5 ms·
I'm not sure if I understood the issue fully: Assuming both parties have the "show security warnings" setting enabled and take it seriously, but ignore the lack
by tgsovlerkhgsel 10y ago
I'm not sure if I understood the issue fully: Assuming both parties have the "show security warnings" setting enabled and take it seriously, but ignore the lack of "message delivered" checkmarks, can the attacker snoop on one message or multiple ones?
As soon as the message is delivered it cannot be resent anymore, but could the attacker refuse to provide the delivery confirmations, then perform the attack (getting all messages that weren't yet marked as delivered, potentially over a large timeframe, while also showing the warning)? If so, I'd say it is a thing to worry about.
A smart attacker could wait until one party is switching phones, so that the warning is not considered suspicious, and since they could swap the new-correct key in immediately afterwards, users would be likely to dismiss the missing checkmarks and double key-change notification (at least before this news was published).
Also, for phone calls, WhatsApp only shows the warning after the call.
I don't believe these are backdoors, but I'm surprised WhatsApp isn't taking it more seriously and trying to address it.