5 ms·

From the outset I've always expected that a backdoor was present in Whatsapp. In fact, I'd be surprised if they hadn't granted themselves some special capabilit

From the outset I've always expected that a backdoor was present in Whatsapp. In fact, I'd be surprised if they hadn't granted themselves some special capabilities with regards to the content of the communications. Touting their end-to-end encryption has enticed many people to trust the product, sometimes with strong conviction, while giving themselves a monopoly on access to communication perceived as secure by the end users. It stands to reason that claims about security and privacy of an end product (the Whatsapp app), no matter how lofty the goals that its creator (especially a murky company like Facebook) has purportedly set out to realize, can be verified without being completely open. There is software out there like OpenSSL that is developed by PhD's, and is completely open and available to anyone who wishes to validate its security, yet vulnerabilities are found years after they've been introduced into the code. Claims to Whatsapp's security/privacy are preposterous a priori.

d33 10y ago
The fact that you have a PhD in cryptography doesn't necessarily mean you know how to write secure code. Especially C code. Lot of people hated OpenSSL quality long before Heartbleed, but it took that vuln for people to actually realize how bad it is. I can imagine a good, secure SSL library being written by somebody without a PhD, in a safer language.
- hellofunk 10y ago
  > Especially C code Isn't WhatsApp an Erlang app?
  - tim333 10y ago
    WhatsApp uses Erlang and various other languages. I doubt the encryption code is in Erlang. Erlang can call C code.
  - pgt 10y ago
    The socket layer at OS-level is written in C and Erlang probably uses an SSL library written in C. Turtles all the way down!
  - rakoo 10y ago
    Whatsapp is both a server and a client. The server might be written in Erlang, but the client (where all the end-to-end encryption happens) is written in whatever the device can run.
    - fnj 10y ago
      The device runs machine code. Client code can be written in any language which can be either compiled or interpreted to machine code.
      - SAI_Peregrinus 10y ago
        Android devices run Java, with an option for machine code for some functionality.
- sverige 10y ago
  I'm not sure that security is fully correlated with the degrees held by developers. It seems to have more to do with their motives. WhatsApp is owned by Facebook, which is wholly motivated by profit and the aggrandizement of Zuckerberg, not by providing secure code. What's most interesting to me is that for all the people who complain that C is insecure, I don't see any great, proven open source crypto implementations written in the "secure" languages. As an aside to your aside, LibreSSL is certainly more secure than OpenSSL, and it is written in C. Theo de Raadt doesn't have a PhD (though obviously he's not the only one hacking on LibreSSL).
  - weavie 10y ago
    There are plenty of crypto implementations out there. What do you mean by proven?
qznc 10y ago
There is no technical way to defend against the app itself (so WhatsApp/Facebook) and the operating system (Android/Google, iOS/Apple, etc). Transitively, this means no real defense against the US government when they can invoke the "national security" card. Also, hardware and manufacturer cannot be defended against with software-only. This means Intel, Qualcomm, FoxConn, etc. Transitively, the Chinese Government. I see no other possibility but trust them or don't use them. (There is a technical way to fight the OS, but it is not mature/available yet. See Intel SGX.)
- jMyles 10y ago
  What you've said here, whether true or not, is a much more general notion than the linked topic, which is a specific, documented vulnerability in an app popular largely because it is ostensibly secure.
patrickk 10y ago
> In fact, I'd be surprised if they hadn't granted themselves some special capabilities with regards to the content of the communications. Touting their end-to-end encryption has enticed many people to trust the product, sometimes with strong conviction, while giving themselves a monopoly on access to communication perceived as secure by the end users. It reminds me of this PR puff piece[1] by Google, banging on about how secure their data centre was, the limited access by employees, the amazing information security team, the underfloor lasers to detect intruders, etc. while totally ignoring the elephant in the room, i.e. NSA backdoors which Google is forced to comply with and can't reveal publicly when they do so. [1]https://www.youtube.com/watch?v=XZmGGAbHqa0 https://www.youtube.com/watch?v=XZmGGAbHqa0
DavideNL 10y ago
> I've always expected that a backdoor was present in Whatsapp Yea, and this is exactly why i never understood why Whispersystems/Moxie cooperated with Whatsapp/Facebook: It gives people a false feeling of security (communicating via Whatsapp), and basically Whispersystems facilitated/made this possible. It was so obvious...

d33 10y ago

The fact that you have a PhD in cryptography doesn't necessarily mean you know how to write secure code. Especially C code. Lot of people hated OpenSSL quality long before Heartbleed, but it took that vuln for people to actually realize how bad it is. I can imagine a good, secure SSL library being written by somebody without a PhD, in a safer language.

hellofunk 10y ago
> Especially C code Isn't WhatsApp an Erlang app?
- tim333 10y ago
  WhatsApp uses Erlang and various other languages. I doubt the encryption code is in Erlang. Erlang can call C code.
- pgt 10y ago
  The socket layer at OS-level is written in C and Erlang probably uses an SSL library written in C. Turtles all the way down!
- rakoo 10y ago
  Whatsapp is both a server and a client. The server might be written in Erlang, but the client (where all the end-to-end encryption happens) is written in whatever the device can run.
  - fnj 10y ago
    The device runs machine code. Client code can be written in any language which can be either compiled or interpreted to machine code.
    - SAI_Peregrinus 10y ago
      Android devices run Java, with an option for machine code for some functionality.
sverige 10y ago
I'm not sure that security is fully correlated with the degrees held by developers. It seems to have more to do with their motives. WhatsApp is owned by Facebook, which is wholly motivated by profit and the aggrandizement of Zuckerberg, not by providing secure code. What's most interesting to me is that for all the people who complain that C is insecure, I don't see any great, proven open source crypto implementations written in the "secure" languages. As an aside to your aside, LibreSSL is certainly more secure than OpenSSL, and it is written in C. Theo de Raadt doesn't have a PhD (though obviously he's not the only one hacking on LibreSSL).
- weavie 10y ago
  There are plenty of crypto implementations out there. What do you mean by proven?

qznc 10y ago

There is no technical way to defend against the app itself (so WhatsApp/Facebook) and the operating system (Android/Google, iOS/Apple, etc). Transitively, this means no real defense against the US government when they can invoke the "national security" card. Also, hardware and manufacturer cannot be defended against with software-only. This means Intel, Qualcomm, FoxConn, etc. Transitively, the Chinese Government. I see no other possibility but trust them or don't use them. (There is a technical way to fight the OS, but it is not mature/available yet. See Intel SGX.)

jMyles 10y ago
What you've said here, whether true or not, is a much more general notion than the linked topic, which is a specific, documented vulnerability in an app popular largely because it is ostensibly secure.

patrickk 10y ago

> In fact, I'd be surprised if they hadn't granted themselves some special capabilities with regards to the content of the communications. Touting their end-to-end encryption has enticed many people to trust the product, sometimes with strong conviction, while giving themselves a monopoly on access to communication perceived as secure by the end users. It reminds me of this PR puff piece[1] by Google, banging on about how secure their data centre was, the limited access by employees, the amazing information security team, the underfloor lasers to detect intruders, etc. while totally ignoring the elephant in the room, i.e. NSA backdoors which Google is forced to comply with and can't reveal publicly when they do so. [1]https://www.youtube.com/watch?v=XZmGGAbHqa0 https://www.youtube.com/watch?v=XZmGGAbHqa0

DavideNL 10y ago

> I've always expected that a backdoor was present in Whatsapp Yea, and this is exactly why i never understood why Whispersystems/Moxie cooperated with Whatsapp/Facebook: It gives people a false feeling of security (communicating via Whatsapp), and basically Whispersystems facilitated/made this possible. It was so obvious...