they choose to use the vulnerability when this is fair simpler and could access far more messages with the update? I'll concede that it's worrying if their server somehow became compromised but I'm seeing that as being highly unlikely.
  - wirelessest 10y ago
    I thought that was the whole point of end-to-end. That you don't need trust in the server because the messages are opaque. If this is an exploit that can be performed by a compromised server, it's very much relevant
    - FabHK 10y ago
      So, just to clarify my understanding: Basically, what we have here is a weakness in the client, namely a provision that allows the server to send the client a fresh key and ask for re-encryption and re-sending with the new key. This, in turn, would allow for a good old MITM attack if the server were to be compromised. This re-encryption and re-sending of messages would be without intervention by the user, though a message "new key" would be displayed to the user provided they had chosen the option to display such notifications (which are disabled by default). What's unclear to me is whether only messages that have not yet been delivered would be affected, or all.

samsonradu 10y ago

I happened to have the Security Notifications on for a while now. I see the message: "X's security code has changed." pretty often. Under what circumstances does a new pair of encryption keys get generated?

dmichulke 10y ago
Maybe the very fact that you want to be notified of key change events got you marked as suspicious ;-)
yomly 10y ago
I think when people swap sims in their device it triggers a key change
joopxiv 10y ago
One circumstance is when you put your sim card in a different phone. The new phone recognises that you already have a WhatsApp account, as it's tied to your phone number, but it doesn't have your private key, so it will generate a new pair and start exchanging the public part.
anotherboffin 10y ago
A new pair of keys are also generated when a device is wiped and restored from backup (in my experience on iOS).

jish 10y ago

> "it's not something a general attacker can do but it would enable WhatsApp/Facebook to read conversations" So it downgrades "end-to-end encryption" to "transport layer security".