4 ms·

Whichever story you are talking about, this one or the guardian one, it doesn't address the closed-source point. There is theoretically a way to verify WhatsAp

Whichever story you are talking about, this one or the guardian one, it doesn't address the closed-source point. There is theoretically a way to verify WhatsApp even though it's closed source, but it's practically impossible. It's hard enough to verify software even when the source is open, you built it yourself and the whole platform and toolchain is trusted. A bunch of the potential NSA crypto backdoors were totally in the open. The app could just be lying about resending old messages or even not encrypting them or any number of things much more subtle.

tptacek 10y ago
I'm sorry, but this simply isn't true. Software of far, far greater complexity than WhatsApp has been reverse engineered comprehensively by hobbyists and amateurs. Meanwhile, professionals have pretty sophisticated tools for doing this work at scale.
- akvadrako 10y ago
  Have you ever heard of the obfuscated C contest? Even with the code in front of your face and looking innocent it's hard to see what it does. When you only have decompiled assembly, obfuscation is much easier.
  - tptacek 10y ago
    At the binary level, obfuscation is powerful but obvious. Is iOS WhatsApp meaningfully obfuscated?
    - tedunangst 10y ago
      Considering iOS forbids self modifying code, lots of tricks aren't even available.
    - deleted 10y ago
      [deleted]
    - akvadrako 10y ago
      You are claiming that it would be easier to detect the obfuscation from the Obfuscated C Contest with only the binary and no access to the source code? That is logically wrong - otherwise people would simply compile the source before looking for the bad intentions. Having the source makes detection of backdoors strictly easier. Nothing you've said provides any evidence to the contrary.
- serf 10y ago
  This seems to be the same angle played every time the analysis of crypto tools comes up on HN. (Almost always) when someone mentions the 'impossibility of analysis' of closed-source programs they are actually referring to the difficulty in doing so -- not actually stating that it's impossible. It is easier to look through source code. Now, if we're progressing through this conversation according to script, it will be mentioned that open source projects have had tremendous security problems, too. (OpenSSL comes to mind..) But that's beside the point expressed. The only point, and it's the point that was originally expressed, is that open source code is easier to look through than a closed code base. The hurdles posed by closed source, although not impossible to jump, significantly hinder the progress of analysis. Is this not true?
  - tptacek 10y ago
    I'm sorry, but if you look upthread, the comment I responded to not only didn't say that verifying open source was easier, but actually made the extreme claim that there was in principle no way to verify closed source software at all. Meanwhile, addressing your (different) argument directly: sure, reading C code is easier than reading assembly code, and reading Python is easier than reading C. The easier it is to read a program the easier it is to reason about it. But: * It's not terribly difficult to reason about the functionality of messaging software in any language. * WhatsApp is an extremely high-profile target; it would be weird if people hadn't reversed it by now, since less well-known programs that are much harder to reverse have been productively (as in: findings uncovered) reversed. * The particular things we're looking for in a program like WhatsApp fall into two classes: (1) basic functional stuff like data flow that is even more straightforward to discern from control flow graphs than the kinds of things we routinely use reversing to find (like memory corruption flaws), and (2) cryptographic vulnerabilities that are difficult to spot even in source code, because they're implemented in the mathematical domain of the crypto primitives regardless of the language used to express them to computers. Sure, though. It is easier to spot backdoors in open source software. It's just not capital-H Hard to do it in closed-source software, so this open vs. closed debate about backdoors is usually a red herring.
    - eeZah7Ux 10y ago

tptacek 10y ago

I'm sorry, but this simply isn't true. Software of far, far greater complexity than WhatsApp has been reverse engineered comprehensively by hobbyists and amateurs. Meanwhile, professionals have pretty sophisticated tools for doing this work at scale.

akvadrako 10y ago
Have you ever heard of the obfuscated C contest? Even with the code in front of your face and looking innocent it's hard to see what it does. When you only have decompiled assembly, obfuscation is much easier.
- tptacek 10y ago
  At the binary level, obfuscation is powerful but obvious. Is iOS WhatsApp meaningfully obfuscated?
  - tedunangst 10y ago
    Considering iOS forbids self modifying code, lots of tricks aren't even available.
  - deleted 10y ago
    [deleted]
  - akvadrako 10y ago
    You are claiming that it would be easier to detect the obfuscation from the Obfuscated C Contest with only the binary and no access to the source code? That is logically wrong - otherwise people would simply compile the source before looking for the bad intentions. Having the source makes detection of backdoors strictly easier. Nothing you've said provides any evidence to the contrary.
serf 10y ago
This seems to be the same angle played every time the analysis of crypto tools comes up on HN. (Almost always) when someone mentions the 'impossibility of analysis' of closed-source programs they are actually referring to the difficulty in doing so -- not actually stating that it's impossible. It is easier to look through source code. Now, if we're progressing through this conversation according to script, it will be mentioned that open source projects have had tremendous security problems, too. (OpenSSL comes to mind..) But that's beside the point expressed. The only point, and it's the point that was originally expressed, is that open source code is easier to look through than a closed code base. The hurdles posed by closed source, although not impossible to jump, significantly hinder the progress of analysis. Is this not true?
- tptacek 10y ago
  I'm sorry, but if you look upthread, the comment I responded to not only didn't say that verifying open source was easier, but actually made the extreme claim that there was in principle no way to verify closed source software at all. Meanwhile, addressing your (different) argument directly: sure, reading C code is easier than reading assembly code, and reading Python is easier than reading C. The easier it is to read a program the easier it is to reason about it. But: * It's not terribly difficult to reason about the functionality of messaging software in any language. * WhatsApp is an extremely high-profile target; it would be weird if people hadn't reversed it by now, since less well-known programs that are much harder to reverse have been productively (as in: findings uncovered) reversed. * The particular things we're looking for in a program like WhatsApp fall into two classes: (1) basic functional stuff like data flow that is even more straightforward to discern from control flow graphs than the kinds of things we routinely use reversing to find (like memory corruption flaws), and (2) cryptographic vulnerabilities that are difficult to spot even in source code, because they're implemented in the mathematical domain of the crypto primitives regardless of the language used to express them to computers. Sure, though. It is easier to spot backdoors in open source software. It's just not capital-H Hard to do it in closed-source software, so this open vs. closed debate about backdoors is usually a red herring.
  - eeZah7Ux 10y ago