7 ms·

WhatsApp, with more than 1.2 billion active users, is one of the easiest ways to send secure information. “With WhatsApp, it’s as simple as sending a text mes

WhatsApp, with more than 1.2 billion active users, is one of the easiest ways to send secure information. “With WhatsApp, it’s as simple as sending a text message — but it’s encrypted,” Mr. Dance explained. I'm not a security expert but I think this is not exactly the best practice. This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. Also the departure of WhatsApp founders under uncertain terms, doesn't give me much confidence with usage of that app for clandestine operations. Perhaps folks here who are well versed with the state of the app can chime in.

lalos 8y ago
Not to mention if they have automatic backup enabled on the phone, it bypasses the E2E encryption and adds another third party to the list that can read the messages. You never know if the other person has it enabled or not. https://www.engadget.com/2018/08/29/whatsapp-google-drive-backups-arent-encrypted/ https://www.engadget.com/2018/08/29/whatsapp-google-drive-ba...
lisper 8y ago
In general you cannot be certain of anything in today's world with regards to security. You have to trust someone. Actually, you have to trust a lot of people: hardware vendors, compiler vendors, OS vendors, and application software vendors. Any one of these could, if they chose to, easily introduce a back-door into your "secure" system. The only way to be absolutely certain that no one has done this is to build your own hardware from discrete components and write all your own code from the bare metal on up, and even then you have to trust yourself not to have made a single mistake in a realm where even experts regularly do. Personally, I don't trust FB, but for a non-technical person there aren't any clearly superior alternatives.
- fcarraldo 8y ago
  I believe Signal and Wire are both clearly superior alternatives when it comes to privacy and trust. Both are easy to use for non-technical people.
  - balladeer 8y ago
    Signal's iOS app is really nothing to write home about (imho) and its desktop app is often downright unusable. I have not used Wire beyond a test install but it indeed looked promising. In a sense it's even better than Telegram that allows you to just use usernames but you have to add a phone number anyway (also if the other Telegram user by any chance has your phone number in their contacts then your identity is revealed anyway). But I'd say that Telegram's apps (mobile and desktop both) are superior too all the major IM apps around. I wish they could be more forthcoming about openness.
binbag 8y ago
Even if the message contents is encrypted, doesn't whatsapp still log the source and destination and their phone number and associate these with real persons? It should be trivial enough to figure out who delivered which tip by knowing a particular person sent something to that tip line.
- reitanqild 8y ago
  Yep. And to verify or to find out exactly what was written you just need to get the backups from either the sender or the receiver. This can be done in a number of ways from subpoenas to hacking to threats/blackmail.
psychometry 8y ago
How can I as an iOS user know that the message is encrypted? I don't see how.
- newscracker 8y ago
  Like lisper said above, you cannot really be certain of anything. Taken to an extreme, you can’t even be certain if the padlock icon on your browser signifying a secure HTTPS connection is truly secure or not. You decide to trust certain things with the assumption that everyone else out there is not out to get you, and that those who’re considered experts in this domain do practice honesty and that there are people who do care more about the rest of the population than their own paychecks. In the case of WhatsApp, we do have public confirmation of the Signal team working with WhatsApp to implement end-to-end encryption. [1] [1]: https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/
reificator 8y ago
Please don't use the code formatting for quotes. It makes them nearly unreadable on mobile.
- dredmorbius 8y ago
  HN could fix this trivially. It's been requested numerous times. They refuse. For years. Sigh.
  - reificator 8y ago
    True, it would probably be a small change, and it'd be nice to have code blocks readable on mobile. However, the generally accepted quote syntax on HN does not use code blocks in the first place. > *Quote goes here*
    - dredmorbius 8y ago
      And that's how I write extended quote blocks generally. Some users don't, there is no one unambiguously correct method, and the 2nd- most common variant I see has several obvious detriments. The fact that the "show us your code" feature seems to be predominantly used for blockquotes, on a generally technological site, strongly suggests a failure to correctly match user expectations and needs. Though as metacommentary in infotech, SV, and YC, the message couldn't be clearer.
      - reificator 8y ago
        I think you're reading too much into it. Seems more likely that it's a lack of instruction on the comment page. Discord manages to fit all of its formatting into the whitespace under the chat input....
        dredmorbius 8y ago
        That would help. Many sites now offer formatting tools or a "help" link or expando. HN elects not to. Some of this may be part of its intentional asthetic. But more proximate hep might, er, help.
ac4tw 8y ago
myth_buster, lisper, & newscracker make interesting points. In researching WhatsApp a while ago, I came across this in a Quora post "But one more point I want to stress here is that, though whatsapp is allowing end to end communication , it does not necessarily mean they can not analyse the encrypted data. in cryptography we call it Searchable Encryption." (https://www.quora.com/Now-that-WhatsApp-can-no-longer-read-your-messages-how-will-they-make-money https://www.quora.com/Now-that-WhatsApp-can-no-longer-read-y...) I don't know whether it is accurate to WhatsApp, but it's certainly food for thought and also made me wonder how many other end-end encrypted systems use it. I personally don't trust FB. WhatsApp is not open source, so I have to trust what FB says. I don't. There are many important considerations in secure messaging and the EFF has done a reasonable job of trying to cover the subject in their series on messaging (https://www.eff.org/deeplinks/2018/03/secure-messaging-more-secure-mess https://www.eff.org/deeplinks/2018/03/secure-messaging-more-...)
- CiPHPerCoder 8y ago
  You can reverse engineer any Android app in very little time. Professionals use frameworks like Lobotomy, but you can get by with dex2jar and JD-GUI for most of it. It not being open source is a political argument, not a technical one. EDIT: I ended up doing just that. It took roughly 5 minutes (most of that was making sure I had my PATH for Java set up correctly on this machine) to get decompiled Java code ready to inspect. https://pbs.twimg.com/media/DnkFaKxU8AE4mFn.jpg https://pbs.twimg.com/media/DnkFaKxU8AE4mFn.jpg
  - ac4tw 8y ago
    "It not being open source is a political argument, not a technical one." If I can compare the open source to the reverse engineered code to see what I'm really using/getting, that seems like a technical advantage. Also, all of the reverse engineered code I've worked with has been difficult and time consuming to digest (missing var names, comments etc); open source gives me a technical advantage in analyzing and understanding the code. Lastly, looking at a companies open source lets me assess their technical sophistication and practices which also seems like a technical advantage. I haven't spent much time thinking on this subject, but the political aspect seems to be the line of thinking that says: you will engender trust by making a project open source. Is your reasoning similar? Also are there good tools for reverse engineering iOS deployments?
CiPHPerCoder 8y ago
> This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. WhatsApp messages are encrypted end-to-end between each person using it. The whole point of end-to-end encryption is not having to trust the server-side storage. Furthermore, WhatsApp uses the Signal Protocol-- the state-of-the-art for secure messaging protocols. The worst that WhatsApp can see is "who's talking to who?" Finally, the adoption of the Signal Protocol in WhatsApp came long after the Facebook acquisition. So, no. It wasn't better off pre-fb.
- nostoc 8y ago
  > who's talking to who? That can be a problem when you're a whistle blower contacting a journalist.
  - CiPHPerCoder 8y ago
    Sure, that can be a problem. However, it's completely irrelevant to the problem of server-side storage, as the comment I replied to was citing. (Server-side storage is a non-issue, due to the encryption protocols in use. It doesn't matter if you distrust Facebook, they aren't going to be able to read your messages. End of.)
    - reitanqild 8y ago
      I avoid WhatsApp but this is correct AFAIK (given that they don't push a malicious client at some point.) The main problems with WhatsApp are as I can see: - they scoop up metadata - they upload the data more or less plaintext to Google for backup. (I personally dislike but trust Google but not everyone trusts them.) - they paid way to much for it to not try to monetize it in all kinds of crazy ways
      - TheSpiceIsLife 8y ago
        > given that they don't push a malicious client at some point How do we know this hasn't happened already? How do we know it won't happen tomorrow?
krn 8y ago
As far as I'm aware of, Facebook collects and stores all the meta-data WhatsApp generates. Which means, that it can provide a list of phone numbers, IP addresses, or even GPS coordinates(?) of the people who contacted the journalist at any specific time. So, even if the messages are encrypted, a person can still be tracked down.
deleted 8y ago
[deleted]

lalos 8y ago

Not to mention if they have automatic backup enabled on the phone, it bypasses the E2E encryption and adds another third party to the list that can read the messages. You never know if the other person has it enabled or not. https://www.engadget.com/2018/08/29/whatsapp-google-drive-backups-arent-encrypted/ https://www.engadget.com/2018/08/29/whatsapp-google-drive-ba...

lisper 8y ago

In general you cannot be certain of anything in today's world with regards to security. You have to trust someone. Actually, you have to trust a lot of people: hardware vendors, compiler vendors, OS vendors, and application software vendors. Any one of these could, if they chose to, easily introduce a back-door into your "secure" system. The only way to be absolutely certain that no one has done this is to build your own hardware from discrete components and write all your own code from the bare metal on up, and even then you have to trust yourself not to have made a single mistake in a realm where even experts regularly do. Personally, I don't trust FB, but for a non-technical person there aren't any clearly superior alternatives.

fcarraldo 8y ago
I believe Signal and Wire are both clearly superior alternatives when it comes to privacy and trust. Both are easy to use for non-technical people.
- balladeer 8y ago
  Signal's iOS app is really nothing to write home about (imho) and its desktop app is often downright unusable. I have not used Wire beyond a test install but it indeed looked promising. In a sense it's even better than Telegram that allows you to just use usernames but you have to add a phone number anyway (also if the other Telegram user by any chance has your phone number in their contacts then your identity is revealed anyway). But I'd say that Telegram's apps (mobile and desktop both) are superior too all the major IM apps around. I wish they could be more forthcoming about openness.

binbag 8y ago

Even if the message contents is encrypted, doesn't whatsapp still log the source and destination and their phone number and associate these with real persons? It should be trivial enough to figure out who delivered which tip by knowing a particular person sent something to that tip line.

reitanqild 8y ago
Yep. And to verify or to find out exactly what was written you just need to get the backups from either the sender or the receiver. This can be done in a number of ways from subpoenas to hacking to threats/blackmail.

psychometry 8y ago

How can I as an iOS user know that the message is encrypted? I don't see how.

newscracker 8y ago
Like lisper said above, you cannot really be certain of anything. Taken to an extreme, you can’t even be certain if the padlock icon on your browser signifying a secure HTTPS connection is truly secure or not. You decide to trust certain things with the assumption that everyone else out there is not out to get you, and that those who’re considered experts in this domain do practice honesty and that there are people who do care more about the rest of the population than their own paychecks. In the case of WhatsApp, we do have public confirmation of the Signal team working with WhatsApp to implement end-to-end encryption. [1] [1]: https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/

reificator 8y ago

Please don't use the code formatting for quotes. It makes them nearly unreadable on mobile.

dredmorbius 8y ago
HN could fix this trivially. It's been requested numerous times. They refuse. For years. Sigh.
- reificator 8y ago
  True, it would probably be a small change, and it'd be nice to have code blocks readable on mobile. However, the generally accepted quote syntax on HN does not use code blocks in the first place. > *Quote goes here*
  - dredmorbius 8y ago
    And that's how I write extended quote blocks generally. Some users don't, there is no one unambiguously correct method, and the 2nd- most common variant I see has several obvious detriments. The fact that the "show us your code" feature seems to be predominantly used for blockquotes, on a generally technological site, strongly suggests a failure to correctly match user expectations and needs. Though as metacommentary in infotech, SV, and YC, the message couldn't be clearer.
    - reificator 8y ago
      I think you're reading too much into it. Seems more likely that it's a lack of instruction on the comment page. Discord manages to fit all of its formatting into the whitespace under the chat input....
      - dredmorbius 8y ago
        That would help. Many sites now offer formatting tools or a "help" link or expando. HN elects not to. Some of this may be part of its intentional asthetic. But more proximate hep might, er, help.

ac4tw 8y ago

myth_buster, lisper, & newscracker make interesting points. In researching WhatsApp a while ago, I came across this in a Quora post "But one more point I want to stress here is that, though whatsapp is allowing end to end communication , it does not necessarily mean they can not analyse the encrypted data. in cryptography we call it Searchable Encryption." (https://www.quora.com/Now-that-WhatsApp-can-no-longer-read-your-messages-how-will-they-make-money https://www.quora.com/Now-that-WhatsApp-can-no-longer-read-y...) I don't know whether it is accurate to WhatsApp, but it's certainly food for thought and also made me wonder how many other end-end encrypted systems use it. I personally don't trust FB. WhatsApp is not open source, so I have to trust what FB says. I don't. There are many important considerations in secure messaging and the EFF has done a reasonable job of trying to cover the subject in their series on messaging (https://www.eff.org/deeplinks/2018/03/secure-messaging-more-secure-mess https://www.eff.org/deeplinks/2018/03/secure-messaging-more-...)

CiPHPerCoder 8y ago
You can reverse engineer any Android app in very little time. Professionals use frameworks like Lobotomy, but you can get by with dex2jar and JD-GUI for most of it. It not being open source is a political argument, not a technical one. EDIT: I ended up doing just that. It took roughly 5 minutes (most of that was making sure I had my PATH for Java set up correctly on this machine) to get decompiled Java code ready to inspect. https://pbs.twimg.com/media/DnkFaKxU8AE4mFn.jpg https://pbs.twimg.com/media/DnkFaKxU8AE4mFn.jpg
- ac4tw 8y ago
  "It not being open source is a political argument, not a technical one." If I can compare the open source to the reverse engineered code to see what I'm really using/getting, that seems like a technical advantage. Also, all of the reverse engineered code I've worked with has been difficult and time consuming to digest (missing var names, comments etc); open source gives me a technical advantage in analyzing and understanding the code. Lastly, looking at a companies open source lets me assess their technical sophistication and practices which also seems like a technical advantage. I haven't spent much time thinking on this subject, but the political aspect seems to be the line of thinking that says: you will engender trust by making a project open source. Is your reasoning similar? Also are there good tools for reverse engineering iOS deployments?

CiPHPerCoder 8y ago

> This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage. WhatsApp messages are encrypted end-to-end between each person using it. The whole point of end-to-end encryption is not having to trust the server-side storage. Furthermore, WhatsApp uses the Signal Protocol-- the state-of-the-art for secure messaging protocols. The worst that WhatsApp can see is "who's talking to who?" Finally, the adoption of the Signal Protocol in WhatsApp came long after the Facebook acquisition. So, no. It wasn't better off pre-fb.

nostoc 8y ago
> who's talking to who? That can be a problem when you're a whistle blower contacting a journalist.
- CiPHPerCoder 8y ago
  Sure, that can be a problem. However, it's completely irrelevant to the problem of server-side storage, as the comment I replied to was citing. (Server-side storage is a non-issue, due to the encryption protocols in use. It doesn't matter if you distrust Facebook, they aren't going to be able to read your messages. End of.)
  - reitanqild 8y ago
    I avoid WhatsApp but this is correct AFAIK (given that they don't push a malicious client at some point.) The main problems with WhatsApp are as I can see: - they scoop up metadata - they upload the data more or less plaintext to Google for backup. (I personally dislike but trust Google but not everyone trusts them.) - they paid way to much for it to not try to monetize it in all kinds of crazy ways
    - TheSpiceIsLife 8y ago
      > given that they don't push a malicious client at some point How do we know this hasn't happened already? How do we know it won't happen tomorrow?

krn 8y ago

As far as I'm aware of, Facebook collects and stores all the meta-data WhatsApp generates. Which means, that it can provide a list of phone numbers, IP addresses, or even GPS coordinates(?) of the people who contacted the journalist at any specific time. So, even if the messages are encrypted, a person can still be tracked down.

deleted 8y ago

[deleted]