4 ms·

> That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could

> That would leak information to the server about who has enabled safety number change notifications and who hasn't, effectively telling the server who it could MITM transparently and who it couldn't; something that WhatsApp considered very carefully. I am not convinced. Why should this option exist at all? Even worse, it is disabled by default. Just enable notifications for everyone and demand verification. If you don't want to verify, just ticking "veryfied" without actual verification is not that bad, it is just a trust-on-first-use principle in action. Actually it is how SSH works and nobody complains about SSH being backdoored.

UncleMeat 10y ago
WhatsApp has a gazillion+ users, most of whom don't care about e2e security and definitely don't care enough to verify keys before they are allowed to chat with their friends again. The friction caused by a security popup that 90% of users simply ignore is real. It annoys users and causes fatigue that jeopardizes future security notifications.
cypherpunks01 10y ago
If we're talking about key change notifications, isn't SSH the thing that throws the following error when a key changes? @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is 51:82:00:1c:7e:6f:ac:ac:de:f1:53:08:1c:7d:55:68. Please contact your system administrator. Add correct host key in /Users/user/.ssh/known_hosts to get rid of this message. Offending RSA key in /Users/user/.ssh/known_hosts:12 RSA host key for 8.8.8.8 has changed and you have requested strict checking. Host key verification failed.
- jlgaddis 10y ago
  FYI: indent those lines a few spaces for proper formatting.
- makomk 10y ago
  Yeah, SSH is at the complete opposite end of the scale in how it handles unexpected key changes - it won't even let you connect unless you manually edit known_hosts, whereas WhatsApp automatically uses the new key without any possible way for the user to stop it from doing so until it's too late.
mos_basik 10y ago
Caveat: I have never used WhatsApp and do not know anything about its interface or options (default or otherwise). >>[The choice to make these notifications "blocking" (i.e. to require manual verification) would] leak information to the server, etc., etc. >Why should this option exist at all? The option does not exist, and should not exist. That's the author's point there. You agree with him and with WhatsApp on that. All you disagree on is implementation: Author: "[Non-blocking defaults] provide transparent and cryptographically guaranteed confidence in the privacy of a user's communication, along with a simple user experience." You: "Enable notifications for everyone and demand verification; if you don't want to verify, just tick "verified" without actually verifying." How are these two substantially different? They look the same to me in terms of security and WhatsApp's implementation doesn't make you click anything.
- FabHK 10y ago
  Difference is that the WhatsApp client re-encrypts the message with the new key from the server and re-sends it without user intervention ("non-blocking"), so even if you cared, you can't prevent it. With the alternative, people that don't care could tick "verified" with or without verifying, but you could also click "cancel" (with or without verifying).
  - mos_basik 10y ago
    What difference does it make? ALICE When would you like to meet? BOB Tomorrow, 19:00, by the north tennis courts. ALICE Sounds good. !!! BOB's key has changed !!! BOB Actually, could we meet at my place? I'm going to be super busy tomorrow. If Alice and Bob are doing something that needs to remain secure, Alice would be a fool to trust Bob's messages after the key change without manually verifying the new key with Bob. How does withholding messages help, aside from telling the server which people have enabled the setting and which people have not? [edit: I just realized you were talking specifically about the case where manual verification is enforced for all users; disregard the last phrase.] Admittedly one angle I can kind of agree with is that layman users may not understand the implications of a key change and the importance of out-of-band verification, and blocking messages until verification would be a way of signaling the significance of the key change. But... counterpoint to that is that users interested in security are probably already dead in the water in that regard if all they have is a layman's knowledge of how crypto works.
mtgx 10y ago
I think both Signal and WhatsApp "trust on first use" like SSH does it. The issue here is that: 1) the vast majority of users have those MITM notifications off by default (because WhatsApp decided it's best that way) 2) WhatsApp generates its own keys in some scenarios, like when people switch their SIM cards, so the "trust on first use" that worked on the original SIM is gone out of the window now, and the users won't even know it because the notification is off by default. Actually now that I think about it, this is why WhatsApp must have let the notifications off by default, because they knew they would generate their own keys this way, which would generate a lot of those notifications all the time.

UncleMeat 10y ago

WhatsApp has a gazillion+ users, most of whom don't care about e2e security and definitely don't care enough to verify keys before they are allowed to chat with their friends again. The friction caused by a security popup that 90% of users simply ignore is real. It annoys users and causes fatigue that jeopardizes future security notifications.

cypherpunks01 10y ago

If we're talking about key change notifications, isn't SSH the thing that throws the following error when a key changes? @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is 51:82:00:1c:7e:6f:ac:ac:de:f1:53:08:1c:7d:55:68. Please contact your system administrator. Add correct host key in /Users/user/.ssh/known_hosts to get rid of this message. Offending RSA key in /Users/user/.ssh/known_hosts:12 RSA host key for 8.8.8.8 has changed and you have requested strict checking. Host key verification failed.

jlgaddis 10y ago
FYI: indent those lines a few spaces for proper formatting.
makomk 10y ago
Yeah, SSH is at the complete opposite end of the scale in how it handles unexpected key changes - it won't even let you connect unless you manually edit known_hosts, whereas WhatsApp automatically uses the new key without any possible way for the user to stop it from doing so until it's too late.

mos_basik 10y ago

Caveat: I have never used WhatsApp and do not know anything about its interface or options (default or otherwise). >>[The choice to make these notifications "blocking" (i.e. to require manual verification) would] leak information to the server, etc., etc. >Why should this option exist at all? The option does not exist, and should not exist. That's the author's point there. You agree with him and with WhatsApp on that. All you disagree on is implementation: Author: "[Non-blocking defaults] provide transparent and cryptographically guaranteed confidence in the privacy of a user's communication, along with a simple user experience." You: "Enable notifications for everyone and demand verification; if you don't want to verify, just tick "verified" without actually verifying." How are these two substantially different? They look the same to me in terms of security and WhatsApp's implementation doesn't make you click anything.

FabHK 10y ago
Difference is that the WhatsApp client re-encrypts the message with the new key from the server and re-sends it without user intervention ("non-blocking"), so even if you cared, you can't prevent it. With the alternative, people that don't care could tick "verified" with or without verifying, but you could also click "cancel" (with or without verifying).
- mos_basik 10y ago
  What difference does it make? ALICE When would you like to meet? BOB Tomorrow, 19:00, by the north tennis courts. ALICE Sounds good. !!! BOB's key has changed !!! BOB Actually, could we meet at my place? I'm going to be super busy tomorrow. If Alice and Bob are doing something that needs to remain secure, Alice would be a fool to trust Bob's messages after the key change without manually verifying the new key with Bob. How does withholding messages help, aside from telling the server which people have enabled the setting and which people have not? [edit: I just realized you were talking specifically about the case where manual verification is enforced for all users; disregard the last phrase.] Admittedly one angle I can kind of agree with is that layman users may not understand the implications of a key change and the importance of out-of-band verification, and blocking messages until verification would be a way of signaling the significance of the key change. But... counterpoint to that is that users interested in security are probably already dead in the water in that regard if all they have is a layman's knowledge of how crypto works.

mtgx 10y ago

I think both Signal and WhatsApp "trust on first use" like SSH does it. The issue here is that: 1) the vast majority of users have those MITM notifications off by default (because WhatsApp decided it's best that way) 2) WhatsApp generates its own keys in some scenarios, like when people switch their SIM cards, so the "trust on first use" that worked on the original SIM is gone out of the window now, and the users won't even know it because the notification is off by default. Actually now that I think about it, this is why WhatsApp must have let the notifications off by default, because they knew they would generate their own keys this way, which would generate a lot of those notifications all the time.