8 ms·

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them

This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. PS: I just check on my phone if those notifications were turned on. There were not. And I'd never turn those off myself, which leads me to conclude that the rekeying notifications are off by default (in their android app)

Normal_gaussian 10y ago
I can confirm that the rekeying notifications are off by default, also Android
ehsankia 10y ago
I'm confused. The way I understand it is that once the double checkmark appears, those messages are locked in and never rekeyed. That means once you see those checkmarks, you're guaranteed no one can snoop on that message anymore. Assuming you have the notification on (Which anyone who cares about security could and should turn on), once you see a warning, you could just delete all messages that don't have the double checkmark (if any) and not send new ones.
- rndgermandude 10y ago
  One checkmark = message delivered / Double checkmark = somebody read it. That somebody might as well be WhatApp doing a MITM The double checkmark stuff the blog talks about just means you cannot retroactively rekey already sent (old) messages. WhatApp inserting itself as a MITM can however read (and double checkmark) and new messages after they did the MITM rekeying
  - srathi 10y ago
    It is actually slightly different. One checkbox means received by WhatsApp, two checkboxes means received by the recipient and two blue checkboxes means read by the recipient.
- FabHK 10y ago
  > once you see a warning, you could just delete all messages that don't have the double checkmark No, as it stands, they are automatically (without user intervention) re-encrypted and re-sent.
lima 10y ago
> This is contrary to WhatsApp's claim that even they cannot snoop. They claimed that once a message has been delivered (double check mark),. > The only notification might be that rekeying warning The rekeying warning is a fundamental part of WhatsApp's security. If it's disabled, there are many possible attacks, not just this one. The blog entry explains it pretty well.
- rndgermandude 10y ago
  The double check mark might just mean WhatApp rekeyed both parties and have read the messages themselves. And the "fundamental part" is disabled by default...
haser_au 10y ago
> This allows WhatsApp to MITM. Technically, yes. Users could verify if they have been MITMed by verifying the Security Number (just tap on a contact, view contact details -> Encryption). This assumes the WhatsApp app doesn't just display the old safety number.
- jknoepfler 10y ago
  In the world of security, technically means actually. Life or death situations require zero trust technologies.
- rndgermandude 10y ago
  Indeed. I'm working under the assumption that the client itself is sound. The question is: how many users will actually check the Security Number, and recheck all the security numbers now that they were made aware of having to turn on the notification. What WhatsApp is doing here is like using a self signed certificate to do TLS (your own fault if you did not check the cert yourself using whatever out-of-bands method available) and on top of that the TLS client later by default will not tell you when that self-signed cert changes (and you therefore need to recheck it) and for added bonus routing all traffic through them.
moxie 10y ago
> This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. You've just described a "man in the middle" attack. It is endemic to any public key cryptosystem, including Signal and PGP, not just WhatsApp. The notification that you see in WhatsApp, Signal, SSH, PGP, or whatever is the defense. > PS: I just check on my phone if those notifications were turned on. There were not. And I'd never turn those off myself, which leads me to conclude that the rekeying notifications are off by default (in their android app) Key change notifications are off by default in WhatsApp. That's probably going to be a fundamental limit of any application that serves billions of people from many different demographics all over the world. Even if they were on by default, a fact of life is that the majority of users will probably not verify keys. That is our reality. Given that reality, the most important thing is to design your product so that the server has no knowledge of who has verified keys or who has enabled a setting to see key change notifications. That way the server has no knowledge of who it can MITM without getting caught. I've been impressed with the level of care that WhatsApp has given to that requirement. I think we should all remain open to ideas about how we can improve this UX within the limits a mass market product has to operate within, but that's very different from labeling this a "backdoor."
- wfunction 10y ago
  > That way the server has no knowledge of who it can MITM without getting caught. What exactly do you think is the worst thing that could happen if you "catch" them doing this? Now what do you think is the worst thing that could happen if they receive a subpoena or NSL or whatever that tells them to do this regardless of whether the user finds out or not (because the government wants the message contents that badly)? Which do you think will prevail?
  - feral 10y ago
    > What exactly do you think is the worst thing that could happen if you "catch" them doing this? [I'm not the OP, but my 0.02]: Hopefully there would be an outcry, initially started by technically sophisticated communities like this, and credible articles in the Guardian, eventually causing significant user anger, and letting competitors gain against them. People running social networks care about mass user anger. Hopefully that possibility keeps them honest. Hopefully people don't cry wolf too many times, like today - slowly poisoning the watchdog! > Now what do you think is the worst thing that could happen if they receive a subpoena or NSL or whatever that tells them to do this regardless of whether the user finds out or not (because the government wants the message contents that badly)? This has got to primarily be a defense against ongoing mass surveillance. If the government can compel them (via NSL or force or whatever) to change the service so that it just spies on a few targeted individuals, wouldn't it be easier to push these individual a malicious client update, rather than MITM the encryption and hope they have notifications off? Does anyone know how to build a massively adopted network that resists targeted NSLs? I'm grateful we appear to have one that is resistant to pervasive monitoring.
shawnz 10y ago
> This allows WhatsApp to MITM. If you're operating under the assumption that users aren't going to check their peers' key fingerprints, then you could just give compromised keys from the beginning -- no rekeying necessary. There's no way to protect against that scenario. That's not a fault of WhatsApp.
- manquer 10y ago
  well if they allow me to use my own keys this will not be a problem.
Ajedi32 10y ago
Right, as the article says: > The only question it might be reasonable to ask is whether these safety number change notifications should be "blocking" or "non-blocking." In other words, when a contact's key changes, should WhatsApp require the user to manually verify the new key before continuing, or should WhatsApp display an advisory notification and continue without blocking the user. You seem to be arguing that they should be blocking. While I agree that's definitely the best choice from a security perspective, I kinda doubt most users would appreciate having to manually re-verify keys every time someone reinstalls WhatsApp or changes their phone. In this case, WhatsApp decided to prioritize usability over security. You and I are of course free to criticize that choice, but it's hardly a "backdoor". I'd add to the author's statement above and say another question we might reasonably ask is whether the notification should be on or off by default. While my gut reaction to that "On, obviously!", upon giving it a bit more thought I think it's actually understandable why WhatsApp chose off instead. They're not designing WhatsApp merely for security conscious people, but for the masses. The average user is unlikely to understand or care enough about this warning to manually re-verify keys every time they see it, especially when the vast majority of the time it's just going to turn out to be the result of something mundane, like one of their friends getting a new phone. Honestly, I could go either way on this one.
- rndgermandude 10y ago
  No, first and foremost, I argue the notifications should be ON by default and feature a lot more clear and understandable text than what is displayed now. The auto-resending of unread messages is another issue next to the potential of MITM due to no or unclear notifications about key changes
vorticalbox 10y ago
Can confirm it's off by default on windows phone.
Findeton 10y ago
I'd call this SITM (Server in the middle).

Normal_gaussian 10y ago

I can confirm that the rekeying notifications are off by default, also Android

ehsankia 10y ago

I'm confused. The way I understand it is that once the double checkmark appears, those messages are locked in and never rekeyed. That means once you see those checkmarks, you're guaranteed no one can snoop on that message anymore. Assuming you have the notification on (Which anyone who cares about security could and should turn on), once you see a warning, you could just delete all messages that don't have the double checkmark (if any) and not send new ones.

rndgermandude 10y ago
One checkmark = message delivered / Double checkmark = somebody read it. That somebody might as well be WhatApp doing a MITM The double checkmark stuff the blog talks about just means you cannot retroactively rekey already sent (old) messages. WhatApp inserting itself as a MITM can however read (and double checkmark) and new messages after they did the MITM rekeying
- srathi 10y ago
  It is actually slightly different. One checkbox means received by WhatsApp, two checkboxes means received by the recipient and two blue checkboxes means read by the recipient.
FabHK 10y ago
> once you see a warning, you could just delete all messages that don't have the double checkmark No, as it stands, they are automatically (without user intervention) re-encrypted and re-sent.

lima 10y ago

> This is contrary to WhatsApp's claim that even they cannot snoop. They claimed that once a message has been delivered (double check mark),. > The only notification might be that rekeying warning The rekeying warning is a fundamental part of WhatsApp's security. If it's disabled, there are many possible attacks, not just this one. The blog entry explains it pretty well.

rndgermandude 10y ago
The double check mark might just mean WhatApp rekeyed both parties and have read the messages themselves. And the "fundamental part" is disabled by default...

haser_au 10y ago

> This allows WhatsApp to MITM. Technically, yes. Users could verify if they have been MITMed by verifying the Security Number (just tap on a contact, view contact details -> Encryption). This assumes the WhatsApp app doesn't just display the old safety number.

jknoepfler 10y ago
In the world of security, technically means actually. Life or death situations require zero trust technologies.
rndgermandude 10y ago
Indeed. I'm working under the assumption that the client itself is sound. The question is: how many users will actually check the Security Number, and recheck all the security numbers now that they were made aware of having to turn on the notification. What WhatsApp is doing here is like using a self signed certificate to do TLS (your own fault if you did not check the cert yourself using whatever out-of-bands method available) and on top of that the TLS client later by default will not tell you when that self-signed cert changes (and you therefore need to recheck it) and for added bonus routing all traffic through them.

moxie 10y ago

> This allows WhatsApp to MITM. Whatapps can rekey both Alice and Bob, decrypt both their messages from that point onwards (incl unsent messages) and forward them re-encrypted with their real keys. The only notification might be that rekeying warning, if the users have turned it on. In this scenario even the double-checkmarks are present. This is contrary to WhatsApp's claim that even they cannot snoop. You've just described a "man in the middle" attack. It is endemic to any public key cryptosystem, including Signal and PGP, not just WhatsApp. The notification that you see in WhatsApp, Signal, SSH, PGP, or whatever is the defense. > PS: I just check on my phone if those notifications were turned on. There were not. And I'd never turn those off myself, which leads me to conclude that the rekeying notifications are off by default (in their android app) Key change notifications are off by default in WhatsApp. That's probably going to be a fundamental limit of any application that serves billions of people from many different demographics all over the world. Even if they were on by default, a fact of life is that the majority of users will probably not verify keys. That is our reality. Given that reality, the most important thing is to design your product so that the server has no knowledge of who has verified keys or who has enabled a setting to see key change notifications. That way the server has no knowledge of who it can MITM without getting caught. I've been impressed with the level of care that WhatsApp has given to that requirement. I think we should all remain open to ideas about how we can improve this UX within the limits a mass market product has to operate within, but that's very different from labeling this a "backdoor."

wfunction 10y ago
> That way the server has no knowledge of who it can MITM without getting caught. What exactly do you think is the worst thing that could happen if you "catch" them doing this? Now what do you think is the worst thing that could happen if they receive a subpoena or NSL or whatever that tells them to do this regardless of whether the user finds out or not (because the government wants the message contents that badly)? Which do you think will prevail?
- feral 10y ago
  > What exactly do you think is the worst thing that could happen if you "catch" them doing this? [I'm not the OP, but my 0.02]: Hopefully there would be an outcry, initially started by technically sophisticated communities like this, and credible articles in the Guardian, eventually causing significant user anger, and letting competitors gain against them. People running social networks care about mass user anger. Hopefully that possibility keeps them honest. Hopefully people don't cry wolf too many times, like today - slowly poisoning the watchdog! > Now what do you think is the worst thing that could happen if they receive a subpoena or NSL or whatever that tells them to do this regardless of whether the user finds out or not (because the government wants the message contents that badly)? This has got to primarily be a defense against ongoing mass surveillance. If the government can compel them (via NSL or force or whatever) to change the service so that it just spies on a few targeted individuals, wouldn't it be easier to push these individual a malicious client update, rather than MITM the encryption and hope they have notifications off? Does anyone know how to build a massively adopted network that resists targeted NSLs? I'm grateful we appear to have one that is resistant to pervasive monitoring.

shawnz 10y ago

> This allows WhatsApp to MITM. If you're operating under the assumption that users aren't going to check their peers' key fingerprints, then you could just give compromised keys from the beginning -- no rekeying necessary. There's no way to protect against that scenario. That's not a fault of WhatsApp.

manquer 10y ago
well if they allow me to use my own keys this will not be a problem.

Ajedi32 10y ago

Right, as the article says: > The only question it might be reasonable to ask is whether these safety number change notifications should be "blocking" or "non-blocking." In other words, when a contact's key changes, should WhatsApp require the user to manually verify the new key before continuing, or should WhatsApp display an advisory notification and continue without blocking the user. You seem to be arguing that they should be blocking. While I agree that's definitely the best choice from a security perspective, I kinda doubt most users would appreciate having to manually re-verify keys every time someone reinstalls WhatsApp or changes their phone. In this case, WhatsApp decided to prioritize usability over security. You and I are of course free to criticize that choice, but it's hardly a "backdoor". I'd add to the author's statement above and say another question we might reasonably ask is whether the notification should be on or off by default. While my gut reaction to that "On, obviously!", upon giving it a bit more thought I think it's actually understandable why WhatsApp chose off instead. They're not designing WhatsApp merely for security conscious people, but for the masses. The average user is unlikely to understand or care enough about this warning to manually re-verify keys every time they see it, especially when the vast majority of the time it's just going to turn out to be the result of something mundane, like one of their friends getting a new phone. Honestly, I could go either way on this one.

rndgermandude 10y ago
No, first and foremost, I argue the notifications should be ON by default and feature a lot more clear and understandable text than what is displayed now. The auto-resending of unread messages is another issue next to the potential of MITM due to no or unclear notifications about key changes

vorticalbox 10y ago

Can confirm it's off by default on windows phone.

Findeton 10y ago

I'd call this SITM (Server in the middle).