5 ms·

He does address this: Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. That means a user is able to

by tucif 10y ago

He does address this: Once the sending client displays a "double check mark," it can no longer be asked to re-send that message. That means a user is able to verify visually that the end-to-end is working. "users might not notice" doesn't seem to me as a strong argument to state this as a backdoor. This would imply not noticing that you don't have a green padlock on chrome is a backdoor too, and it clearly is not.

MichaelGG 10y ago
Couldn't the server change keys after every message? The delay would be fairly small. Hold the original, change key, retransmit, change key back? Guess that is easily enough mitigated if the client won't allow switching back to the same key.
- tucif 10y ago
  It could. I guess the point here is: Can there be a backdoor in whatsapp? Of course! Is there a backdoor on Whatsapp as described on the guardian article? No. Can the UX be improved to alert the smaller percentage of users that rely heavily on the encryption features when their communication is not being actively protected without disturbing the UX of the rest of the users? Probably yes,
  - MichaelGG 10y ago
    No it's very different. Without further details, it sounds like it's possible for FB to switch keys and intercept all messages on everyone, all the time.
    - occamrazor 10y ago
      But the sender would receive at least a notification of key change by the recipient. It is up to them to confirm the validity of the key.
  - acqq 10y ago
    > Can the UX be improved to alert the smaller percentage of users that rely heavily ... Probably yes Hell yes! Imagine jusr changing background color and the banner "somebody spies on you." Now it's something like some checkmark somewhere looks a bit different or whatever.. I'm still not sure what when...
    - estel 10y ago
      But keys changes are pretty frequent and normal things that happen between clients - this would be an awful and inappropriate warning almost every time it was shown.
runn1ng 10y ago
A little. Without reading the Guardian piece, I wouldn't even guess that delivery notifications have anything in common with security properties. In other words, the messages are secure only when there is a double checkmark, not just a single checkmark. How am I supposed to know that?!? I am not even sure what do the checkmarks mean. Frankly, that's not a "backdoor", that's just a poorly thought out GUI (in my opinion), that might eventually lead to backdoors with an evil server.
- tucif 10y ago
  Absolutely. There is no evident connection that can be done from the double checkmark to a "secured communication". But when you think about it, the double check is a read confirmation so if we are in an end-to-end encrypted scenario, and the message content was read, it means the recipient's device was able to decrypt it successfully. This tells you that the recipient is still using the same set of keys that your device thought it had and used to encrypt the message.
- JCzynski 10y ago
  The single/double checkmark is used with Signal's client as well. When you're sending unsecured texts, you get a single checkmark when you send it; when you are sending encrypted messages, a lock symbol and a single check when sent, and a double check when received.
  - makomk 10y ago
    Except that the obvious interpretation of the second checkmark not appearing is that the message was never received, not that it was decrypted by an attacker. Especially when there's a key change warning afterwards. I think this is still the correct interpretation in Signal proper, but who knows at this point?
  - runn1ng 10y ago
    Yes, but in Signal, it doesn't have bad security consequences when its meaning is misunderstood.
ploxiln 10y ago
The "green padlock" was not considered enough because users would not be able to differentiate it from a big lock symbol within the page. Thus we got HSTS. (There was a time when browsers would color the entire URL bar yellow to indicate https, but that went out of favor many years ago.) Moxie deserves respect for the web vulnerabilities he discovered and raised awareness about years ago, and for his general competence at cryptography. But in recent years he's shown himself to be willing to make catastrophic sacrifices to make security applications popular and viable for the "lay person". If the "lay person" ignores the non-obtrusive key changes, and difference between single and multiple checkmarks (and the timing of them, whether single changed to double after a key change), and just trusts that "I heard WhatsApp is secure, so I'm good to go", then so much is sacrificed that there wasn't any point in the exercise to begin with. Except that real solid systems, with direct user control over key continuity, and fully open-source, are undermined by the confusion with these "lay person" super-convenient closed-source systems.
- tucif 10y ago
  I agree, perhaps a further version of the signal protocol could implement a definitive solution that better addresses this kind of scenario the way HSTS did for ssl certs. And combined with a friendly UI solution (like the new padlock | Secure string in chrome) would lead to easier detection of possible eavesdroppers by the lay person.
  - gepoch 10y ago
    This isn't a vulnerability in the signal protocol. More a vulnerability in a particular UX decision that WhatsApp made (consciously, even.)
- oconnor663 10y ago
  > catastrophic sacrifices to make security applications popular and viable for the "lay person" This isn't wrong, but it's unfair to bring it up without the most obvious counter-argument. PGP provides absolutely zero security to the average person, because average people don't use it. HTTPS provides lots of security to the average person, whether or not they know what the green lock means, because lots of people use it. Adoption is a feature. Of course both of these things are true. Security sacrifices for the sake of adoption suck. But let's not paint a picture of Signal as "desperate for popularity", as though that was a selfish and not security-minded goal. Be fair.
moomin 10y ago
Correct me if I'm wrong, but don't double-ticks only appear in one on one conversations? What's the story on group chats?
- barbs 10y ago
  A double-tick will appear once everyone has received the message. You can view details on a single message to see who has received the message on an individual basis (and also who has read it).

by tucif 10y ago

MichaelGG 10y ago

Couldn't the server change keys after every message? The delay would be fairly small. Hold the original, change key, retransmit, change key back? Guess that is easily enough mitigated if the client won't allow switching back to the same key.

tucif 10y ago
It could. I guess the point here is: Can there be a backdoor in whatsapp? Of course! Is there a backdoor on Whatsapp as described on the guardian article? No. Can the UX be improved to alert the smaller percentage of users that rely heavily on the encryption features when their communication is not being actively protected without disturbing the UX of the rest of the users? Probably yes,
- MichaelGG 10y ago
  No it's very different. Without further details, it sounds like it's possible for FB to switch keys and intercept all messages on everyone, all the time.
  - occamrazor 10y ago
    But the sender would receive at least a notification of key change by the recipient. It is up to them to confirm the validity of the key.
- acqq 10y ago
  > Can the UX be improved to alert the smaller percentage of users that rely heavily ... Probably yes Hell yes! Imagine jusr changing background color and the banner "somebody spies on you." Now it's something like some checkmark somewhere looks a bit different or whatever.. I'm still not sure what when...
  - estel 10y ago
    But keys changes are pretty frequent and normal things that happen between clients - this would be an awful and inappropriate warning almost every time it was shown.

runn1ng 10y ago

A little. Without reading the Guardian piece, I wouldn't even guess that delivery notifications have anything in common with security properties. In other words, the messages are secure only when there is a double checkmark, not just a single checkmark. How am I supposed to know that?!? I am not even sure what do the checkmarks mean. Frankly, that's not a "backdoor", that's just a poorly thought out GUI (in my opinion), that might eventually lead to backdoors with an evil server.

tucif 10y ago
Absolutely. There is no evident connection that can be done from the double checkmark to a "secured communication". But when you think about it, the double check is a read confirmation so if we are in an end-to-end encrypted scenario, and the message content was read, it means the recipient's device was able to decrypt it successfully. This tells you that the recipient is still using the same set of keys that your device thought it had and used to encrypt the message.
JCzynski 10y ago
The single/double checkmark is used with Signal's client as well. When you're sending unsecured texts, you get a single checkmark when you send it; when you are sending encrypted messages, a lock symbol and a single check when sent, and a double check when received.
- makomk 10y ago
  Except that the obvious interpretation of the second checkmark not appearing is that the message was never received, not that it was decrypted by an attacker. Especially when there's a key change warning afterwards. I think this is still the correct interpretation in Signal proper, but who knows at this point?
- runn1ng 10y ago
  Yes, but in Signal, it doesn't have bad security consequences when its meaning is misunderstood.

ploxiln 10y ago

The "green padlock" was not considered enough because users would not be able to differentiate it from a big lock symbol within the page. Thus we got HSTS. (There was a time when browsers would color the entire URL bar yellow to indicate https, but that went out of favor many years ago.) Moxie deserves respect for the web vulnerabilities he discovered and raised awareness about years ago, and for his general competence at cryptography. But in recent years he's shown himself to be willing to make catastrophic sacrifices to make security applications popular and viable for the "lay person". If the "lay person" ignores the non-obtrusive key changes, and difference between single and multiple checkmarks (and the timing of them, whether single changed to double after a key change), and just trusts that "I heard WhatsApp is secure, so I'm good to go", then so much is sacrificed that there wasn't any point in the exercise to begin with. Except that real solid systems, with direct user control over key continuity, and fully open-source, are undermined by the confusion with these "lay person" super-convenient closed-source systems.

tucif 10y ago
I agree, perhaps a further version of the signal protocol could implement a definitive solution that better addresses this kind of scenario the way HSTS did for ssl certs. And combined with a friendly UI solution (like the new padlock | Secure string in chrome) would lead to easier detection of possible eavesdroppers by the lay person.
- gepoch 10y ago
  This isn't a vulnerability in the signal protocol. More a vulnerability in a particular UX decision that WhatsApp made (consciously, even.)
oconnor663 10y ago
> catastrophic sacrifices to make security applications popular and viable for the "lay person" This isn't wrong, but it's unfair to bring it up without the most obvious counter-argument. PGP provides absolutely zero security to the average person, because average people don't use it. HTTPS provides lots of security to the average person, whether or not they know what the green lock means, because lots of people use it. Adoption is a feature. Of course both of these things are true. Security sacrifices for the sake of adoption suck. But let's not paint a picture of Signal as "desperate for popularity", as though that was a selfish and not security-minded goal. Be fair.

moomin 10y ago

Correct me if I'm wrong, but don't double-ticks only appear in one on one conversations? What's the story on group chats?

barbs 10y ago
A double-tick will appear once everyone has received the message. You can view details on a single message to see who has received the message on an individual basis (and also who has read it).