4 ms·
Maciej, I have tremendous respect for you. What follows is a long post, so please don't feel like I am beating up on you - I am responding to a few things in th
by ABCLAW 10y ago
Maciej, I have tremendous respect for you. What follows is a long post, so please don't feel like I am beating up on you - I am responding to a few things in this thread.
---
This wasn't negligent disinformation (post-revision of the usage of 'backdoor') on the part of the Guardian. The reaction to the information presented on the part of the public - to switch to SMS in significant numbers - was irrational.
That said, there is a productive issue raised by the Guardian that has been smoked out into the open, namely the revelation of two contradictory assumptions underlying the decision, as discussed by Moxie in the previous HN thread, to defend against state level snooping.
The rationale goes a bit like this:
1 - People change keys in the regular course of using Whatsapp. It therefore needs to accept that without impeding usability.
2 - Most users do not care about security enough to prefer one service to another for the Whatsapp market segment - Those users use Signal or other offerings.
3 - Whatsapp's lack of 'post consent' resending is intentional, and designed to prevent the server from knowing who is monitoring the status of their keys.
4 - As such, Whatsapp effectively defends against dragnet surveillance! As security minded individuals will note inappropriate key changes once a MITM attack begins, confer, and determine they have been compromised at scale.
The key flaw here is that 2 and 3 mean that for targeted surveillance, powerful attackers are unlikely to be uncovered while exfiltrating specific communications, and likely don't see very much reputational or legal risk to potentially triggering a key change event.
So people are vulnerable to feasible, targeted message exfiltration, contrary to what they may have believed when E2E was rolled out. That's newsworthy.
The fact that the security community is striking back makes me feel like they are circling the wagons now that the Guardian has caught them with their pants down - They should have been the ones raising these issues and providing the appropriate framing to protect the public.
- idlewords 10y agoThe thing the Guardian did that was really unforgivably bad is not canvass expert opinion. They didn't even care that 'backdoor' has a specific technical meaning, they just stuck it in the headline and then edited it out after getting called out.
- ABCLAW 10y agoI think this is a valid concern, but one that applies to most media. In my field, I often see pieces circulated which are incorrect with facts sourced from less precise colleagues of mine. I don't believe the piece was not 'newsworthy', though, and I believe the security industry's response should have been one of collaboration rather than admonition - it leaves a bad taste in my mouth to see an industry with a clear communication problem striking at their best potential ally. The Guardian are not the 'bad guys' for trying to inform us of a vulnerability.
- morganvachon 10y ago> The Guardian are not the 'bad guys' for trying to inform us of a vulnerability. This is my ultimate takeaway as well; their intent was good, it was their implementation that fell short. I'm just really bothered that they are unwilling to own their mistake and retract the article, or at the very least allow a counter-editorial to be written and published by them.
- idlewords 10y agoThey've offered to publish a counter-editorial. But that would just lead to a headline like "Experts Divided Over Critical WhatsApp Vulnerability". They need to retract.