5 ms·
Even if this is true, don't forget that in WhatsApp you don't get the message history when you join a group. Plus, everybody sees that someone joined. That does
by skrebbel 9y ago
Even if this is true, don't forget that in WhatsApp you don't get the message history when you join a group. Plus, everybody sees that someone joined. That doesn't take the problem away, but it makes the impact much smaller than it sounds.
- eqtn 9y ago"everybody sees that someone joined" i can see that xxx has joined. Is the message coming from server or client? If it is from the server, then the attacker could block that message right?
- baby 9y agoI have looked at such implementations but don’t know you about whatsapp specifically: you will see the notification no matter what. This makes this attack not really an attack. Sure the servers can modify the participant list but everyone will see it and everyone will choose to write to the new group chat willingly. When someone joins/leaves the group every participant generates and distribute a new key. So as a rogue participant, the keys you’ll receive won’t allow you to decrypt past messages. PS: this article was posted before the speaker was even done with his talk. This is funny?
- nebulous1 9y agoI don't see how you're arguing that this isn't an attack. However, it's clear that the severity will depend on the particular group. A group of three friends will certainly notice when someone is added to the membership. A larger group of people who don't know each other personally but trust the administrator to administer membership will have to rely on the admin both noticing and taking action, and he may be hampered in doing so by the attacker.
- baby 9y agoIt's just a UX failure more than an attack imo. If you're paranoid you will for sure see that someone has been added to the group. If you don't care well...
- nebulous1 9y agoIt's implied that that's generated by the client when it's going through the add member routine (exchanging keys etc).
- mikeokner 9y agoThat's coming from the client because the client has received a new public key with which to encrypt messages.
- titzer 9y ago> Plus, everybody sees that someone joined. The article states that admins can suppress messages, including the ones that report that someone has joined.
- exhilaration 9y agoWhatsapp disagrees, from the article: ...a WhatsApp spokesperson confirmed the researchers' findings, but emphasized that no one can secretly add a new member to a group—a notification does go through that a new, unknown member has joined the group.
- wsxcde 9y agoNo, the notification of a new member joining is always sent. Subsequent messages might be blocked.
- FabHK 9y agoOr, from what I gather, previous ones (given that the server is compromised) and then sent later (after the new member notice).
- cortesoft 9y agoWell, it has to send the public key for the new group member to the client, so the client will encrypt messages for them with that key. So the server HAS to notify the client of a new member if they want to intercept any messages.
- raguuu 9y agoIs the message coming from server or client?