4 ms·

"everybody sees that someone joined" i can see that xxx has joined. Is the message coming from server or client? If it is from the server, then the attacker cou

• baby 9y ago
  I have looked at such implementations but don’t know you about whatsapp specifically: you will see the notification no matter what. This makes this attack not really an attack. Sure the servers can modify the participant list but everyone will see it and everyone will choose to write to the new group chat willingly. When someone joins/leaves the group every participant generates and distribute a new key. So as a rogue participant, the keys you’ll receive won’t allow you to decrypt past messages. PS: this article was posted before the speaker was even done with his talk. This is funny?
  • nebulous1 9y ago
    I don't see how you're arguing that this isn't an attack. However, it's clear that the severity will depend on the particular group. A group of three friends will certainly notice when someone is added to the membership. A larger group of people who don't know each other personally but trust the administrator to administer membership will have to rely on the admin both noticing and taking action, and he may be hampered in doing so by the attacker.
    • baby 9y ago
      It's just a UX failure more than an attack imo. If you're paranoid you will for sure see that someone has been added to the group. If you don't care well...
• nebulous1 9y ago
  It's implied that that's generated by the client when it's going through the add member routine (exchanging keys etc).
• mikeokner 9y ago
  That's coming from the client because the client has received a new public key with which to encrypt messages.