57 ms·

There is no WhatsApp 'backdoor'

1018 points by stablemap 10y ago

deleted 10y ago
[deleted]
hackcasual 10y ago
tl;dr to me seems: Since users can change devices, they'll need to reissue key material, this needs to be supported. WhatsApp reports key changing optionally, but doesn't tell the server that happened. If WhatsApp tries to backdoor a channel and one of the users has key change notification, they'll find out about it, and WhatsApp has no idea whether the warning was shown.
- int_19h 10y ago
  If I understand correctly, the default is no key change notification. So for the majority of users, MITM would go unnoticed here.
  - Deregibus 10y ago
    I believe that you get a key change notification, but by default it doesn't require any sort of confirmation and will just continue to work with the new key.
    - FabHK 10y ago
      GP is correct: no notification of key changes by default. Even if you enable the key change notification, it is "non-blocking" in WhatsApp as outlined by the blog post: when you get the key change notification, the WhatsApp client will automatically without user intervention resend undelivered messages (unlike Signal, btw, from what I understand).
- jMyles 10y ago
  > If WhatsApp tries to backdoor a channel and one of the users has key change notification, they'll find out about it The problem is that the might not find about out retransmissions. You are trusting that the "double-tick" means that the message won't be resent, but presumably WhatsApp can indeed retransmit those messages with the new key under pressure from a state actor. They need to specifically address this point; it's the only thing worth talking about. The rest is just a discussion of implementation of key exchanges generally.
  - Deregibus 10y ago
    That would require the client to be compromised though right? My understanding is that the client is making the decision whether to retransmit with the new key. Now it's fair to question whether you can trust the client, but if you can't then there's no limit to what they could do.
- willvarfar 10y ago
  Additionally, the WhatsApp notification is after the message is resent.
- deleted 10y ago
  [deleted]
- dsp1234 10y ago
  FTA: "WhatsApp server has no knowledge of whether users have enabled the change notifications, or whether users have verified safety numbers." If it's off by default, then the answer is likely to be near zero, as it often is with default options. This isn't an argument about the security of the app (which I have no background to know), more of a comment on relying on non-default behavior.
deleted 10y ago
[deleted]
jMyles 10y ago
Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which users might not notice. Using the retransmission vulnerability, the WhatsApp server can then later get a transcript of the whole conversation, not just a single message.”
- maxerickson 10y ago
  Unconvinced of what exactly?
  - tedunangst 10y ago
    I remain unconvinced that people who build messaging apps used by billions of people know more about the problem space than I do.
    - dmix 10y ago
      This may be in need of a /s.
- tucif 10y ago
  He does address this: Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. That means a user is able to verify visually that the end-to-end is working. "users might not notice" doesn't seem to me as a strong argument to state this as a backdoor. This would imply not noticing that you don't have a green padlock on chrome is a backdoor too, and it clearly is not.
  - MichaelGG 10y ago
    Couldn't the server change keys after every message? The delay would be fairly small. Hold the original, change key, retransmit, change key back? Guess that is easily enough mitigated if the client won't allow switching back to the same key.
throw7 10y ago
What is the user supposed to do when they get notified of a "safety number changed" message? How do they verify they've not just been MITM? Honest question... I don't use whatsapp or signal at all.
- sloanesturz 10y ago
  You have to physically compare the numbers on the two phones (in real life), or send the numbers through a different trusted channel (PGP, USPS, Carrier Pigeon, etc).
- ivanhoe 10y ago
  It's up to you to confirm what's going on using another channel (say call them on phone and see what's going on, compare the numbers). It's the same thing ssh does when server keys change for instance. To me it's a reasonable way to handle such situation.
- jlgaddis 10y ago
  (Re-)verify the safety number out-of-band, like you hopefully did initially.
- Freestyler_3 10y ago
  You can aks the other party to resend you a message from before (one that doesn't matter). Ie. Can you confirm this is you: send me a message from 5 messages back using the quote function. (you know what is said 5 mssgs back so you can pick a non sensitive one, and they can do the same to you) edit: nvm, if this is man in the middle then that doesn't matter because you still exchange with each other and its not a hijack. Sorry, I made a mistake.
- subliminalpanda 10y ago
  I would simply ask if they got a new phone or re-installed WhatsApp. A few would inquisitively ask "Yes, how did you know?", then I would explain them to them the notification I got.
  - pbalau 10y ago
tyrust 10y ago
>The WhatsApp clients have been carefully designed so that they will not re-encrypt messages that have already been delivered. Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. This prevents anyone who compromises the server from being able to selectively target previously delivered messages for re-encryption. Can this be verified? Can this be verified to be the case 100% of the time? Is there anything stopping the client from lying to a user [0] with this interface, saying one thing (i.e. "this will not be resent") and doing another (i.e. resending)? [0] - Or being triggered to lie to a particular user at a particular time.
- UncleMeat 10y ago
  If your threat model includes using a malicious app to send messages then you lose anyway. Nothing can ever be done to send messages securely using whatsapp if the client is neither trusted nor verified. This is true for basically all software that you use.
  - hackuser 10y ago
    Open source software can be verified.
    - enduser 10y ago
      Source code can be verified. Binaries distributed via app stores may or may not have behavior different from the published code.
      - jMyles 10y ago
        Certainly it's possible to remedy this situation simply by having the app author sign a checksum of binaries in the app store. Why this is not currently an option (to my knowledge) is a mystery to me.
        obscene 10y ago
ycmbntrthrwaway 10y ago
> That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully. I am not convinced. Why should this option exist at all? Even worse, it is disabled by default. Just enable notifications for everyone and demand verification. If you don't want to verify, just ticking "veryfied" without actual verification is not that bad, it is just a trust-on-first-use principle in action. Actually it is how SSH works and nobody complains about SSH being backdoored.
- UncleMeat 10y ago
  WhatsApp has a gazillion+ users, most of whom don't care about e2e security and definitely don't care enough to verify keys before they are allowed to chat with their friends again. The friction caused by a security popup that 90% of users simply ignore is real. It annoys users and causes fatigue that jeopardizes future security notifications.
- cypherpunks01 10y ago
  If we're talking about key change notifications, isn't SSH the thing that throws the following error when a key changes? @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is 51:82:00:1c:7e:6f:ac:ac:de:f1:53:08:1c:7d:55:68. Please contact your system administrator. Add correct host key in /Users/user/.ssh/known_hosts to get rid of this message. Offending RSA key in /Users/user/.ssh/known_hosts:12 RSA host key for 8.8.8.8 has changed and you have requested strict checking. Host key verification failed.
  - jlgaddis 10y ago
    FYI: indent those lines a few spaces for proper formatting.
pasta 10y ago
Maybe I don't get exactly what this means, but isn't it true that if see a message that someone's signature changed and the other person sees this also and we both choose to ignore this message the man in the middle can read all our new conversations? Ofcourse if then one of us checks the signature later and sees it is not correct this would be very harmfull for whatsapp. But this indeed doesn't sound like a backdoor. It's just the way it works. Which seems good enough.
kingnight 10y ago
This main flagrant or off-topic, but something that nags at me when thinking about truly secure messaging apps from the App Store: Even with perfect e2e encryption protocol added, what's preventing WhatsApp developers (FB) from adding in a feature of the app: if local.user is "TargetUser007" { takeDeviceSnap(); sendDeviceSnapshotToFBOverSameEncryption(); } Wouldn't this not be ever verifiable unless you ARE that specific user and it's too late?
- maxerickson 10y ago
  You'd also have to make sure they were the only user that received that binary. Otherwise you'd have to hope that no one reverse engineered the binary and noticed the oddly specific comparison there.
  - kingnight 10y ago
    Are reverse engineering techniques currently greater than known ability to obfuscate compiled iOS code?
    - dean177 10y ago
      Yes
    - deleted 10y ago
      [deleted]
    - MichaelGG 10y ago
      And it'd have to work for other platforms, too. Android is Java right? Which is even easier to RE.
      - besselheim 10y ago
        Android apps can also contain native code. Indeed, WhatsApp includes such libraries, to help with Curve25519 encryption, video encoding, voice over IP, and other functionality.
quickben 10y ago
I don't user whatsapp, but a general question to these that do: Can the server change keys twice? Change once to server keys, ask for the entire history retransmission. Change again to revert to original receipient keys. Will the receipient be prompted in that case?
- brainfire 10y ago
  "The WhatsApp clients have been carefully designed so that they will not re-encrypt messages that have already been delivered. Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. This prevents anyone who compromises the server from being able to selectively target previously delivered messages for re-encryption."
  - quickben 10y ago
    Ah, thanks
- matthewmacleod 10y ago
  Change once to server keys, ask for the entire history retransmission. No. the WhatsApp client will not retransmit messages that have already been acknowledged by the recipient device. Of course, you'll have to trust that this is the case; but obviously you'd have to trust the the WhatsApp client app isn't backdoored in the first place, so there is no change in security posture.
disiplus 10y ago
> The choice to make these notifications "blocking" would in some ways make things worse. That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully. could not this be saved only localy ?
- ekiru 10y ago
  If resending undelivered messages to new keys waited for confirmation of the new key when safety number change notifications are enabled, then users without those notifications enabled would continue to immediately resend undelivered messages to new keys while users with the notifications enabled would not resend until the user manually OKed the change. The WhatsApp servers know (or can know) whether users have outstanding undelivered messages and can observe whether users resend them immediately after a key change. As a result, if resends after key changes waited for user confirmation with security notifications enabled, whenever a user changed keys, WhatsApp would be able to tell whether any of their contacts who had undelivered messages to that user had the notifications enabled by observing whether those contacts immediately resent the messages or not.
  - disiplus 10y ago
    thats then a timing attack, but the client could replace the mesaage with a placeholder and send that immidietly, and the real message after the user approves. this way server could not know.
    - ekiru 10y ago
      I think that could mostly work. The placeholder message would have to be of identical length to the original and the resent message would have to use later sequence numbers/message ids (or whatever is used to identify individual messages) so the server couldn't tell that the placeholders were placeholders. One issue is that it would mean that, in the case of an active attack where the server substituted a key they knew in place of a legitimate new key from the user, the server would be able to decrypt the possibly-placeholder resent message and determine whether the user had notifications on. If the user didn't, they'd know that they were safe to continue to attack the user (this attack is more risky than the passive one on the blocking resend without placeholder messages protocol, of course). So, this does improve the security of the protocol for users with security notifications enabled, at the cost of making users without those notifications less safe. I'm not sure how the tradeoff should be balanced here (just as I'm unsure if the UX tradeoff of having the option of not receiving security notifications is worth it...).
sebleon 10y ago
At the end of the day, it comes down to trusting WhatsApp. Even without a backdoor in their protocol, they can easily do all kinds of things. For instance, it could instruct specific clients to encrypt and send each message twice: one for the recipient, and one for the WhatsApp server. As long as this was off for 99.9% of users, it's unlikely that security researchers would ever detect this.
- hawkice 10y ago
  I mean, they're probably disassembling the app, so they'd definitely notice _that_, but there are some truly subtle problems that pop up in security, so your general point about trust seems reasonable enough (certainly for any closed-source remote-updating system).
  - akvadrako 10y ago
    Also it would be possible to put in subtle backdoors, which would be hard to see when it's disassembled and could even allow plausible deniability.
- na85 10y ago
  Trusting WhatsApp == trusting Facebook I can't think of a company I trust less than Facebook.
  - imranq 10y ago
    What about...Walmart, Glencore, Phillip Morris, Blackwater, Palantir...
    - ljk 10y ago
      > Walmart I can use cash at Walmart
      - evgen 10y ago
        And be sure to smile at the cameras watching you in the store, and the ones in the parking lot that recorded you driving in.
stefantalpalaru 10y ago
So WhatsApp can be easily subjected to a man-in-the-middle attack because of some design decisions, but he doesn't want to call it a backdoor? I hope this will significantly reduce his fan base.
joeblau 10y ago
There seems to be a pretty clear war going on between engineers and journalists lately. - Chris Latter [1] vs Business Insider [2] - Elon Musk vs (Bunch of outlets) - Moxie vs The Guardian I feel like journalists want to write a compelling story and engineers are on the other side like "No, those aren't facts!" I don't follow a lot of media outlets but it seems like journalists either lack the skills or don't care about doing any technical due diligence. [1] - https://twitter.com/clattner_llvm/status/819974025371787264 https://twitter.com/clattner_llvm/status/819974025371787264 [2] - http://www.businessinsider.com/how-apples-culture-of-secrecy-wears-down-its-top-developers-2017-1 http://www.businessinsider.com/how-apples-culture-of-secrecy...
- hackuser 10y ago
  I don't know what happened here, but ... Let's avoid our own bias of automatically believing the engineers are in the right; they are fallible people, no more or less honest or prone to error than journalists. Every news story that breaks, involving any person or industry, gets the same response: It's false, they didn't ask us, etc. etc. Therefore, that response is not an indication that something is wrong (or right); the response tells us nothing in itself.
  - joeblau 10y ago
    You're right. Everyone is fallible and I'm all for mistakes being made — We are all human. I also agree that the immediate snap response tells us nothing. Based on the BI story, I know a few people that have actually already uninstalled WhatApp for fear of a backdoor. What I wish is that there was a better way for these two entities to communicate rather than finger pointing and name calling so that we as consumers of both media and technology can read a better more comprehensive narrative.
    - kordless 10y ago
      Name calling results in reassigning fear. People are afraid of the unknown and so try to box it up in something digestible they can fear less. We tend to blame others because it's easy and cheap to do so. If you are wrong, that means I'm right and so then I wasn't wrong about it and don't have to think about it anymore. And you are wrong, so why would I think about it again? I think it's interesting the entities are not two, but many and one at the same time. Elon Musk is an individual and he is also part of the press process. My rationale is that the press includes everyone in the press, including the people writing the stories and the people in the stories. We know Musk. He doesn't know us.
zspitzer 10y ago
What about https://web.whatsapp.com https://web.whatsapp.com? It grants full access to the entire message archive on your phone
- zaken 10y ago
  Only once you scan the barcode, which contains an encryption key to use for your phone to securely ship /its/ keys to the browser. Only encrypted messages are transmitted between phone and browser
LinuxFreedom 10y ago
We can learn one important thing here - it is not possible to trust closed source software. Enough said, next issue please.
- UncleMeat 10y ago
  It isn't possible, in most cases, to trust open source software either. Have you verified that the binaries on your phone were indeed built from the source you can read on github or wherever?
  - omginternets 10y ago
    Which fully open-source phone platform do you have in mind? I'm not aware of any. On desktop and servers, however, it certainly is possible (and not-too-impractical) to verify binary blobs against known PGP signatures. See Debian's reproducible builds, for instance.
- zorked 10y ago
  The problem is that we can't trust open source software either. Software being closed source doesn't make it impervious to analysis. Software being open source does not mean it has been analyzed.
  - CaptSpify 10y ago
    No, but you can do it any time you want. I don't ever want to change the tires on my car, but I think it's essential that I have the ability to change the tires on my car.
- FabHK 10y ago
  If your goal is to get the greatest number of people onto the greatest and most secure, private, free software, then pure ideology won't help. What do you think Iran/the NSA/any TLA is more upset about, WhatsApp using the Signal protocol, or Matrix and Riot?
carlos808 10y ago
The Guardian slipped up again, expect more BS from their incompetent journalists.
- hrxn 10y ago
  Yes, that is the story actually going on. Can't believe how many people fall for this BS, even on HN..
deleted 10y ago
[deleted]
psranga 10y ago
I take this blog post as confirmation that: 1) ANY one message can be intercepted even if the sender exhibits ideal levels of alertness [Whatsapp server drops message to recipient; sends a rekey request with a fake key; message is intercepted since fake key was generated by server. Sender will see a warning if they turned on that setting (default is to show no warning), but it's too late]. 2) Only Whatsapp has this vuln, not Signal app. 3) Depending on sloppiness of sender, more extensive interception is possible. [E.g., server not supplying delivery reports + sender doesn't have warning for key changes + sender sloppy about noticing lack of double check mark => full transcript can be generated]
- dangero 10y ago
  Best summary I've seen. There are two significant facts here that surprised me: 1. The double checkmark has security implications. How would a typical user know that? 2. Even if you are completely vigilant, follow best practices, etc, Whatsapp messages can be intercepted. They claim this is a "wontfix" UX choice. I'm skeptical why the non-default feature cannot even provide the protection that almost everyone assumed it would.
  - Vinnl 10y ago
    > How would a typical user know that? I think that's basically the main problem: there is no way to get a typical user to understand security implications of anything without having that user give up before reaching that point...
- artefacts 10y ago
  This. So much this. Let's consider three other facts: 1.) WhatsApp is owned by Facebook. This is a company that's has publicly said through a former, nepotistically appointed director that privacy needs to 'go away'. Their sole purpose is to extract as much PII from users as possible for resale. Offering a completely private messaging service doesn't seem to be in their financial interest. 2.) There is no way to independently verify anything being claimed by Moxie/Facebook. No WhatsApp specific source code - which is clearly different from Signal - why? Furthermore, no view into the infrastructure at Facebook. The latter is more reasonable, but seriously, why are we trusting a company whose CEO calls its users "Dumb fucks" for trusting it with their data? 3.) The Client is updated regularly through auto updates, so it seems possible that many of these notifications could simply be bypassed based on Moxie's own described MITM attack. Moxie, fuck your blog post. It has some decent points, but helping Facebook is probably the opposite of what decent privacy advocates should be doing. More likely you've helped them be more covert about doing evil shit than helping users. Hope you enjoyed the cheque though.
RatherFunky 10y ago
This is the source from Guradian paper, so you can test it for yourself. https://tobi.rocks/2016/04/whats-app-retransmission-vulnerability/ https://tobi.rocks/2016/04/whats-app-retransmission-vulnerab...
ljk 10y ago
seems like the original thread has fallen off the front page https://news.ycombinator.com/item?id=13389935 https://news.ycombinator.com/item?id=13389935
RatherFunky 10y ago
"We were previously aware of the issue and might change it in the future, but for now it's not something we're actively working on changing" - FB respond to Tobias Boelter in may 31,2016
lwyr 10y ago
Why is moxie doing PR for WhatsApp?
- seanieb 10y ago
  He consulted on and helped them implement their E2E encryption.
- mos_basik 10y ago
  >Even though we are the creators of the encryption protocol supposedly "backdoored" by WhatsApp, we were not asked for comment. It's only a small step from criticism of WhatsApp crypto to criticism of Signal crypto. Why wouldn't moxie be interested?
  - RatherFunky 10y ago
    because here it clearly says that signal had dealt with this problem https://tobi.rocks/2016/04/whats-app-retransmission-vulnerability/ https://tobi.rocks/2016/04/whats-app-retransmission-vulnerab... So it is solely whatsapp's fault
  - nullc 10y ago
    Especially when signal's interface has similar, if less severe, weaknesses.
- autocorr 10y ago
  WhatsApp uses the Signal Protocol, I'm not familiar with the details, but this post by OWS should[1]. [1] https://whispersystems.org/blog/whatsapp-complete/ https://whispersystems.org/blog/whatsapp-complete/
mhandley 10y ago
Moxie claimed: > "The choice to make these notifications "blocking" would in some ways make things worse. That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully." Surely if WhatsApp cared about the server not being able to detect this, they could just get the client to "retransmit" an encrypted blank message in place of the original under these circumstances. Then the server wouldn't be able to tell who has enabled blocking mode and who hasn't.
_jp__ 10y ago
Of course there is a backdoor. Why not? Under what law whatsapp and whispersystems live? The one with secret courts and secret court orders?. How to trust someone under this umbrella? We need to spread technology companies. Everything but a bunch of things comes from this law. And what starts in another country, magicaly gets bought or dismissed. Take Symbian as an example...
- RatherFunky 10y ago
  again ows has nothing to do with this. It is solely vulnerability of whatsapp
leecarraher 10y ago
thanks
agd 10y ago
'Given the size and scope of WhatsApp's user base, we feel that their choice to display a non-blocking notification is appropriate. It provides transparent and cryptographically guaranteed confidence in the privacy of a user's communication, along with a simple user experience. The choice to make these notifications "blocking" would in some ways make things worse. That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully.' Why not have every client show up as having safety number change notifications on and just choose whether to display them client side depending on user settings? i.e. if you have them off, no message will display and the message will automatically be resent using the new key?
- Ajedi32 10y ago
  Huh? Isn't that exactly how it is now?
  - agd 10y ago
    No, even if you have the notification turned on, the message is still resent without your consent.
- eridius 10y ago
  You quoted the answer to that already. If these change notices are "blocking", then the sending device won't re-send the message until the user has verified it. If the user hasn't enabled the notification, then the sending device will re-send immediately. This makes it trivial for the server to figure out who's actually enabled the notifications and who hasn't, which means the server can be confident about when it's actually safe to MITM.
  - agd 10y ago
    You could send a dummy message for those with blocking turned on and screen it out at the receiving client.
  - 10y ago
rebuilder 10y ago
So full-on paranoia mode on: What would you do if you wanted to compare safety numbers? I'm guessing most people would call and read out the code. How far are we from targeted interception of calls, with replacement of key phrases? Voice synthesis seems to be there more or less, if I understood Adobe's recent demo correctly, but real-time parsing of conversations to determine where to intervene is probably not close yet.
- makomk 10y ago
  This kind of phrase replacement in calls was on the NSA's priority list years ago, according to the Snowden leaks.
olegkikin 10y ago
It actually doesn't matter. They are talking about comprimising the servers. The government has the power to force a backdoor (remember Lavabit?). All Whatsapp has to do is update their client, and all the beautiful encryption schemes are ruined. If you need a truly secure communication system, it has to be open source and self-hosted. You still have to trust the hardware though.
- Grollicus 10y ago
  To expand on this argument a bit, if you think the Government/Whatsapp are specifically out to get you (eg. willing to mount an active attack against you specifically), then WhatsApp is propably the wrong messenger for you. If on the other hand you want a reasonably secure Messenger that you can use to chat privately with everybody and their Grandma then maybe you should not expect that it does super complex security thingys that 99% of its users just don't care about and don't want to be bothered with..
- hrxn 10y ago
  Lock yourself in the basement, throw away the keys. It's the only way to be safe. > You still have to trust the hardware though. Yes, exactly. And, realistically, how would this work? For a start, everyone running his own lil' chip foundry in the garden shed? This is all BS. Paranoid BS, and fake news Guardian is stoking the flames. Good job..
aaronbrager 10y ago
WhatsApp should make three hanged: 1. handle new keys the same way Chrome handles expired SSL certs: a big warning with the option to continue anyway if you want 2. Don't automatically resend a message with a new key (require the user to manually resend, like when iMessage falls back on MMS) 3. enable the key change notifications and make disabling them an "advanced" setting WhatsApp is making the right choice by designing for ease of use, I think they just landed a little too far away from a secure implementation.
baybal2 10y ago
They are trying to say that an intentionally placed backdoor is not a backdoor? ha ha
ucy 10y ago
The real "Whatsapp Backdoor" is that, by default, the app stores a backup of all your messages on "teh cloud". On android, that's google. So google can play "eve", and every run of the mill script kiddie that can get your google credentials may "restore" your messages. How convenient. And that's the default settings. So, even if you turn it off, "mallory" can steal the credentials of your contact and snoop into your conversation that way.
theveloped 10y ago
As with all end-to-end encryption it stops at the "end". It is this unencrypted state, in which humans consume data, that can't be defended by crypto. Therefore the only way to be completely safe, is to make sure both you and your conversation partner don't decrypt their message until it's on an offline device only you have access to. But end-to-end encryption where the interface (mobile app/phone) is controlled by the parties you want to protect your data from is not possible. WhatsApp could send freaking screenshots back of the unencrypted data if they wanted. For nearly all other threat models whatsApp's encryption is a wonderful add-on.
ryeguy_24 10y ago
Did Hacker News delete the original Guardian WhatsApp article post?
newsat13 10y ago
Yawn. Next what, whatsapp is not going to use monetizing to advertise? Why don't we just all admit that all our data is being plundered by corporations to make money and just leave it at that? Seriously, nobody cares about their data being used by corporations for profit. Just be honest about it.. and you will see that people continue to use whatsapp or signal or whatever the current fad is.
kentonv 10y ago
I love this post for the in-depth explanation of the UX challenges around e2e encryption and why they made the decisions they did. It's educational. I think Moxie highlights a very good point that is commonly underrated among "security Dunning-Krugers": Opening yourself to the possibility of an attack is often OK if the attack is easily detectable, and if the identity of the attacker would be obvious upon detection. Yes, Facebook could intercept and decrypt a message without your advance knowledge. However, you would be able to detect it after the fact. And if you detected an attack, the attacker could be no one other than Facebook. You could then expose them and ruin their reputation. Given this, it's unlikely that Facebook would risk carrying out such an attack in the first place. Security is not binary, it's risk management. The goal is to minimize the risk of an attack, not to rule it out entirely (hint: you can't). I think WhatsApp has made the right choices here.
- yellowapple 10y ago
  In most cases, I'd much rather disallow Facebook from MITMing my messages than try to "ruin their reputation" (hint: I won't, because Facebook already does far worse things on a regular basis without so much as an eye-bat from the world). In other words: I care about the confidentiality of my messages far more than the promise of some sort of dubious ability to shame Facebook for simply fulfilling its business model. Sure, there are some cases where allowing security to be exploited in one area protects the security of another, but those are called "honeypots", and I sure as hell hope my private communications are not a part of that. Transparency is a dependency of trust. WhatsApp is not transparent; therefore, it is not trustworthy. Simple as that.
  - artefacts 10y ago
    > Transparency is a dependency of trust. WhatsApp is not transparent; therefore, it is not trustworthy. Simple as that. +1. The CEO calls its users "Dumb Fucks"; the sister of the CEO, formerly a director of Facebook, claimed "Privacy needs to go away". There's no transparency with WhatsApp in terms of its implementation, so the fact that Moxie may have helped them get initially set up is moot. Moxie's reputation doesn't provide any provable assurances of confidentiality from Facebook.
RRRA 10y ago
Terrible UX combined with unsane default, at best...
_Codemonkeyism 10y ago
Call me paranoid, but the thing which is strange to me is that Whisper talks about this defending Facebook/WhatsApp. This makes me highly suspicion my usage of Signal :-(
- makomk 10y ago
  Facebook's payments to use the Signal protocol pay the bills. Same reason why Moxie was fine with Google disabling E2E by default so they could use chat for ad targeting, after attacking other software for doing this, and with them tying enabling it to inconvenient behaviour like disabling the chat log that discourages all but the most paranoid from using it.
xg15 10y ago
So if the security of Whatsapp's keys hinges so much on the key change notifications, why turn them off by default? Why allow them to be turned off at all? No one (today) would get the idea to make https warnings optional even though that audience is even broader than Whatsapp's. (Possibly even because that audience is so broad)
throay123124 10y ago
I have been contemplating deleting my facebook for 6 months. I finally pulled the trigger just now. I don't trust the company at all. Too many smokes and mirrors in what they do.
Sami_Lehtinen 10y ago
Telegram made different choice. Secret chats do get broken, if ephemeral key renewal fails. Queued messages won't get encrypted with new key automatically. Of course at times this is annoying.
dx034 10y ago
I don't get the complains here. Whatsapp is used by over a billion people and offers end2end encryption for them. A system that mainly targets people with little tech experience can never be kept 100% secure. If they make it harder to switch phones, people would stop using whatsapp. The only vulnerability seems to be that they could prevent delivery messages. I'm sure that most people would notice if they suddenly son't see the 2 ticks, even if the other person answered. And if you want your conversation to be secret, that's a major red flag, now that this is known. And if I get a phone change notification even though the other person didn't change their phones I'd also be confused at least. When I last changed my phone, a lot of people noticed because of the notification and asked me. And those were not tech savvy people, they were just wondering why I got a new phone. Spying on conversations (especially by govt agencies) is only effective if the target doesn't know about it. It seems that Whatsapp has no way of enforcing that without the user noticing.
pepijndevos 10y ago
> We believe that WhatsApp remains a great choice for users concerned with the privacy of their message content. What about meta-data? Even Signal uses Google's push service to send your messages, and WhatsApp is even known to collect meta-data. (IIRC they changed their EULA recently)
YeGoblynQueenne 10y ago
I think all this is by-the-by. The gist of The Guardian's article was that WhatsApp has full control of when, if and how your messages are encrypted, and if you're a dissident working against an oppressive regime and you use WhatsApp to collaborate with your allies, your ass is grass, because there isn't anything physically preventing security agencies from getting hold of your communications. That such security agencies have the power to force WhatsApp (or anyone) to comply with their demands is without doubt. A really secure system for activists would be one that makes it impossible even for the provider to read your messages, under any circumstances. WhatsApp is not just not that, it is also ridiculously easy for them to read your messages, if they so choose and you use it at your own risk.
- sschueller 10y ago
  Isn't Signal in the same boat? They are a US company and they control what version of the app is in the play/apple store. They could be force to push a version of a flaw and no one could verify it. The source looks good but the app that has been distributed is not.
  - usernam 10y ago
    I was actually perplexed, after reading about signal, that I couldn't just download an APK. Are play services required for signal? If so, can I even install signal on a cyanogenmod phone? Can you do so by rebuilding it yourself? Does the build match the shipped binary on the play store? To me, Signal does look exactly in the same boat as whatsapp. The fact that WhisperSystems didn't cooperate harder to ship Signal in F-Droid is also a major let-down. Is any other app sharing the same protocol?
    - sschueller 10y ago
      Wire uses the signal protocol. [1] I am not sure if they require google play services but I thought saw something a while back on their github regarding a fallback if google services was not installed and battery consumption. [1] https://wire.com/download/ https://wire.com/download/
wslh 10y ago
Probably it is not a backdoor but still insecure. End to end encryption is not what they offer but they make you think you are safe. They should clearly state that in a big splash message.
maglavaitss 10y ago
A vulnerability you know of and choose to ignore IS a backdoor. All the rest is fancy talk.
FabHK 10y ago
Response by the finder of the vulnerability: As Eike Kühl pretty well describes, this functionality only increases usability in a rare corner case: When you dump your phone in the ocean and you need a month to get a new one. Then everyone who has sent you a message during this period will not need to press an additional "OK" button. https://tobi.rocks/2017/01/what-is-facebook-going-to-do-a-suggestion/ https://tobi.rocks/2017/01/what-is-facebook-going-to-do-a-su...
ryan_j_naughton 10y ago
Wouldn't a better defense be to not re-transmit messages encrypted with the new key unless the originating user clicks a button authorizing it AFTER they have been informed that the receiving user has a new key??
kemonocode 10y ago
If I worked for WhatsApp (Or conversely, if WhatsApp used an implementation of something I've made, thus making it hugely popular in the process) I'd certainly say there's no backdoor indeed. Conflicts of interest.
deleted 10y ago
[deleted]
t0b 10y ago
response: https://tobi.rocks/2017/01/there-is-a-whatsapp-backdoor/ https://tobi.rocks/2017/01/there-is-a-whatsapp-backdoor/
Eager 10y ago
Oh give me a break 7.7 billion people in this planet are not part of ISIS. Nice business model though. Even if WhatsApp or Telegram or Signal are not compromised, you realky should assume the kernel or baseband are. When I was a kid, I did an experiment cracking Apple] [ software. Turns out forget the disk encryption, just hook up the NMI interrupt and you are golden... snapshot whenever you want. Seriously, security is a joke. Nothing is safe. Get over it.
Eager 10y ago
Oh give me a break 7.7 billion people in this planet are not part of ISIS. Nice business model though. Even if WhatsApp or Telegram or Signal are not compromised, you really should assume the kernel or baseband are. When I was a kid, I did an experiment cracking Apple ][ software. Circa 1984, just to see if I could after reading countless documents on the encoding formats (and doing it the hard way). I'm sure the ops have figured this out by now. I know personally was contacted by them multiple times. Rolls eyes. Turns out forget the encryption, just hook up the NMI and snapshot whenever you want. Seriously, security is a joke. Nothing is safe. Get over it.
nullc 10y ago
It's remarkably hard to tell if a key has changed with a peer in signal. It gives you some small faded text between messages which is easily scrolled off by the other party making a lot of comments. Once its off your screen, there is no way to tell that you've never authenticated the current key. No mark, not even burred in a menu. So perhaps I should not surprised to see the authors of the worst public key management security that I've ever actually used defending even worse public key management security.
Vertirigian5 10y ago
My wife use to be a big time cheat,and i was curious of getting proofs about it for real then i saw recommendations about mastershield55@gmail.com online and never hesitated to contact him,He asked me for some few information about my wife mobile device no personal info was asked for also,i provided it all to him and in less than 24 hours i was getting too see my wife text messages,call logs and as well as whats app messages as they come into his phone,i was able to get good and solid proof for my Antony to file a divorce,if you are having similar issues i would advice you contact mastershield55@gmail.com tell him Vertrigian Davison referred you.

1018 points by stablemap 10y ago

deleted 10y ago

[deleted]

tl;dr to me seems: Since users can change devices, they'll need to reissue key material, this needs to be supported. WhatsApp reports key changing optionally, but doesn't tell the server that happened. If WhatsApp tries to backdoor a channel and one of the users has key change notification, they'll find out about it, and WhatsApp has no idea whether the warning was shown.

int_19h 10y ago
If I understand correctly, the default is no key change notification. So for the majority of users, MITM would go unnoticed here.
- Deregibus 10y ago
  I believe that you get a key change notification, but by default it doesn't require any sort of confirmation and will just continue to work with the new key.
  - FabHK 10y ago
    GP is correct: no notification of key changes by default. Even if you enable the key change notification, it is "non-blocking" in WhatsApp as outlined by the blog post: when you get the key change notification, the WhatsApp client will automatically without user intervention resend undelivered messages (unlike Signal, btw, from what I understand).
jMyles 10y ago
> If WhatsApp tries to backdoor a channel and one of the users has key change notification, they'll find out about it The problem is that the might not find about out retransmissions. You are trusting that the "double-tick" means that the message won't be resent, but presumably WhatsApp can indeed retransmit those messages with the new key under pressure from a state actor. They need to specifically address this point; it's the only thing worth talking about. The rest is just a discussion of implementation of key exchanges generally.
- Deregibus 10y ago
  That would require the client to be compromised though right? My understanding is that the client is making the decision whether to retransmit with the new key. Now it's fair to question whether you can trust the client, but if you can't then there's no limit to what they could do.
willvarfar 10y ago
Additionally, the WhatsApp notification is after the message is resent.
deleted 10y ago
[deleted]
dsp1234 10y ago
FTA: "WhatsApp server has no knowledge of whether users have enabled the change notifications, or whether users have verified safety numbers." If it's off by default, then the answer is likely to be near zero, as it often is with default options. This isn't an argument about the security of the app (which I have no background to know), more of a comment on relying on non-default behavior.

deleted 10y ago

[deleted]

jMyles 10y ago

Color me still-unconvinced. This retort does not address the fundamental point made in the Guardian piece: > “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which users might not notice. Using the retransmission vulnerability, the WhatsApp server can then later get a transcript of the whole conversation, not just a single message.”

maxerickson 10y ago
Unconvinced of what exactly?
- tedunangst 10y ago
  I remain unconvinced that people who build messaging apps used by billions of people know more about the problem space than I do.
  - dmix 10y ago
    This may be in need of a /s.
tucif 10y ago
He does address this: Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. That means a user is able to verify visually that the end-to-end is working. "users might not notice" doesn't seem to me as a strong argument to state this as a backdoor. This would imply not noticing that you don't have a green padlock on chrome is a backdoor too, and it clearly is not.
- MichaelGG 10y ago
  Couldn't the server change keys after every message? The delay would be fairly small. Hold the original, change key, retransmit, change key back? Guess that is easily enough mitigated if the client won't allow switching back to the same key.

throw7 10y ago

What is the user supposed to do when they get notified of a "safety number changed" message? How do they verify they've not just been MITM? Honest question... I don't use whatsapp or signal at all.

sloanesturz 10y ago
You have to physically compare the numbers on the two phones (in real life), or send the numbers through a different trusted channel (PGP, USPS, Carrier Pigeon, etc).
ivanhoe 10y ago
It's up to you to confirm what's going on using another channel (say call them on phone and see what's going on, compare the numbers). It's the same thing ssh does when server keys change for instance. To me it's a reasonable way to handle such situation.
jlgaddis 10y ago
(Re-)verify the safety number out-of-band, like you hopefully did initially.
Freestyler_3 10y ago
You can aks the other party to resend you a message from before (one that doesn't matter). Ie. Can you confirm this is you: send me a message from 5 messages back using the quote function. (you know what is said 5 mssgs back so you can pick a non sensitive one, and they can do the same to you) edit: nvm, if this is man in the middle then that doesn't matter because you still exchange with each other and its not a hijack. Sorry, I made a mistake.
subliminalpanda 10y ago
I would simply ask if they got a new phone or re-installed WhatsApp. A few would inquisitively ask "Yes, how did you know?", then I would explain them to them the notification I got.
- pbalau 10y ago

tyrust 10y ago

>The WhatsApp clients have been carefully designed so that they will not re-encrypt messages that have already been delivered. Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. This prevents anyone who compromises the server from being able to selectively target previously delivered messages for re-encryption. Can this be verified? Can this be verified to be the case 100% of the time? Is there anything stopping the client from lying to a user [0] with this interface, saying one thing (i.e. "this will not be resent") and doing another (i.e. resending)? [0] - Or being triggered to lie to a particular user at a particular time.

UncleMeat 10y ago
If your threat model includes using a malicious app to send messages then you lose anyway. Nothing can ever be done to send messages securely using whatsapp if the client is neither trusted nor verified. This is true for basically all software that you use.
- hackuser 10y ago
  Open source software can be verified.
  - enduser 10y ago
    Source code can be verified. Binaries distributed via app stores may or may not have behavior different from the published code.
    - jMyles 10y ago
      Certainly it's possible to remedy this situation simply by having the app author sign a checksum of binaries in the app store. Why this is not currently an option (to my knowledge) is a mystery to me.
      - obscene 10y ago

ycmbntrthrwaway 10y ago

> That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully. I am not convinced. Why should this option exist at all? Even worse, it is disabled by default. Just enable notifications for everyone and demand verification. If you don't want to verify, just ticking "veryfied" without actual verification is not that bad, it is just a trust-on-first-use principle in action. Actually it is how SSH works and nobody complains about SSH being backdoored.

UncleMeat 10y ago
WhatsApp has a gazillion+ users, most of whom don't care about e2e security and definitely don't care enough to verify keys before they are allowed to chat with their friends again. The friction caused by a security popup that 90% of users simply ignore is real. It annoys users and causes fatigue that jeopardizes future security notifications.
cypherpunks01 10y ago
If we're talking about key change notifications, isn't SSH the thing that throws the following error when a key changes? @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is 51:82:00:1c:7e:6f:ac:ac:de:f1:53:08:1c:7d:55:68. Please contact your system administrator. Add correct host key in /Users/user/.ssh/known_hosts to get rid of this message. Offending RSA key in /Users/user/.ssh/known_hosts:12 RSA host key for 8.8.8.8 has changed and you have requested strict checking. Host key verification failed.
- jlgaddis 10y ago
  FYI: indent those lines a few spaces for proper formatting.

pasta 10y ago

Maybe I don't get exactly what this means, but isn't it true that if see a message that someone's signature changed and the other person sees this also and we both choose to ignore this message the man in the middle can read all our new conversations? Ofcourse if then one of us checks the signature later and sees it is not correct this would be very harmfull for whatsapp. But this indeed doesn't sound like a backdoor. It's just the way it works. Which seems good enough.

kingnight 10y ago

This main flagrant or off-topic, but something that nags at me when thinking about truly secure messaging apps from the App Store: Even with perfect e2e encryption protocol added, what's preventing WhatsApp developers (FB) from adding in a feature of the app: if local.user is "TargetUser007" { takeDeviceSnap(); sendDeviceSnapshotToFBOverSameEncryption(); } Wouldn't this not be ever verifiable unless you ARE that specific user and it's too late?

maxerickson 10y ago
You'd also have to make sure they were the only user that received that binary. Otherwise you'd have to hope that no one reverse engineered the binary and noticed the oddly specific comparison there.
- kingnight 10y ago
  Are reverse engineering techniques currently greater than known ability to obfuscate compiled iOS code?
  - dean177 10y ago
    Yes
  - deleted 10y ago
    [deleted]
  - MichaelGG 10y ago
    And it'd have to work for other platforms, too. Android is Java right? Which is even easier to RE.
    - besselheim 10y ago
      Android apps can also contain native code. Indeed, WhatsApp includes such libraries, to help with Curve25519 encryption, video encoding, voice over IP, and other functionality.

quickben 10y ago

I don't user whatsapp, but a general question to these that do: Can the server change keys twice? Change once to server keys, ask for the entire history retransmission. Change again to revert to original receipient keys. Will the receipient be prompted in that case?

brainfire 10y ago
"The WhatsApp clients have been carefully designed so that they will not re-encrypt messages that have already been delivered. Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. This prevents anyone who compromises the server from being able to selectively target previously delivered messages for re-encryption."
- quickben 10y ago
  Ah, thanks
matthewmacleod 10y ago
Change once to server keys, ask for the entire history retransmission. No. the WhatsApp client will not retransmit messages that have already been acknowledged by the recipient device. Of course, you'll have to trust that this is the case; but obviously you'd have to trust the the WhatsApp client app isn't backdoored in the first place, so there is no change in security posture.

disiplus 10y ago

> The choice to make these notifications "blocking" would in some ways make things worse. That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully. could not this be saved only localy ?

ekiru 10y ago
If resending undelivered messages to new keys waited for confirmation of the new key when safety number change notifications are enabled, then users without those notifications enabled would continue to immediately resend undelivered messages to new keys while users with the notifications enabled would not resend until the user manually OKed the change. The WhatsApp servers know (or can know) whether users have outstanding undelivered messages and can observe whether users resend them immediately after a key change. As a result, if resends after key changes waited for user confirmation with security notifications enabled, whenever a user changed keys, WhatsApp would be able to tell whether any of their contacts who had undelivered messages to that user had the notifications enabled by observing whether those contacts immediately resent the messages or not.
- disiplus 10y ago
  thats then a timing attack, but the client could replace the mesaage with a placeholder and send that immidietly, and the real message after the user approves. this way server could not know.
  - ekiru 10y ago
    I think that could mostly work. The placeholder message would have to be of identical length to the original and the resent message would have to use later sequence numbers/message ids (or whatever is used to identify individual messages) so the server couldn't tell that the placeholders were placeholders. One issue is that it would mean that, in the case of an active attack where the server substituted a key they knew in place of a legitimate new key from the user, the server would be able to decrypt the possibly-placeholder resent message and determine whether the user had notifications on. If the user didn't, they'd know that they were safe to continue to attack the user (this attack is more risky than the passive one on the blocking resend without placeholder messages protocol, of course). So, this does improve the security of the protocol for users with security notifications enabled, at the cost of making users without those notifications less safe. I'm not sure how the tradeoff should be balanced here (just as I'm unsure if the UX tradeoff of having the option of not receiving security notifications is worth it...).

sebleon 10y ago

At the end of the day, it comes down to trusting WhatsApp. Even without a backdoor in their protocol, they can easily do all kinds of things. For instance, it could instruct specific clients to encrypt and send each message twice: one for the recipient, and one for the WhatsApp server. As long as this was off for 99.9% of users, it's unlikely that security researchers would ever detect this.

hawkice 10y ago
I mean, they're probably disassembling the app, so they'd definitely notice _that_, but there are some truly subtle problems that pop up in security, so your general point about trust seems reasonable enough (certainly for any closed-source remote-updating system).
- akvadrako 10y ago
  Also it would be possible to put in subtle backdoors, which would be hard to see when it's disassembled and could even allow plausible deniability.
na85 10y ago
Trusting WhatsApp == trusting Facebook I can't think of a company I trust less than Facebook.
- imranq 10y ago
  What about...Walmart, Glencore, Phillip Morris, Blackwater, Palantir...
  - ljk 10y ago
    > Walmart I can use cash at Walmart
    - evgen 10y ago
      And be sure to smile at the cameras watching you in the store, and the ones in the parking lot that recorded you driving in.

stefantalpalaru 10y ago

So WhatsApp can be easily subjected to a man-in-the-middle attack because of some design decisions, but he doesn't want to call it a backdoor? I hope this will significantly reduce his fan base.

joeblau 10y ago

There seems to be a pretty clear war going on between engineers and journalists lately. - Chris Latter [1] vs Business Insider [2] - Elon Musk vs (Bunch of outlets) - Moxie vs The Guardian I feel like journalists want to write a compelling story and engineers are on the other side like "No, those aren't facts!" I don't follow a lot of media outlets but it seems like journalists either lack the skills or don't care about doing any technical due diligence. [1] - https://twitter.com/clattner_llvm/status/819974025371787264 https://twitter.com/clattner_llvm/status/819974025371787264 [2] - http://www.businessinsider.com/how-apples-culture-of-secrecy-wears-down-its-top-developers-2017-1 http://www.businessinsider.com/how-apples-culture-of-secrecy...

hackuser 10y ago
I don't know what happened here, but ... Let's avoid our own bias of automatically believing the engineers are in the right; they are fallible people, no more or less honest or prone to error than journalists. Every news story that breaks, involving any person or industry, gets the same response: It's false, they didn't ask us, etc. etc. Therefore, that response is not an indication that something is wrong (or right); the response tells us nothing in itself.
- joeblau 10y ago
  You're right. Everyone is fallible and I'm all for mistakes being made — We are all human. I also agree that the immediate snap response tells us nothing. Based on the BI story, I know a few people that have actually already uninstalled WhatApp for fear of a backdoor. What I wish is that there was a better way for these two entities to communicate rather than finger pointing and name calling so that we as consumers of both media and technology can read a better more comprehensive narrative.
  - kordless 10y ago
    Name calling results in reassigning fear. People are afraid of the unknown and so try to box it up in something digestible they can fear less. We tend to blame others because it's easy and cheap to do so. If you are wrong, that means I'm right and so then I wasn't wrong about it and don't have to think about it anymore. And you are wrong, so why would I think about it again? I think it's interesting the entities are not two, but many and one at the same time. Elon Musk is an individual and he is also part of the press process. My rationale is that the press includes everyone in the press, including the people writing the stories and the people in the stories. We know Musk. He doesn't know us.

zspitzer 10y ago

What about https://web.whatsapp.com https://web.whatsapp.com? It grants full access to the entire message archive on your phone

zaken 10y ago
Only once you scan the barcode, which contains an encryption key to use for your phone to securely ship /its/ keys to the browser. Only encrypted messages are transmitted between phone and browser

LinuxFreedom 10y ago

We can learn one important thing here - it is not possible to trust closed source software. Enough said, next issue please.

UncleMeat 10y ago
It isn't possible, in most cases, to trust open source software either. Have you verified that the binaries on your phone were indeed built from the source you can read on github or wherever?
- omginternets 10y ago
  Which fully open-source phone platform do you have in mind? I'm not aware of any. On desktop and servers, however, it certainly is possible (and not-too-impractical) to verify binary blobs against known PGP signatures. See Debian's reproducible builds, for instance.
zorked 10y ago
The problem is that we can't trust open source software either. Software being closed source doesn't make it impervious to analysis. Software being open source does not mean it has been analyzed.
- CaptSpify 10y ago
  No, but you can do it any time you want. I don't ever want to change the tires on my car, but I think it's essential that I have the ability to change the tires on my car.
FabHK 10y ago
If your goal is to get the greatest number of people onto the greatest and most secure, private, free software, then pure ideology won't help. What do you think Iran/the NSA/any TLA is more upset about, WhatsApp using the Signal protocol, or Matrix and Riot?

carlos808 10y ago

The Guardian slipped up again, expect more BS from their incompetent journalists.

hrxn 10y ago
Yes, that is the story actually going on. Can't believe how many people fall for this BS, even on HN..

deleted 10y ago

[deleted]

psranga 10y ago

I take this blog post as confirmation that: 1) ANY one message can be intercepted even if the sender exhibits ideal levels of alertness [Whatsapp server drops message to recipient; sends a rekey request with a fake key; message is intercepted since fake key was generated by server. Sender will see a warning if they turned on that setting (default is to show no warning), but it's too late]. 2) Only Whatsapp has this vuln, not Signal app. 3) Depending on sloppiness of sender, more extensive interception is possible. [E.g., server not supplying delivery reports + sender doesn't have warning for key changes + sender sloppy about noticing lack of double check mark => full transcript can be generated]

dangero 10y ago
Best summary I've seen. There are two significant facts here that surprised me: 1. The double checkmark has security implications. How would a typical user know that? 2. Even if you are completely vigilant, follow best practices, etc, Whatsapp messages can be intercepted. They claim this is a "wontfix" UX choice. I'm skeptical why the non-default feature cannot even provide the protection that almost everyone assumed it would.
- Vinnl 10y ago
  > How would a typical user know that? I think that's basically the main problem: there is no way to get a typical user to understand security implications of anything without having that user give up before reaching that point...
artefacts 10y ago
This. So much this. Let's consider three other facts: 1.) WhatsApp is owned by Facebook. This is a company that's has publicly said through a former, nepotistically appointed director that privacy needs to 'go away'. Their sole purpose is to extract as much PII from users as possible for resale. Offering a completely private messaging service doesn't seem to be in their financial interest. 2.) There is no way to independently verify anything being claimed by Moxie/Facebook. No WhatsApp specific source code - which is clearly different from Signal - why? Furthermore, no view into the infrastructure at Facebook. The latter is more reasonable, but seriously, why are we trusting a company whose CEO calls its users "Dumb fucks" for trusting it with their data? 3.) The Client is updated regularly through auto updates, so it seems possible that many of these notifications could simply be bypassed based on Moxie's own described MITM attack. Moxie, fuck your blog post. It has some decent points, but helping Facebook is probably the opposite of what decent privacy advocates should be doing. More likely you've helped them be more covert about doing evil shit than helping users. Hope you enjoyed the cheque though.

RatherFunky 10y ago

This is the source from Guradian paper, so you can test it for yourself. https://tobi.rocks/2016/04/whats-app-retransmission-vulnerability/ https://tobi.rocks/2016/04/whats-app-retransmission-vulnerab...

ljk 10y ago

seems like the original thread has fallen off the front page https://news.ycombinator.com/item?id=13389935 https://news.ycombinator.com/item?id=13389935

RatherFunky 10y ago

"We were previously aware of the issue and might change it in the future, but for now it's not something we're actively working on changing" - FB respond to Tobias Boelter in may 31,2016

lwyr 10y ago

Why is moxie doing PR for WhatsApp?

seanieb 10y ago
He consulted on and helped them implement their E2E encryption.
mos_basik 10y ago
>Even though we are the creators of the encryption protocol supposedly "backdoored" by WhatsApp, we were not asked for comment. It's only a small step from criticism of WhatsApp crypto to criticism of Signal crypto. Why wouldn't moxie be interested?
- RatherFunky 10y ago
  because here it clearly says that signal had dealt with this problem https://tobi.rocks/2016/04/whats-app-retransmission-vulnerability/ https://tobi.rocks/2016/04/whats-app-retransmission-vulnerab... So it is solely whatsapp's fault
- nullc 10y ago
  Especially when signal's interface has similar, if less severe, weaknesses.
autocorr 10y ago
WhatsApp uses the Signal Protocol, I'm not familiar with the details, but this post by OWS should[1]. [1] https://whispersystems.org/blog/whatsapp-complete/ https://whispersystems.org/blog/whatsapp-complete/

mhandley 10y ago

Moxie claimed: > "The choice to make these notifications "blocking" would in some ways make things worse. That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully." Surely if WhatsApp cared about the server not being able to detect this, they could just get the client to "retransmit" an encrypted blank message in place of the original under these circumstances. Then the server wouldn't be able to tell who has enabled blocking mode and who hasn't.

_jp__ 10y ago

Of course there is a backdoor. Why not? Under what law whatsapp and whispersystems live? The one with secret courts and secret court orders?. How to trust someone under this umbrella? We need to spread technology companies. Everything but a bunch of things comes from this law. And what starts in another country, magicaly gets bought or dismissed. Take Symbian as an example...

RatherFunky 10y ago
again ows has nothing to do with this. It is solely vulnerability of whatsapp

leecarraher 10y ago

thanks

agd 10y ago

'Given the size and scope of WhatsApp's user base, we feel that their choice to display a non-blocking notification is appropriate. It provides transparent and cryptographically guaranteed confidence in the privacy of a user's communication, along with a simple user experience. The choice to make these notifications "blocking" would in some ways make things worse. That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully.' Why not have every client show up as having safety number change notifications on and just choose whether to display them client side depending on user settings? i.e. if you have them off, no message will display and the message will automatically be resent using the new key?

Ajedi32 10y ago
Huh? Isn't that exactly how it is now?
- agd 10y ago
  No, even if you have the notification turned on, the message is still resent without your consent.
eridius 10y ago
You quoted the answer to that already. If these change notices are "blocking", then the sending device won't re-send the message until the user has verified it. If the user hasn't enabled the notification, then the sending device will re-send immediately. This makes it trivial for the server to figure out who's actually enabled the notifications and who hasn't, which means the server can be confident about when it's actually safe to MITM.
- agd 10y ago
  You could send a dummy message for those with blocking turned on and screen it out at the receiving client.
- 10y ago

rebuilder 10y ago

So full-on paranoia mode on: What would you do if you wanted to compare safety numbers? I'm guessing most people would call and read out the code. How far are we from targeted interception of calls, with replacement of key phrases? Voice synthesis seems to be there more or less, if I understood Adobe's recent demo correctly, but real-time parsing of conversations to determine where to intervene is probably not close yet.

makomk 10y ago
This kind of phrase replacement in calls was on the NSA's priority list years ago, according to the Snowden leaks.

olegkikin 10y ago

It actually doesn't matter. They are talking about comprimising the servers. The government has the power to force a backdoor (remember Lavabit?). All Whatsapp has to do is update their client, and all the beautiful encryption schemes are ruined. If you need a truly secure communication system, it has to be open source and self-hosted. You still have to trust the hardware though.

Grollicus 10y ago
To expand on this argument a bit, if you think the Government/Whatsapp are specifically out to get you (eg. willing to mount an active attack against you specifically), then WhatsApp is propably the wrong messenger for you. If on the other hand you want a reasonably secure Messenger that you can use to chat privately with everybody and their Grandma then maybe you should not expect that it does super complex security thingys that 99% of its users just don't care about and don't want to be bothered with..
hrxn 10y ago
Lock yourself in the basement, throw away the keys. It's the only way to be safe. > You still have to trust the hardware though. Yes, exactly. And, realistically, how would this work? For a start, everyone running his own lil' chip foundry in the garden shed? This is all BS. Paranoid BS, and fake news Guardian is stoking the flames. Good job..

aaronbrager 10y ago

WhatsApp should make three hanged: 1. handle new keys the same way Chrome handles expired SSL certs: a big warning with the option to continue anyway if you want 2. Don't automatically resend a message with a new key (require the user to manually resend, like when iMessage falls back on MMS) 3. enable the key change notifications and make disabling them an "advanced" setting WhatsApp is making the right choice by designing for ease of use, I think they just landed a little too far away from a secure implementation.

baybal2 10y ago

They are trying to say that an intentionally placed backdoor is not a backdoor? ha ha

ucy 10y ago

The real "Whatsapp Backdoor" is that, by default, the app stores a backup of all your messages on "teh cloud". On android, that's google. So google can play "eve", and every run of the mill script kiddie that can get your google credentials may "restore" your messages. How convenient. And that's the default settings. So, even if you turn it off, "mallory" can steal the credentials of your contact and snoop into your conversation that way.

theveloped 10y ago

As with all end-to-end encryption it stops at the "end". It is this unencrypted state, in which humans consume data, that can't be defended by crypto. Therefore the only way to be completely safe, is to make sure both you and your conversation partner don't decrypt their message until it's on an offline device only you have access to. But end-to-end encryption where the interface (mobile app/phone) is controlled by the parties you want to protect your data from is not possible. WhatsApp could send freaking screenshots back of the unencrypted data if they wanted. For nearly all other threat models whatsApp's encryption is a wonderful add-on.

ryeguy_24 10y ago

Did Hacker News delete the original Guardian WhatsApp article post?

newsat13 10y ago

Yawn. Next what, whatsapp is not going to use monetizing to advertise? Why don't we just all admit that all our data is being plundered by corporations to make money and just leave it at that? Seriously, nobody cares about their data being used by corporations for profit. Just be honest about it.. and you will see that people continue to use whatsapp or signal or whatever the current fad is.

kentonv 10y ago

I love this post for the in-depth explanation of the UX challenges around e2e encryption and why they made the decisions they did. It's educational. I think Moxie highlights a very good point that is commonly underrated among "security Dunning-Krugers": Opening yourself to the possibility of an attack is often OK if the attack is easily detectable, and if the identity of the attacker would be obvious upon detection. Yes, Facebook could intercept and decrypt a message without your advance knowledge. However, you would be able to detect it after the fact. And if you detected an attack, the attacker could be no one other than Facebook. You could then expose them and ruin their reputation. Given this, it's unlikely that Facebook would risk carrying out such an attack in the first place. Security is not binary, it's risk management. The goal is to minimize the risk of an attack, not to rule it out entirely (hint: you can't). I think WhatsApp has made the right choices here.

yellowapple 10y ago
In most cases, I'd much rather disallow Facebook from MITMing my messages than try to "ruin their reputation" (hint: I won't, because Facebook already does far worse things on a regular basis without so much as an eye-bat from the world). In other words: I care about the confidentiality of my messages far more than the promise of some sort of dubious ability to shame Facebook for simply fulfilling its business model. Sure, there are some cases where allowing security to be exploited in one area protects the security of another, but those are called "honeypots", and I sure as hell hope my private communications are not a part of that. Transparency is a dependency of trust. WhatsApp is not transparent; therefore, it is not trustworthy. Simple as that.
- artefacts 10y ago
  > Transparency is a dependency of trust. WhatsApp is not transparent; therefore, it is not trustworthy. Simple as that. +1. The CEO calls its users "Dumb Fucks"; the sister of the CEO, formerly a director of Facebook, claimed "Privacy needs to go away". There's no transparency with WhatsApp in terms of its implementation, so the fact that Moxie may have helped them get initially set up is moot. Moxie's reputation doesn't provide any provable assurances of confidentiality from Facebook.

RRRA 10y ago

Terrible UX combined with unsane default, at best...

_Codemonkeyism 10y ago

Call me paranoid, but the thing which is strange to me is that Whisper talks about this defending Facebook/WhatsApp. This makes me highly suspicion my usage of Signal :-(

makomk 10y ago
Facebook's payments to use the Signal protocol pay the bills. Same reason why Moxie was fine with Google disabling E2E by default so they could use chat for ad targeting, after attacking other software for doing this, and with them tying enabling it to inconvenient behaviour like disabling the chat log that discourages all but the most paranoid from using it.

xg15 10y ago

So if the security of Whatsapp's keys hinges so much on the key change notifications, why turn them off by default? Why allow them to be turned off at all? No one (today) would get the idea to make https warnings optional even though that audience is even broader than Whatsapp's. (Possibly even because that audience is so broad)

throay123124 10y ago

I have been contemplating deleting my facebook for 6 months. I finally pulled the trigger just now. I don't trust the company at all. Too many smokes and mirrors in what they do.

Sami_Lehtinen 10y ago

Telegram made different choice. Secret chats do get broken, if ephemeral key renewal fails. Queued messages won't get encrypted with new key automatically. Of course at times this is annoying.

dx034 10y ago

I don't get the complains here. Whatsapp is used by over a billion people and offers end2end encryption for them. A system that mainly targets people with little tech experience can never be kept 100% secure. If they make it harder to switch phones, people would stop using whatsapp. The only vulnerability seems to be that they could prevent delivery messages. I'm sure that most people would notice if they suddenly son't see the 2 ticks, even if the other person answered. And if you want your conversation to be secret, that's a major red flag, now that this is known. And if I get a phone change notification even though the other person didn't change their phones I'd also be confused at least. When I last changed my phone, a lot of people noticed because of the notification and asked me. And those were not tech savvy people, they were just wondering why I got a new phone. Spying on conversations (especially by govt agencies) is only effective if the target doesn't know about it. It seems that Whatsapp has no way of enforcing that without the user noticing.

pepijndevos 10y ago

> We believe that WhatsApp remains a great choice for users concerned with the privacy of their message content. What about meta-data? Even Signal uses Google's push service to send your messages, and WhatsApp is even known to collect meta-data. (IIRC they changed their EULA recently)

YeGoblynQueenne 10y ago

I think all this is by-the-by. The gist of The Guardian's article was that WhatsApp has full control of when, if and how your messages are encrypted, and if you're a dissident working against an oppressive regime and you use WhatsApp to collaborate with your allies, your ass is grass, because there isn't anything physically preventing security agencies from getting hold of your communications. That such security agencies have the power to force WhatsApp (or anyone) to comply with their demands is without doubt. A really secure system for activists would be one that makes it impossible even for the provider to read your messages, under any circumstances. WhatsApp is not just not that, it is also ridiculously easy for them to read your messages, if they so choose and you use it at your own risk.

sschueller 10y ago
Isn't Signal in the same boat? They are a US company and they control what version of the app is in the play/apple store. They could be force to push a version of a flaw and no one could verify it. The source looks good but the app that has been distributed is not.
- usernam 10y ago
  I was actually perplexed, after reading about signal, that I couldn't just download an APK. Are play services required for signal? If so, can I even install signal on a cyanogenmod phone? Can you do so by rebuilding it yourself? Does the build match the shipped binary on the play store? To me, Signal does look exactly in the same boat as whatsapp. The fact that WhisperSystems didn't cooperate harder to ship Signal in F-Droid is also a major let-down. Is any other app sharing the same protocol?
  - sschueller 10y ago
    Wire uses the signal protocol. [1] I am not sure if they require google play services but I thought saw something a while back on their github regarding a fallback if google services was not installed and battery consumption. [1] https://wire.com/download/ https://wire.com/download/

wslh 10y ago

Probably it is not a backdoor but still insecure. End to end encryption is not what they offer but they make you think you are safe. They should clearly state that in a big splash message.

maglavaitss 10y ago

A vulnerability you know of and choose to ignore IS a backdoor. All the rest is fancy talk.

FabHK 10y ago

Response by the finder of the vulnerability: As Eike Kühl pretty well describes, this functionality only increases usability in a rare corner case: When you dump your phone in the ocean and you need a month to get a new one. Then everyone who has sent you a message during this period will not need to press an additional "OK" button. https://tobi.rocks/2017/01/what-is-facebook-going-to-do-a-suggestion/ https://tobi.rocks/2017/01/what-is-facebook-going-to-do-a-su...

ryan_j_naughton 10y ago

Wouldn't a better defense be to not re-transmit messages encrypted with the new key unless the originating user clicks a button authorizing it AFTER they have been informed that the receiving user has a new key??

kemonocode 10y ago

If I worked for WhatsApp (Or conversely, if WhatsApp used an implementation of something I've made, thus making it hugely popular in the process) I'd certainly say there's no backdoor indeed. Conflicts of interest.

deleted 10y ago

[deleted]

t0b 10y ago

response: https://tobi.rocks/2017/01/there-is-a-whatsapp-backdoor/ https://tobi.rocks/2017/01/there-is-a-whatsapp-backdoor/

Eager 10y ago

Oh give me a break 7.7 billion people in this planet are not part of ISIS. Nice business model though. Even if WhatsApp or Telegram or Signal are not compromised, you realky should assume the kernel or baseband are. When I was a kid, I did an experiment cracking Apple] [ software. Turns out forget the disk encryption, just hook up the NMI interrupt and you are golden... snapshot whenever you want. Seriously, security is a joke. Nothing is safe. Get over it.

Eager 10y ago

Oh give me a break 7.7 billion people in this planet are not part of ISIS. Nice business model though. Even if WhatsApp or Telegram or Signal are not compromised, you really should assume the kernel or baseband are. When I was a kid, I did an experiment cracking Apple ][ software. Circa 1984, just to see if I could after reading countless documents on the encoding formats (and doing it the hard way). I'm sure the ops have figured this out by now. I know personally was contacted by them multiple times. Rolls eyes. Turns out forget the encryption, just hook up the NMI and snapshot whenever you want. Seriously, security is a joke. Nothing is safe. Get over it.

nullc 10y ago

It's remarkably hard to tell if a key has changed with a peer in signal. It gives you some small faded text between messages which is easily scrolled off by the other party making a lot of comments. Once its off your screen, there is no way to tell that you've never authenticated the current key. No mark, not even burred in a menu. So perhaps I should not surprised to see the authors of the worst public key management security that I've ever actually used defending even worse public key management security.

Vertirigian5 10y ago

My wife use to be a big time cheat,and i was curious of getting proofs about it for real then i saw recommendations about mastershield55@gmail.com online and never hesitated to contact him,He asked me for some few information about my wife mobile device no personal info was asked for also,i provided it all to him and in less than 24 hours i was getting too see my wife text messages,call logs and as well as whats app messages as they come into his phone,i was able to get good and solid proof for my Antony to file a divorce,if you are having similar issues i would advice you contact mastershield55@gmail.com tell him Vertrigian Davison referred you.