19 ms·

WhatsApp Encryption Security Flaws Could Allow Snoops to Slide into Group Chats

362 points by uptown 9y ago

myaccountzz 9y ago
Interesting, I remember when Moxie said: "Pavel Durov wants to frame privacy as a question of trust"[1] Looks like that's what WhatsApp has now arrived at. [1] https://techcrunch.com/2017/09/18/signal-moxie-marlinspike-techcrunch-disrupt-sf-2017-telegram/ https://techcrunch.com/2017/09/18/signal-moxie-marlinspike-t...
woliveirajr 9y ago
> They say that anyone who controls WhatsApp's servers could effortlessly insert new people into an otherwise private group, even without the permission of the administrator who ostensibly controls access to that conversation. Given that WhatsApp isn't open source and so on, controling the WhatsApp server, or controling some part of its code, or controling the signing keys, all can compromise the privacy and encryption. This study shouldn't cause much surprise.
- cup-of-tea 9y ago
  Honestly, I think half of the security community just gave up and accepted that WhatsApp is probably the best we're going to get.
  - kbart 9y ago
    I don't know anybody in security community who would prefer WhatsApp over Signal. Of course, my sample is limited.
    - 659087 9y ago
      While I still trust Signal more than whatsapp, Moxie's "you can definitely trust Facebook" PR tour left me wondering if he had been compromised in some way.
      - nickik 9y ago
        > "PR tour" What PR tour? All that I remember was that he helped with the implementation and that they have a functioning system that they consider correct. I think he and everybody else knows the limits of the security model of WhatsApp. Just because they have a working setup, does not mean they are actually using it, or have not changed it without his knowledge. His assertion was simply that WhatsApp was capable of offering the same service as Signal. This is from memory, but I don't remember any 'PR tour'.
    - gcthomas 9y ago
      Like others, I specifically picked Signal over WhatsApp due to the problem of trusting proprietary apps. I think that the UK Govt Ministers that use WhatsApp to coordinate their actions should switch to whatever GCHQ recommends for givt business – I'm sure that they haven't approved WhatsApp.
    - tptacek 9y ago
      I talk to more cryptographers over WhatsApp than Signal.
      - kbart 9y ago
        I'm sure your sample is bigger than mine, so maybe that's a regional thing (I'm in Europe)? Did you notice some trends?
        tptacek 9y ago
        Just that WhatsApp can be more reliable than Signal.
    - cup-of-tea 9y ago
      It doesn't matter about preference. Many security people will tell you "WhatsApp is encrypted" as if that makes it secure. My feeling is that rather than deriding it as the false sense of security that it is, the community prefer to trust its claims and believe that it's secure.
      - nickik 9y ago
        Yes many security will tell you "WhatsApp is encrpyted" and that is true, and it is simply your assertion that this implies that they believe it is secure. But its not just a false sense of security. Yes, everybody that understands security will have issues with all the problems all of us know that exists. That however does not change that for user there was a real increase in security. I would rather say it is rather disingenuous for you to claim that it is all false security just because it is not what you would consider perfect.
        cup-of-tea 9y ago
        > it is not what you would consider perfect. And that is exactly what I mean by security people giving up. Twenty years ago what I think is perfect was merely the norm. Now WhatsApp is OK and it's just me who doesn't consider it perfect.
        UncleMeat 9y ago
        Best I can tell, people are still publishing papers on messaging. For example, this very paper published in RWC. Where have people given up?
        nickik 9y ago
        Pretty arrogant of you. I was just at a confrence where new more secure communications was one of the topics and there are many people working on new apps, improved protocols and working on figuring out flaws in existing products. Everybody there understands the security constraints of Whatsapp, and believe me they can hardly shut up about it.
    - CommentCard 9y ago
      Signal has the perception of being more secure simply because it isn't owned by Facebook. I will never trust a Facebook server with private messages, despite both Signal and WhatsApp having the same security features on paper.
      - reitanqild 9y ago
        Same with me. I refuse to think Mark Zuckerberg * bought it for north of USD10Bn * made it free * stopped all other monetization efforts (paid api gateways etc) just to provide free messaging service to everyone. I have two explanations: * either he felt it was a threat to his future messenging monopoly or * (and this is already not a secret anymore) they wanted to feed the data into their already huge tracking and ad serving network. Both of those are good enough reasons for me to leave as I care about healthy competition and my future privacy. But maybe the biggest reason why is because they lied to me: they promised to be the service that provided a good messaging service in exchange for a modest fee. They were profitable and yet sold out.
        kbart 9y ago
        Another possibility is that Zuckerberg's plans were destroyed (or at least delayed) by EU ruling[0], so he didn't get what actually expected. 0. https://www.theguardian.com/business/2017/may/18/facebook-fined-eu-whatsapp-european-commission https://www.theguardian.com/business/2017/may/18/facebook-fi...
        reitanqild 9y ago
        ? You mean you agree he had an evil plan and it was thwarted?
        kbart 9y ago
        "An evil plan" might be a bit of an exaggeration, but I think he might have expected more (read more private data or ad push) from WhatsApp users than he currently can get. Of course, that's just speculation, but as you've originally mentioned, it makes no business sense for Facebook to maintain a free messaging app with no strings attached.
    - TheChaplain 9y ago
      But that in itself is also a problem, because people outside the security community does not like Signal. I've tried so many times to convert people, but every non-security person prefer LINE, WhatsApp and Telegram. The reasons are simple; they are fun to use, good user experience and the most important one "my friends use it".
      - kbart 9y ago
        Yes, "my friends use it" argument greatly impedes switching to another app, even though it is better. Anyway, slowly, but surely I expand my circle of Signal users. Current version of Signal is actually quite polished, at least not worse than WhatsApp was the last time I used it (before acquisition by Facebook), and I rarely hear complaints about usability anymore from people who have actually tried it.
        Outpox 9y ago
        I'm trying to push Keybase within my friend group. I've yet to try Signal.
        Jtsummers 9y ago
        Ditto, but you'll have more luck with Signal. They'll see the value of it more quickly. I'm currently trying to get 3 people to use Keybase. My girlfriend/fiancee: Lives in another country, we're sharing data involving PII to deal with immigration stuffs. My sister: We have a side project and I'd like to use the team based, private git repos. A colleague: Same as sister, plus he's generally interested in privacy/security. And it's still been like pulling teeth to get him to do it.
      - vitro 9y ago
        Yes, in Signal you for example still cannot share one photo to multiple recipients or share multiple photos. I've installed it to all my relatives and they use it anyway, just those simple things would make it a bit better for your average "share pictures of my kids" types of use.
- air 9y ago
  You can inspect the WhatsApp binary and prevent updates. Having to trust the server is a big deal.
  - FabHK 9y ago
    And that's indeed the point of end-to-end encryption: that you don't have to trust the server.
    - UncleMeat 9y ago
      You still trust the server, unless the encryption is done with code that wasn't delivered from the server. E2E prevents your content from being stolen in a data breach or from being accessed if the server was fine when you sent a message but compromised later.
      - FabHK 9y ago
        Good point. The (variously named) security code should allow you to withdraw even that trust (assuming you verify the security code and the binary on your client...), right. Or does it? If the server knows the secret, it can invisibly MITM you, right?
    - Spivak 9y ago
      Unless you're independently verifying the keys in meatspace you're still trusting the server.
  - anfedorov 9y ago
    How easy is this, in practice? Has anyone inspected the WhatsApp binary? How much of it?
    - willstrafach 9y ago
      I have. It is a pain in the ass but certainly doable. I am experienced with iOS, but honestly it is a big app so those who are familiar with Android could do this better, as I believe they actually have decompilers versus needing to read the compiled ARM code.
- deleted 9y ago
  [deleted]
- gcb0 9y ago
  but the fact that it causes surprise causes me surprise, even though it shouldn't by the same reasons you exposed.
- pbalau 9y ago
  I just want to point out that WhatsApp controls the WhatsApp's client, so who the fuck cares about the server?
- dingo_bat 9y ago
  Exactly. Whatsapp "saying" they use e2e encryption itself is a suspicious thing. I don't know what algorithms they are using. I don't know they're not taking fucking screenshots of the chat messages and piping them to Zuckerberg's personal machine. Talking about encryption in a closed source app in istore or android play (which don't allow you to even verify binaries yourself) is just like discussing how well the infotainment system works on a flight with a burning jet engine.
StavrosK 9y ago
Hmm, this is interesting. I would expect that members would at least have some sort of room key (or at least signed assertion) that they would need to send to a new member, to ensure that the server couldn't unilaterally add participants.
- baby 9y ago
  They don’t but this can easily be fixed by having the admin send a special encrypted message to the group as proof that someone was added/removed.
  - StavrosK 9y ago
    A malicious server admin would probably be able to just intercept and stop that. I don't know how they do group encryption, but I imagine they either have a room key (although with forward secrecy that sounds unlikely) or they do 1:M sending. In any case, it sounds that, since the server doesn't have the group chat keys, they could just check for authorization from the admin (ie a signed message verifying that they're the ones adding the user) before adding a new user to the chat.
    - baby 9y ago
      > A malicious server admin would probably be able to just intercept and stop that Which would stop anyone from being invited to the group > or they do 1:M sending That's what they do. When you join a group you generate a key that you distribute to all the other participants via a 1-on-1 encrypted session, you then use it to derive keys in a normal chaining-key thingy to encrypt messages to all other participants. > they could just check for authorization from the admin So you mean the admin would be in on it?
      - StavrosK 9y ago
        > Which would stop anyone from being invited to the group No, just the malicious server adding the malicious user. > So you mean the admin would be in on it? I mean WhatsApp could patch this attack vector by requiring the new member to get a signed assertion from the group admin, proving to the other members that the group admin was the person who added the user.
skrebbel 9y ago
Even if this is true, don't forget that in WhatsApp you don't get the message history when you join a group. Plus, everybody sees that someone joined. That doesn't take the problem away, but it makes the impact much smaller than it sounds.
- eqtn 9y ago
  "everybody sees that someone joined" i can see that xxx has joined. Is the message coming from server or client? If it is from the server, then the attacker could block that message right?
  - baby 9y ago
    I have looked at such implementations but don’t know you about whatsapp specifically: you will see the notification no matter what. This makes this attack not really an attack. Sure the servers can modify the participant list but everyone will see it and everyone will choose to write to the new group chat willingly. When someone joins/leaves the group every participant generates and distribute a new key. So as a rogue participant, the keys you’ll receive won’t allow you to decrypt past messages. PS: this article was posted before the speaker was even done with his talk. This is funny?
    - nebulous1 9y ago
      I don't see how you're arguing that this isn't an attack. However, it's clear that the severity will depend on the particular group. A group of three friends will certainly notice when someone is added to the membership. A larger group of people who don't know each other personally but trust the administrator to administer membership will have to rely on the admin both noticing and taking action, and he may be hampered in doing so by the attacker.
      - baby 9y ago
        It's just a UX failure more than an attack imo. If you're paranoid you will for sure see that someone has been added to the group. If you don't care well...
danielmg 9y ago
"Flaw"
joannexxx 9y ago
interesting post! But only the idea is kind of creepy... Anyways, if someone new enters the group this person is usually not able to see all the previous posts...
- jwilk 9y ago
  "Usually"?
  - jkmangang 9y ago
    Not usually, it never allowed to see the message history.
    - joannexxx 9y ago
      yes you can never see the old messages
gruez 9y ago
how do other apps prevent this? short of everybody in the group manually adding the new participant's key, I don't see why this flaw can't be replicated in other chat apps
- FabHK 9y ago
  From looking at the paper [1], the basic mitigation seems to be that the group admin that adds someone to the group sends the "add this account to the group" message to all group members end-to-end encrypted. In Signal, apparently some malicious users that are not a group member (such as a former group member) could add users to a group. In Threema and WhatsApp, a malicious server can add further users, but Threema has apparently fixed that already. [1] https://eprint.iacr.org/2017/713.pdf https://eprint.iacr.org/2017/713.pdf
  - dbrgn 9y ago
    Not 100%. In Threema, a malicious server could replay an old add-this-user message after that user has been removed from the group to re-add it to the group. But it could never add new users (since add messages are encrypted by the admin). Also, the server can't tell group control messages from regular text messages, making this even harder. Replay protection has been added in the meantime.
- contravariant 9y ago
  Requiring new participants to have an invitation signed by the administrators private key seems like it would prevent this.
snvzz 9y ago
That anybody uses these proprietary "chat apps" for anything baffles me.
- roywiggins 9y ago
  What else are you supposed to use to communicate on a phone? Unauthenticated cleartext SMS?
  - snvzz 9y ago
    Some chat system that isn't an "app", but rather, where the "app" is just an open source client for a documented, reasonably secure system. EFF's recommendation list is being remade: https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard But the old one is still reachable from it. WhatsApp is the one that got bought by facebook, which should be a red flag for those sensible.
    - mrstone 9y ago
      What do you use?
    - blackoil 9y ago
      >How to use WhatsApp on Android or iOS. From the EFF page you have linked. :D
      - snvzz 9y ago
        EFF recommending Facebook for IM? I want my donations back.
williamscales 9y ago
This was a deliberate design decision by WhatsApp. I even remember going to a talk by a WhatsApp engineer when they announced end-to-end encryption and he spent a fair amount of time detailing the method WhatsApp had implemented to allow for adding new users to groups while allowing these new users to read old messages. So I'm pretty sure this has been known from the start. Don't use Facebook products if you care about real security.
- jkmangang 9y ago
  Whatsapp never allowed new users to read message history. Never!
cntlzw 9y ago
So the problem is WhatsApp servers can add people to groups? I don't want to be a cynic but aren't groups per se stored on a centralised server? Or the definition of a group at least. So this isn't much of a surprise?
- nebulous1 9y ago
  No. Cynic or not, I'm unsure why you're assuming the entire research results made no sense! The administrator of a group should sign the "add member" messages, and group members should only believe that a member has joined if they have such a signed message authorizing the member. You are correct in so far as this is apparently not what happens at the moment.
- baby 9y ago
  Yeah I’m with you on that but mostly because I’ve grew up on shitty chat apps that would allow glitches and wouldn’t handle participants correctly. For example in MSN you could write as the other person in a 1-to-1 chat. The first time someone did that to me I unpluged the ethernet cord from my computer. Anyway these are small issues because the attack still doesn’t reveal any messages to the attacker. These are more about UI/UX issues.
- dbrgn 9y ago
  Apps like Threema manage groups entirely on the client. Group messages are sent to every member separately. The server doesn't know what groups you have created, or who's in them. This comes with some usability tradeoffs of course. But it's possible.
deleted 9y ago
[deleted]
brndnmtthws 9y ago
The most interesting part of this (to me at least) is that even our 'secure' messaging systems rely entirely on trusted entities. I don't think Signal is immune to this problem either, as you still need to communicate with their servers. As a distributed trust system, WhatsApp and Signal are single points of failure. Messaging is analogous to money in a lot of ways. Perhaps we'll see a good distributed peer to peer messaging protocol at some point in the future.
- craftyguy 9y ago
  > Perhaps we'll see a good distributed peer to peer messaging protocol at some point in the future. The Matrix protocol is actually fairly promising, as long as you only use it for Matrix<->Matrix communication. Things fall to pieces when you try to bridge it with IRC. It's certainly more user-friendly for non-tech. folks than, say, the awkward key exchange/setups of XMPP clients, but it's still a far cry from something like Signal in terms of 'ease of use'
  - Shoothe 9y ago
    > awkward key exchange/setups of XMPP clients What do you mean by that? Conversations.im establishes e2e secure session without any fingerprint approving interaction whatsoever. Of course you can manually scan barcodes for paranoid mode but that's not necessary. For me it's a perfect balance between convenience and security. Read more at https://gultsch.de/trust.html https://gultsch.de/trust.html
    - craftyguy 9y ago
      Hmm, I'll check this out, thanks. I was mainly speaking to previous experiences trying to set up Conversations on one device, Pidgin on another, there not being any good way to use a consistent key for my user on both, and trying to walk non-technical family members through that fiasco. This was about 2 years ago, maybe the situation has improved!
      - upofadown 9y ago
excalibur 9y ago
I don't get why people even consider using WhatsApp for secure messaging. Everybody knows it's owned by Facebook, and everybody knows how they operate.
- praneshp 9y ago
  > and everybody knows how they operate. Yep! Painless to use, and truly cross platform. WhatsApp operates like a charm.
  - dingo_bat 9y ago
    As much as I hate facebook, their social messaging products (IG, messenger, whatsapp) are top-notch, truly a cut above anything else.
EGreg 9y ago
"If you build a system where everything comes down to trusting the server, you might as well dispense with all the complexity and forget about end-to-end encryption," says Matthew Green, a cryptography professor at Johns Hopkins University who reviewed the Ruhr University researchers' work. "It's just a total screwup. There's no excuse." Someone was asking about blockchains. THIS is why you use blockchains. So you don't trust just the server. Actually everything on the Web trusts the server. That's just how the Web was designed. Now, one way to mitigate this - and also improve security in open source projects - is to implement a blockchain hosted by many organizations which can't all be compromised easily. At Qbix, we are working on a drop-in data structure that would implement arbitrary business rules in a secure way. The nice thing is you don't need everyone to adopt it, for it to help you secure your network. For example, some guy starts a group so he has all the access and privileges, and he uses them to invite others and assign privileges. Then he repudiates his own privileges in the group. Now everyone can verify and be SURE that everyone has the same privileges - rules are added for different types of Messages posted on the Stream and are are enforced by the blockchain. That is how you do governance. It ain't easy but there can be packages made, of different governance types. PS: However when you have end-to-end encryption, you don't need the blockchain to be hosted on servers. You can have the server relay messages between clients and enforce rules on the clients. If you don't need consensus, sometimes you don't even need a blockchain! For example, with Reddit, you can just have an append-only Merkle Tree and have clients pass each other comments. But what if you wanted to expand more comments? Do you have read permission? Do you have write permission? One way to do it is on a per-thread basis. Each thread is owned by its OP. The rules are enforced by the OP and the messages are published by the OP. So then you trust the OP to be available (online) and accept and broadcast your reply etc. But if you have MORE THAN ONE user involved in governance of a Stream (our terminology) then you need a blockchain. At the very least, to verify there are no malicious forks of a stream. If you want to find out more you can look in my profile (about) and email me.
axau 9y ago
Hah! Meanwhile in Facebook group chats, anyone can add anyone, and they get to see the whole conversation history immediately and completely irrevocably (even if someone removes them later, they get to keep the history until their removal, and you can’t delete Facebook messages either).
mkagenius 9y ago
In case someone is wondering the unique group link is of length 22. Made of A-Z|a-z|0-9 . You can also refresh a link, there isn't any limit on number of refreshes it seems but won't be able to reach 62^22.
moxie 9y ago
Here's how WhatsApp group messaging works: membership is maintained by the server. Clients of a group retrieve membership from the server, and clients encrypt all messages they send e2e to all group members. If someone hacks the WhatsApp server, they can obviously alter the group membership. If they add themselves to the group: 1. The attacker will not see any past messages to the group; those were e2e encrypted with keys the attacker doesn't have. 2. All group members will see that the attacker has joined. There is no way to suppress this message. Given the alternatives, I think that's a pretty reasonable design decision, and I think this headline pretty substantially mischaracterizes the situation. I think it would be better if the server didn't have metadata visibility into group membership, but that's a largely unsolved problem, and it's unrelated to confidentiality of group messages. In contrast, Telegram does no encryption at all for group messages, even though it advertises itself as an encrypted messenger, and even though Telegram users think that group chats are somehow secure. An attacker who compromises the Telegram server can, undetected, recover every message that was sent in the past and receive all messages transmitted in the future without anyone receiving any notification at all. There's no way to publish an academic paper about that, though, because there's no "attack" to describe, because there's no encryption to begin with. Without a paper there will be no talks at conferences, which means there will be no inflammatory headlines like this one. To me, this article reads as a better example of the problems with the security industry and the way security research is done today, because I think the lesson to anyone watching is clear: don't build security into your products, because that makes you a target for researchers, even if you make the right decisions, and regardless of whether their research is practically important or not. It's much more effective to be Telegram: just leave cryptography out of everything, except for your marketing.
- freeflight 9y ago
  > There's no way to publish an academic paper about that, though, because there's no "attack" to describe, because there's no encryption to begin with. Then why does the Telegram faq state that there's "server-client encryption" for group chats? [0] "Secret Chats" supposedly even uses e2e encryption [1] Note: Never used Telegram (Signal does the job for me, thank you!), I'm no coder, but your comment makes me wonder if I'm missing something here? [0] https://telegram.org/faq#q-so-how-do-you-encrypt-data https://telegram.org/faq#q-so-how-do-you-encrypt-data [1] https://core.telegram.org/api/end-to-end https://core.telegram.org/api/end-to-end
satyanash 9y ago
WhatsApp has some decent decisions even after the complexity of being tied down to a single device at a time. WhatsApp Web is essentially a hack where any message you send through the web app is _always_ routed through your phone (which is why it needs to be connected all the time). Earlier you could not even view the media on the web client without first downloading it on your phone. But now it looks like they've hacked it further such that you can view the E2E encrypted message on the web app without downloading it to your phone. I guess it achieves this via shipping the decryption key to the web app (just for the current session) where it allows it to decrypt messages in the browser and using the phone just as a router of sorts. This is just speculation based on apparent behavior though.
draggnar 9y ago
If you are using WhatsApp, make sure you deactivate your account if you change phone numbers. I recently got a new phone number and when I logged in, I assumed a non-deactivated profile previously attached to my new number.
pelasaco 9y ago
I was like, ok sounds like FUD for me, but reading what moxie said, helped me to be sure: FUD for click baiting
Buttes8 9y ago
This is a big nothing burger, you could practically infer the design from the fact that they supported encrypted group chats at all. Very sensible design IMO.
dmitrygr 9y ago
Potential solution: all participants will only start sending new messages to new participant/key if his "joined" message was signed by chat administrator (which they can verify). Server cannot fake this sig as it does not have administrator's key.
rajeshbagti 9y ago
Rajeshbagti

362 points by uptown 9y ago

Interesting, I remember when Moxie said: "Pavel Durov wants to frame privacy as a question of trust"[1] Looks like that's what WhatsApp has now arrived at. [1] https://techcrunch.com/2017/09/18/signal-moxie-marlinspike-techcrunch-disrupt-sf-2017-telegram/ https://techcrunch.com/2017/09/18/signal-moxie-marlinspike-t...

woliveirajr 9y ago

> They say that anyone who controls WhatsApp's servers could effortlessly insert new people into an otherwise private group, even without the permission of the administrator who ostensibly controls access to that conversation. Given that WhatsApp isn't open source and so on, controling the WhatsApp server, or controling some part of its code, or controling the signing keys, all can compromise the privacy and encryption. This study shouldn't cause much surprise.

cup-of-tea 9y ago
Honestly, I think half of the security community just gave up and accepted that WhatsApp is probably the best we're going to get.
- kbart 9y ago
  I don't know anybody in security community who would prefer WhatsApp over Signal. Of course, my sample is limited.
  - 659087 9y ago
    While I still trust Signal more than whatsapp, Moxie's "you can definitely trust Facebook" PR tour left me wondering if he had been compromised in some way.
    - nickik 9y ago
      > "PR tour" What PR tour? All that I remember was that he helped with the implementation and that they have a functioning system that they consider correct. I think he and everybody else knows the limits of the security model of WhatsApp. Just because they have a working setup, does not mean they are actually using it, or have not changed it without his knowledge. His assertion was simply that WhatsApp was capable of offering the same service as Signal. This is from memory, but I don't remember any 'PR tour'.
  - gcthomas 9y ago
    Like others, I specifically picked Signal over WhatsApp due to the problem of trusting proprietary apps. I think that the UK Govt Ministers that use WhatsApp to coordinate their actions should switch to whatever GCHQ recommends for givt business – I'm sure that they haven't approved WhatsApp.
  - tptacek 9y ago
    I talk to more cryptographers over WhatsApp than Signal.
    - kbart 9y ago
      I'm sure your sample is bigger than mine, so maybe that's a regional thing (I'm in Europe)? Did you notice some trends?
      - tptacek 9y ago
        Just that WhatsApp can be more reliable than Signal.
  - cup-of-tea 9y ago
    It doesn't matter about preference. Many security people will tell you "WhatsApp is encrypted" as if that makes it secure. My feeling is that rather than deriding it as the false sense of security that it is, the community prefer to trust its claims and believe that it's secure.
    - nickik 9y ago
      Yes many security will tell you "WhatsApp is encrpyted" and that is true, and it is simply your assertion that this implies that they believe it is secure. But its not just a false sense of security. Yes, everybody that understands security will have issues with all the problems all of us know that exists. That however does not change that for user there was a real increase in security. I would rather say it is rather disingenuous for you to claim that it is all false security just because it is not what you would consider perfect.
      - cup-of-tea 9y ago
        > it is not what you would consider perfect. And that is exactly what I mean by security people giving up. Twenty years ago what I think is perfect was merely the norm. Now WhatsApp is OK and it's just me who doesn't consider it perfect.
        UncleMeat 9y ago
        Best I can tell, people are still publishing papers on messaging. For example, this very paper published in RWC. Where have people given up?
        nickik 9y ago
        Pretty arrogant of you. I was just at a confrence where new more secure communications was one of the topics and there are many people working on new apps, improved protocols and working on figuring out flaws in existing products. Everybody there understands the security constraints of Whatsapp, and believe me they can hardly shut up about it.
  - CommentCard 9y ago
    Signal has the perception of being more secure simply because it isn't owned by Facebook. I will never trust a Facebook server with private messages, despite both Signal and WhatsApp having the same security features on paper.
    - reitanqild 9y ago
      Same with me. I refuse to think Mark Zuckerberg * bought it for north of USD10Bn * made it free * stopped all other monetization efforts (paid api gateways etc) just to provide free messaging service to everyone. I have two explanations: * either he felt it was a threat to his future messenging monopoly or * (and this is already not a secret anymore) they wanted to feed the data into their already huge tracking and ad serving network. Both of those are good enough reasons for me to leave as I care about healthy competition and my future privacy. But maybe the biggest reason why is because they lied to me: they promised to be the service that provided a good messaging service in exchange for a modest fee. They were profitable and yet sold out.
      - kbart 9y ago
        Another possibility is that Zuckerberg's plans were destroyed (or at least delayed) by EU ruling[0], so he didn't get what actually expected. 0. https://www.theguardian.com/business/2017/may/18/facebook-fined-eu-whatsapp-european-commission https://www.theguardian.com/business/2017/may/18/facebook-fi...
        reitanqild 9y ago
        ? You mean you agree he had an evil plan and it was thwarted?
        kbart 9y ago
        "An evil plan" might be a bit of an exaggeration, but I think he might have expected more (read more private data or ad push) from WhatsApp users than he currently can get. Of course, that's just speculation, but as you've originally mentioned, it makes no business sense for Facebook to maintain a free messaging app with no strings attached.
  - TheChaplain 9y ago
    But that in itself is also a problem, because people outside the security community does not like Signal. I've tried so many times to convert people, but every non-security person prefer LINE, WhatsApp and Telegram. The reasons are simple; they are fun to use, good user experience and the most important one "my friends use it".
    - kbart 9y ago
      Yes, "my friends use it" argument greatly impedes switching to another app, even though it is better. Anyway, slowly, but surely I expand my circle of Signal users. Current version of Signal is actually quite polished, at least not worse than WhatsApp was the last time I used it (before acquisition by Facebook), and I rarely hear complaints about usability anymore from people who have actually tried it.
      - Outpox 9y ago
        I'm trying to push Keybase within my friend group. I've yet to try Signal.
        Jtsummers 9y ago
        Ditto, but you'll have more luck with Signal. They'll see the value of it more quickly. I'm currently trying to get 3 people to use Keybase. My girlfriend/fiancee: Lives in another country, we're sharing data involving PII to deal with immigration stuffs. My sister: We have a side project and I'd like to use the team based, private git repos. A colleague: Same as sister, plus he's generally interested in privacy/security. And it's still been like pulling teeth to get him to do it.
    - vitro 9y ago
      Yes, in Signal you for example still cannot share one photo to multiple recipients or share multiple photos. I've installed it to all my relatives and they use it anyway, just those simple things would make it a bit better for your average "share pictures of my kids" types of use.
air 9y ago
You can inspect the WhatsApp binary and prevent updates. Having to trust the server is a big deal.
- FabHK 9y ago
  And that's indeed the point of end-to-end encryption: that you don't have to trust the server.
  - UncleMeat 9y ago
    You still trust the server, unless the encryption is done with code that wasn't delivered from the server. E2E prevents your content from being stolen in a data breach or from being accessed if the server was fine when you sent a message but compromised later.
    - FabHK 9y ago
      Good point. The (variously named) security code should allow you to withdraw even that trust (assuming you verify the security code and the binary on your client...), right. Or does it? If the server knows the secret, it can invisibly MITM you, right?
  - Spivak 9y ago
    Unless you're independently verifying the keys in meatspace you're still trusting the server.
- anfedorov 9y ago
  How easy is this, in practice? Has anyone inspected the WhatsApp binary? How much of it?
  - willstrafach 9y ago
    I have. It is a pain in the ass but certainly doable. I am experienced with iOS, but honestly it is a big app so those who are familiar with Android could do this better, as I believe they actually have decompilers versus needing to read the compiled ARM code.
deleted 9y ago
[deleted]
gcb0 9y ago
but the fact that it causes surprise causes me surprise, even though it shouldn't by the same reasons you exposed.
pbalau 9y ago
I just want to point out that WhatsApp controls the WhatsApp's client, so who the fuck cares about the server?
dingo_bat 9y ago
Exactly. Whatsapp "saying" they use e2e encryption itself is a suspicious thing. I don't know what algorithms they are using. I don't know they're not taking fucking screenshots of the chat messages and piping them to Zuckerberg's personal machine. Talking about encryption in a closed source app in istore or android play (which don't allow you to even verify binaries yourself) is just like discussing how well the infotainment system works on a flight with a burning jet engine.

StavrosK 9y ago

Hmm, this is interesting. I would expect that members would at least have some sort of room key (or at least signed assertion) that they would need to send to a new member, to ensure that the server couldn't unilaterally add participants.

baby 9y ago
They don’t but this can easily be fixed by having the admin send a special encrypted message to the group as proof that someone was added/removed.
- StavrosK 9y ago
  A malicious server admin would probably be able to just intercept and stop that. I don't know how they do group encryption, but I imagine they either have a room key (although with forward secrecy that sounds unlikely) or they do 1:M sending. In any case, it sounds that, since the server doesn't have the group chat keys, they could just check for authorization from the admin (ie a signed message verifying that they're the ones adding the user) before adding a new user to the chat.
  - baby 9y ago
    > A malicious server admin would probably be able to just intercept and stop that Which would stop anyone from being invited to the group > or they do 1:M sending That's what they do. When you join a group you generate a key that you distribute to all the other participants via a 1-on-1 encrypted session, you then use it to derive keys in a normal chaining-key thingy to encrypt messages to all other participants. > they could just check for authorization from the admin So you mean the admin would be in on it?
    - StavrosK 9y ago
      > Which would stop anyone from being invited to the group No, just the malicious server adding the malicious user. > So you mean the admin would be in on it? I mean WhatsApp could patch this attack vector by requiring the new member to get a signed assertion from the group admin, proving to the other members that the group admin was the person who added the user.

skrebbel 9y ago

Even if this is true, don't forget that in WhatsApp you don't get the message history when you join a group. Plus, everybody sees that someone joined. That doesn't take the problem away, but it makes the impact much smaller than it sounds.

eqtn 9y ago
"everybody sees that someone joined" i can see that xxx has joined. Is the message coming from server or client? If it is from the server, then the attacker could block that message right?
- baby 9y ago
  I have looked at such implementations but don’t know you about whatsapp specifically: you will see the notification no matter what. This makes this attack not really an attack. Sure the servers can modify the participant list but everyone will see it and everyone will choose to write to the new group chat willingly. When someone joins/leaves the group every participant generates and distribute a new key. So as a rogue participant, the keys you’ll receive won’t allow you to decrypt past messages. PS: this article was posted before the speaker was even done with his talk. This is funny?
  - nebulous1 9y ago
    I don't see how you're arguing that this isn't an attack. However, it's clear that the severity will depend on the particular group. A group of three friends will certainly notice when someone is added to the membership. A larger group of people who don't know each other personally but trust the administrator to administer membership will have to rely on the admin both noticing and taking action, and he may be hampered in doing so by the attacker.
    - baby 9y ago
      It's just a UX failure more than an attack imo. If you're paranoid you will for sure see that someone has been added to the group. If you don't care well...

danielmg 9y ago

"Flaw"

joannexxx 9y ago

interesting post! But only the idea is kind of creepy... Anyways, if someone new enters the group this person is usually not able to see all the previous posts...

jwilk 9y ago
"Usually"?
- jkmangang 9y ago
  Not usually, it never allowed to see the message history.
  - joannexxx 9y ago
    yes you can never see the old messages

gruez 9y ago

how do other apps prevent this? short of everybody in the group manually adding the new participant's key, I don't see why this flaw can't be replicated in other chat apps

FabHK 9y ago
From looking at the paper [1], the basic mitigation seems to be that the group admin that adds someone to the group sends the "add this account to the group" message to all group members end-to-end encrypted. In Signal, apparently some malicious users that are not a group member (such as a former group member) could add users to a group. In Threema and WhatsApp, a malicious server can add further users, but Threema has apparently fixed that already. [1] https://eprint.iacr.org/2017/713.pdf https://eprint.iacr.org/2017/713.pdf
- dbrgn 9y ago
  Not 100%. In Threema, a malicious server could replay an old add-this-user message after that user has been removed from the group to re-add it to the group. But it could never add new users (since add messages are encrypted by the admin). Also, the server can't tell group control messages from regular text messages, making this even harder. Replay protection has been added in the meantime.
contravariant 9y ago
Requiring new participants to have an invitation signed by the administrators private key seems like it would prevent this.

snvzz 9y ago

That anybody uses these proprietary "chat apps" for anything baffles me.

roywiggins 9y ago
What else are you supposed to use to communicate on a phone? Unauthenticated cleartext SMS?
- snvzz 9y ago
  Some chat system that isn't an "app", but rather, where the "app" is just an open source client for a documented, reasonably secure system. EFF's recommendation list is being remade: https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard But the old one is still reachable from it. WhatsApp is the one that got bought by facebook, which should be a red flag for those sensible.
  - mrstone 9y ago
    What do you use?
  - blackoil 9y ago
    >How to use WhatsApp on Android or iOS. From the EFF page you have linked. :D
    - snvzz 9y ago
      EFF recommending Facebook for IM? I want my donations back.

williamscales 9y ago

This was a deliberate design decision by WhatsApp. I even remember going to a talk by a WhatsApp engineer when they announced end-to-end encryption and he spent a fair amount of time detailing the method WhatsApp had implemented to allow for adding new users to groups while allowing these new users to read old messages. So I'm pretty sure this has been known from the start. Don't use Facebook products if you care about real security.

jkmangang 9y ago
Whatsapp never allowed new users to read message history. Never!

cntlzw 9y ago

So the problem is WhatsApp servers can add people to groups? I don't want to be a cynic but aren't groups per se stored on a centralised server? Or the definition of a group at least. So this isn't much of a surprise?

nebulous1 9y ago
No. Cynic or not, I'm unsure why you're assuming the entire research results made no sense! The administrator of a group should sign the "add member" messages, and group members should only believe that a member has joined if they have such a signed message authorizing the member. You are correct in so far as this is apparently not what happens at the moment.
baby 9y ago
Yeah I’m with you on that but mostly because I’ve grew up on shitty chat apps that would allow glitches and wouldn’t handle participants correctly. For example in MSN you could write as the other person in a 1-to-1 chat. The first time someone did that to me I unpluged the ethernet cord from my computer. Anyway these are small issues because the attack still doesn’t reveal any messages to the attacker. These are more about UI/UX issues.
dbrgn 9y ago
Apps like Threema manage groups entirely on the client. Group messages are sent to every member separately. The server doesn't know what groups you have created, or who's in them. This comes with some usability tradeoffs of course. But it's possible.

deleted 9y ago

[deleted]

brndnmtthws 9y ago

The most interesting part of this (to me at least) is that even our 'secure' messaging systems rely entirely on trusted entities. I don't think Signal is immune to this problem either, as you still need to communicate with their servers. As a distributed trust system, WhatsApp and Signal are single points of failure. Messaging is analogous to money in a lot of ways. Perhaps we'll see a good distributed peer to peer messaging protocol at some point in the future.

craftyguy 9y ago
> Perhaps we'll see a good distributed peer to peer messaging protocol at some point in the future. The Matrix protocol is actually fairly promising, as long as you only use it for Matrix<->Matrix communication. Things fall to pieces when you try to bridge it with IRC. It's certainly more user-friendly for non-tech. folks than, say, the awkward key exchange/setups of XMPP clients, but it's still a far cry from something like Signal in terms of 'ease of use'
- Shoothe 9y ago
  > awkward key exchange/setups of XMPP clients What do you mean by that? Conversations.im establishes e2e secure session without any fingerprint approving interaction whatsoever. Of course you can manually scan barcodes for paranoid mode but that's not necessary. For me it's a perfect balance between convenience and security. Read more at https://gultsch.de/trust.html https://gultsch.de/trust.html
  - craftyguy 9y ago
    Hmm, I'll check this out, thanks. I was mainly speaking to previous experiences trying to set up Conversations on one device, Pidgin on another, there not being any good way to use a consistent key for my user on both, and trying to walk non-technical family members through that fiasco. This was about 2 years ago, maybe the situation has improved!
    - upofadown 9y ago

excalibur 9y ago

I don't get why people even consider using WhatsApp for secure messaging. Everybody knows it's owned by Facebook, and everybody knows how they operate.

praneshp 9y ago
> and everybody knows how they operate. Yep! Painless to use, and truly cross platform. WhatsApp operates like a charm.
- dingo_bat 9y ago
  As much as I hate facebook, their social messaging products (IG, messenger, whatsapp) are top-notch, truly a cut above anything else.

EGreg 9y ago

"If you build a system where everything comes down to trusting the server, you might as well dispense with all the complexity and forget about end-to-end encryption," says Matthew Green, a cryptography professor at Johns Hopkins University who reviewed the Ruhr University researchers' work. "It's just a total screwup. There's no excuse." Someone was asking about blockchains. THIS is why you use blockchains. So you don't trust just the server. Actually everything on the Web trusts the server. That's just how the Web was designed. Now, one way to mitigate this - and also improve security in open source projects - is to implement a blockchain hosted by many organizations which can't all be compromised easily. At Qbix, we are working on a drop-in data structure that would implement arbitrary business rules in a secure way. The nice thing is you don't need everyone to adopt it, for it to help you secure your network. For example, some guy starts a group so he has all the access and privileges, and he uses them to invite others and assign privileges. Then he repudiates his own privileges in the group. Now everyone can verify and be SURE that everyone has the same privileges - rules are added for different types of Messages posted on the Stream and are are enforced by the blockchain. That is how you do governance. It ain't easy but there can be packages made, of different governance types. PS: However when you have end-to-end encryption, you don't need the blockchain to be hosted on servers. You can have the server relay messages between clients and enforce rules on the clients. If you don't need consensus, sometimes you don't even need a blockchain! For example, with Reddit, you can just have an append-only Merkle Tree and have clients pass each other comments. But what if you wanted to expand more comments? Do you have read permission? Do you have write permission? One way to do it is on a per-thread basis. Each thread is owned by its OP. The rules are enforced by the OP and the messages are published by the OP. So then you trust the OP to be available (online) and accept and broadcast your reply etc. But if you have MORE THAN ONE user involved in governance of a Stream (our terminology) then you need a blockchain. At the very least, to verify there are no malicious forks of a stream. If you want to find out more you can look in my profile (about) and email me.

axau 9y ago

Hah! Meanwhile in Facebook group chats, anyone can add anyone, and they get to see the whole conversation history immediately and completely irrevocably (even if someone removes them later, they get to keep the history until their removal, and you can’t delete Facebook messages either).

mkagenius 9y ago

In case someone is wondering the unique group link is of length 22. Made of A-Z|a-z|0-9 . You can also refresh a link, there isn't any limit on number of refreshes it seems but won't be able to reach 62^22.

moxie 9y ago

Here's how WhatsApp group messaging works: membership is maintained by the server. Clients of a group retrieve membership from the server, and clients encrypt all messages they send e2e to all group members. If someone hacks the WhatsApp server, they can obviously alter the group membership. If they add themselves to the group: 1. The attacker will not see any past messages to the group; those were e2e encrypted with keys the attacker doesn't have. 2. All group members will see that the attacker has joined. There is no way to suppress this message. Given the alternatives, I think that's a pretty reasonable design decision, and I think this headline pretty substantially mischaracterizes the situation. I think it would be better if the server didn't have metadata visibility into group membership, but that's a largely unsolved problem, and it's unrelated to confidentiality of group messages. In contrast, Telegram does no encryption at all for group messages, even though it advertises itself as an encrypted messenger, and even though Telegram users think that group chats are somehow secure. An attacker who compromises the Telegram server can, undetected, recover every message that was sent in the past and receive all messages transmitted in the future without anyone receiving any notification at all. There's no way to publish an academic paper about that, though, because there's no "attack" to describe, because there's no encryption to begin with. Without a paper there will be no talks at conferences, which means there will be no inflammatory headlines like this one. To me, this article reads as a better example of the problems with the security industry and the way security research is done today, because I think the lesson to anyone watching is clear: don't build security into your products, because that makes you a target for researchers, even if you make the right decisions, and regardless of whether their research is practically important or not. It's much more effective to be Telegram: just leave cryptography out of everything, except for your marketing.

freeflight 9y ago
> There's no way to publish an academic paper about that, though, because there's no "attack" to describe, because there's no encryption to begin with. Then why does the Telegram faq state that there's "server-client encryption" for group chats? [0] "Secret Chats" supposedly even uses e2e encryption [1] Note: Never used Telegram (Signal does the job for me, thank you!), I'm no coder, but your comment makes me wonder if I'm missing something here? [0] https://telegram.org/faq#q-so-how-do-you-encrypt-data https://telegram.org/faq#q-so-how-do-you-encrypt-data [1] https://core.telegram.org/api/end-to-end https://core.telegram.org/api/end-to-end

satyanash 9y ago

WhatsApp has some decent decisions even after the complexity of being tied down to a single device at a time. WhatsApp Web is essentially a hack where any message you send through the web app is _always_ routed through your phone (which is why it needs to be connected all the time). Earlier you could not even view the media on the web client without first downloading it on your phone. But now it looks like they've hacked it further such that you can view the E2E encrypted message on the web app without downloading it to your phone. I guess it achieves this via shipping the decryption key to the web app (just for the current session) where it allows it to decrypt messages in the browser and using the phone just as a router of sorts. This is just speculation based on apparent behavior though.

draggnar 9y ago

If you are using WhatsApp, make sure you deactivate your account if you change phone numbers. I recently got a new phone number and when I logged in, I assumed a non-deactivated profile previously attached to my new number.

pelasaco 9y ago

I was like, ok sounds like FUD for me, but reading what moxie said, helped me to be sure: FUD for click baiting

Buttes8 9y ago

This is a big nothing burger, you could practically infer the design from the fact that they supported encrypted group chats at all. Very sensible design IMO.

dmitrygr 9y ago

Potential solution: all participants will only start sending new messages to new participant/key if his "joined" message was signed by chat administrator (which they can verify). Server cannot fake this sig as it does not have administrator's key.

rajeshbagti 9y ago

Rajeshbagti