6 ms·

No matter what IM service you use: As long as they manage the public keys for their users, they will be vulnerable to exactly this problem. This isn't just What

by pilif 10y ago

No matter what IM service you use: As long as they manage the public keys for their users, they will be vulnerable to exactly this problem. This isn't just WhatsApp. This applies to iMessage and Signal too. In all cases, we rely on the word of the service provider that they don't sneak additional public keys to encrypt for into the clients and in all cases we hear that doing so would cause a message dialog to appear, but we have zero control over that as this is just an additional software functionality (yes. Signal is Open Source, but do you know whether the software you got from the App Store is the software that's on Github?) Also imagine the confusion and warning-blindness it would cause if every time one of my friends gets a new device I'd get huge warnings telling me that public keys have changed. This is a hard problem to solve in a user-friendly way and none of the current IM providers really solve it. Maybe Threema does it best with their multiple levels of authenticity. As such I think it's unfair to just complain about WhatsApp here.

rocqua 10y ago
The solution to this is to have multiple independent clients all working with the same protocol. This way it doesn't matter if an IM service handles your public keys, cause if they send different ones, they can't prevent the client from notifying. They simply don't control the client. In general, it is the control of FB over the whatsapp client where the vulnerabilities lie.
whyever 10y ago
> do you know whether the software you got from the App Store is the software that's on Github? Yes: https://whispersystems.org/blog/reproducible-android/ https://whispersystems.org/blog/reproducible-android/
- pilif 10y ago
  ... minus the libraries in native code which also are considerably harder to reverse-engineer than the java parts. Also, unless you're suspicious and actually check, you could be served a special version by the App Store that was compiled only for you and contains the required add-a-key-but-dont-show-a-popup feature. I'm not saying that Signal and/or Google are shipping a backdoor. I'm saying that we have to trust them that they don't.
  - whyever 10y ago
    Of course, if the software or hardware on your phone is compromised, all is lost. This is not specific to Signal though. > I'm saying that we have to trust them that they don't. This applies to anything. It is not feasible to build and/or check all software and hardware by yourself.
agd 10y ago
'As such I think it's unfair to just complain about WhatsApp here.' I disagree. WhatsApp have a known vulnerability which they won't fix (indeed they deliberately added this vuln on top of the Signal protocol), and no denial that they have used this vulnerability in the past. They made a big PR song and dance about this feature only to backdoor it. That deserves criticism.
- lucb1e 10y ago
  Exactly -- plus, the "notify key changes" setting is off by default. When I was looking through WhatsApp on my girlfriend's phone (it's useful to know what popular applications look like to be able to help others, even if I don't use them myself) I was very surprised to learn it was off by default. That's the same as disabling certificate checking on https and hoping that the pubkey you got is valid. It took me a while to believe it was actually the default and she hadn't turned it off herself (probably by accident), but it seems to be true. I just can't imagine how people call Whatsapp encrypted when whatsapp can push a new key à la "here, go encrypt your messages to this pubkey please".
  - pilif 10y ago
    > plus, the "notify key changes" setting is off by default that's the thing: That setting is pure placebo security-theater. There's nothing to guarantee that this setting actually causes notification on all key changes, whether it's on or off. Knowing that we all have trouble trusting Facebook, we can assume that all this setting does is inform users when their counterpart has a new phone (which in itself is a very slight privacy issue. I might not want you to know that I have a new phone / reinstalled WhatsApp). It won't inform users when Facebook adds another public key for analytics and it also won't inform when the NSA adds a key through their special surveillance interface Facebook built for them. That's the issue with all IM services that manage public keys for their users and thus, my original point was that it's pointless to rage against WhatsApp alone. Worse: Let's say they change the default due to the present outrage: Then everybody will be pleased with them while the actual backdoor remains in place.
    - 10y ago
userbinator 10y ago
As long as they manage the public keys for their users, they will be vulnerable to exactly this problem. Indeed, the most secure way is to generate and confirm each other's keys physically. The thought occurred to me that those whom you'd want to truly communicate securely with are likely people you have met via other means already --- including in person --- and so you should already have an effectively independent channel to share keys. It seems like the level of trust you have with someone is proportional to the probability of that being true: if you've never actually met someone in person, how do you know they are who they say they are? In some sense, you could say that, how secure the communication with someone is, doesn't matter if you don't already have that relationship of trust established.
- thinkloop 10y ago
  What about political dissidents trying to organize some event in a group where different people are brought in by others in a web of trust.
  - nicois 10y ago
    If A and B have already mutually validated each others' keys, and B and C have, then B can act as an intermediary to relay the key fingerprints.
    - mattcoles 10y ago
      B is a key exchange here and you have to trust that B isn't lying about C's key when it tells A.
morsch 10y ago
I don't think people switch phones often enough for the warnings to be a nuisance or be ignored. I agree that a lot of people would be very confused when they see the error, though, and while it's easy enough to explain even in layman's terms, I don't think it would help. I think that's it's totally fair to complain about WhatsApp, since the issue mentioned is separate from the more general problem you describe; they could easily have done it the way Signal does, and I suspect they opted to do it the way the do it for the same reason they don't have the security notifications on -- they don't want to deal with the confusion.
- tripzilch 10y ago
  > I don't think people switch phones often enough for the warnings to be a nuisance or be ignored. apparently in some countries they do and that's a reason to compromise the rest of the world.. just summarising how bizarre this excuse really is. make it an opt-in setting, in some countries reliable connectivity in a situation of frequently changing devices (the more I think about it, the more contrived it sounds) might be more important than privacy, but in others it very much isn't and the consequences for failing privacy are much worse than missing a message between swapping of devices. that's not a tradeoff you should get to make for everyone. the error message itself (I have it on) is not at all obtrusive btw, it's a friendly yellow (like the old Google ads) small type, which a user will either ignore or get a vague sense of unease about not being secure (which is exactly correct), I don't see how this can be further confusing.
JustSomeNobody 10y ago
> As such I think it's unfair to just complain about WhatsApp here. I think it would be wrong to start complaining about other apps. We don't know of vulnerabilities in other apps. We DO know of one in WhatsApp. Let's focus on what we know and take WhatsApp to task on it instead of wasting energy on what we don't know.
ComodoHacker 10y ago
>As long as they manage the public keys for their users, they will be vulnerable On the other hand, as long as users are required to manage their public keys, there won't be end-to-end encryption for the masses (which WhatsApp had declared as their goal and to some degree achieved). At least until key management and other security basics will be taught at elementary school, by the time multiplication table is taught.
patrickk 10y ago
I'd be curious to hear HN's thoughts on what messaging apps they use/trust. I've tried in the past to get friends to switch over to Telegram, but there are issues since they rolled their own encyption protocol. I've looked into using Mumble for voice, it seems quite secure because you host it yourself, and it's open source. There's also a good list from the EFF: https://www.eff.org/node/82654 https://www.eff.org/node/82654
- deleted 10y ago
  [deleted]

by pilif 10y ago

rocqua 10y ago

The solution to this is to have multiple independent clients all working with the same protocol. This way it doesn't matter if an IM service handles your public keys, cause if they send different ones, they can't prevent the client from notifying. They simply don't control the client. In general, it is the control of FB over the whatsapp client where the vulnerabilities lie.

whyever 10y ago

> do you know whether the software you got from the App Store is the software that's on Github? Yes: https://whispersystems.org/blog/reproducible-android/ https://whispersystems.org/blog/reproducible-android/

pilif 10y ago
... minus the libraries in native code which also are considerably harder to reverse-engineer than the java parts. Also, unless you're suspicious and actually check, you could be served a special version by the App Store that was compiled only for you and contains the required add-a-key-but-dont-show-a-popup feature. I'm not saying that Signal and/or Google are shipping a backdoor. I'm saying that we have to trust them that they don't.
- whyever 10y ago
  Of course, if the software or hardware on your phone is compromised, all is lost. This is not specific to Signal though. > I'm saying that we have to trust them that they don't. This applies to anything. It is not feasible to build and/or check all software and hardware by yourself.

agd 10y ago

'As such I think it's unfair to just complain about WhatsApp here.' I disagree. WhatsApp have a known vulnerability which they won't fix (indeed they deliberately added this vuln on top of the Signal protocol), and no denial that they have used this vulnerability in the past. They made a big PR song and dance about this feature only to backdoor it. That deserves criticism.

lucb1e 10y ago
Exactly -- plus, the "notify key changes" setting is off by default. When I was looking through WhatsApp on my girlfriend's phone (it's useful to know what popular applications look like to be able to help others, even if I don't use them myself) I was very surprised to learn it was off by default. That's the same as disabling certificate checking on https and hoping that the pubkey you got is valid. It took me a while to believe it was actually the default and she hadn't turned it off herself (probably by accident), but it seems to be true. I just can't imagine how people call Whatsapp encrypted when whatsapp can push a new key à la "here, go encrypt your messages to this pubkey please".
- pilif 10y ago
  > plus, the "notify key changes" setting is off by default that's the thing: That setting is pure placebo security-theater. There's nothing to guarantee that this setting actually causes notification on all key changes, whether it's on or off. Knowing that we all have trouble trusting Facebook, we can assume that all this setting does is inform users when their counterpart has a new phone (which in itself is a very slight privacy issue. I might not want you to know that I have a new phone / reinstalled WhatsApp). It won't inform users when Facebook adds another public key for analytics and it also won't inform when the NSA adds a key through their special surveillance interface Facebook built for them. That's the issue with all IM services that manage public keys for their users and thus, my original point was that it's pointless to rage against WhatsApp alone. Worse: Let's say they change the default due to the present outrage: Then everybody will be pleased with them while the actual backdoor remains in place.
  - 10y ago

userbinator 10y ago

As long as they manage the public keys for their users, they will be vulnerable to exactly this problem. Indeed, the most secure way is to generate and confirm each other's keys physically. The thought occurred to me that those whom you'd want to truly communicate securely with are likely people you have met via other means already --- including in person --- and so you should already have an effectively independent channel to share keys. It seems like the level of trust you have with someone is proportional to the probability of that being true: if you've never actually met someone in person, how do you know they are who they say they are? In some sense, you could say that, how secure the communication with someone is, doesn't matter if you don't already have that relationship of trust established.

thinkloop 10y ago
What about political dissidents trying to organize some event in a group where different people are brought in by others in a web of trust.
- nicois 10y ago
  If A and B have already mutually validated each others' keys, and B and C have, then B can act as an intermediary to relay the key fingerprints.
  - mattcoles 10y ago
    B is a key exchange here and you have to trust that B isn't lying about C's key when it tells A.

morsch 10y ago

I don't think people switch phones often enough for the warnings to be a nuisance or be ignored. I agree that a lot of people would be very confused when they see the error, though, and while it's easy enough to explain even in layman's terms, I don't think it would help. I think that's it's totally fair to complain about WhatsApp, since the issue mentioned is separate from the more general problem you describe; they could easily have done it the way Signal does, and I suspect they opted to do it the way the do it for the same reason they don't have the security notifications on -- they don't want to deal with the confusion.

tripzilch 10y ago
> I don't think people switch phones often enough for the warnings to be a nuisance or be ignored. apparently in some countries they do and that's a reason to compromise the rest of the world.. just summarising how bizarre this excuse really is. make it an opt-in setting, in some countries reliable connectivity in a situation of frequently changing devices (the more I think about it, the more contrived it sounds) might be more important than privacy, but in others it very much isn't and the consequences for failing privacy are much worse than missing a message between swapping of devices. that's not a tradeoff you should get to make for everyone. the error message itself (I have it on) is not at all obtrusive btw, it's a friendly yellow (like the old Google ads) small type, which a user will either ignore or get a vague sense of unease about not being secure (which is exactly correct), I don't see how this can be further confusing.

JustSomeNobody 10y ago

> As such I think it's unfair to just complain about WhatsApp here. I think it would be wrong to start complaining about other apps. We don't know of vulnerabilities in other apps. We DO know of one in WhatsApp. Let's focus on what we know and take WhatsApp to task on it instead of wasting energy on what we don't know.

ComodoHacker 10y ago

>As long as they manage the public keys for their users, they will be vulnerable On the other hand, as long as users are required to manage their public keys, there won't be end-to-end encryption for the masses (which WhatsApp had declared as their goal and to some degree achieved). At least until key management and other security basics will be taught at elementary school, by the time multiplication table is taught.

patrickk 10y ago

I'd be curious to hear HN's thoughts on what messaging apps they use/trust. I've tried in the past to get friends to switch over to Telegram, but there are issues since they rolled their own encyption protocol. I've looked into using Mumble for voice, it seems quite secure because you host it yourself, and it's open source. There's also a good list from the EFF: https://www.eff.org/node/82654 https://www.eff.org/node/82654

deleted 10y ago
[deleted]