8 ms·

If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What la

If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Platforms that rely on trust (in this case, trusting that FB isn't doing bad things) provide very weak guarantees about privacy/security. They could easily include a keylogger in WhatsApp and bypass the e2e encryption, for example, and us regular folk have no way of knowing.

EvgeniyZh 7y ago
If the source code is available for audit by 3rd parties, but nobody you trust have actually audited it (depending on your paranoia, this may be only yourself), then it was never really "secure" anyway.
londons_explore 7y ago
The Whatsapp binary is sufficiently transparent to enable someone determined to write their own client. Thats enough info for an expert to verify their "messages are end to end encrypted and we don't know the key" claim. The fly in the ointment is the client might have additional functionality to leak the e2e encryption key. That is far harder to find, but if it's use were widespread, it would be found by researchers. The whole point is moot though - whatsapp is designed to (by default) upload cleartext chat logs to google/apple servers. Since all chats have 2+ recipients, the conversation is only safe from snooping if nobody in the chat has backup enabled, which is unlikely.
- brenden2 7y ago
  Yep, the chat log backup basically renders WhatsApp completely insecure. They also constantly nag you inside the app to enable it. This is how they caught Michael Cohen (and presumably others). Unfortunately Signal does it, too.
  - gsich 7y ago
    Signals backups are encrypted.
    - uoylj 7y ago
      And local.. whatsapp tries to get you to send unencrypted backups to google drive.
    - vbezhenar 7y ago
      How are they restored? Is it password-encrypted?
      - gsich 7y ago
        you copy them to your new phone. yes.
      - henryaj 7y ago
        Yes, you're given a random password when you enable backups that you need to use when restoring. They don't get uploaded to the cloud. On iOS there's no backup feature at all AFAIK.
  - thekyle 7y ago
    I don't think that Signal uploads the backups to the cloud though. It seems like they're stored on device and encrypted.
  - commandersaki 7y ago
    At least on iOS - whatsapp doesn't seem to nag about backups (i don't think i've ever enabled it), but you can do a local backup/restore if you replace handset. Signal encrypts your chats locally (but not binary blobs/video/images) but they cannot be backed up and restored locally.
- sschueller 7y ago
  Attack or cooperation with custom soft keyboard makers is much easier. It may only give you one side of the conversation but no ones seems to care if those are secure. As long as they do a good job of spell checking.
- pmlnr 7y ago
  It doesn't have to be whatsapp that "steals" the key, we have zigote and google play services to do that.
- deleted 7y ago
  [deleted]
- samsonradu 7y ago
  Having a 'secure' conversation definitely implies trust in Google/Apple, regardless of the Whatsapp binary behaving flawlessly (e2e encryption, solid PRNG, no logs etc.) They could indeed serve you a different binary from the app-store. "Do you think that's Whatsapp you're using?"
  - londons_explore 7y ago
    Trust in the OS made by Google/Apple is slightly different from trust in the ability of Google/Apple to keep your data stored on their servers secure against nation states. I have much more trust in the former than the latter.
antpls 7y ago
Wouldn't someone from inside the Facebook/Whatsapp team denounce it if that was the case? Like a whistle blower
- brenden2 7y ago
  FB's history suggests they have a culture of not blowing the whistle when shady things are going on. I suspect most people want to keep their $500k+/year jobs instead of sticking their necks out. My friends who work at FAANG are largely mentally checked out, and just do it to collect their monies and retire ASAP. You can't pay rent with good feelings.
  - pmlnr 7y ago
    > You can't pay rent with good feelings. So just keep making the world shittier. Gotta love individualist capitalism.
    - brenden2 7y ago
      I quit my (good paying) job to burn through my savings and start my own company because I want to fix this, so it's not everyone who behaves that way :)
      - cakemuncher 7y ago
        Look into B Corporations and read the last third of the book Lab Rats. You can make your company serve society and it's employees right without adopting shitty cultures that breeds suicides, pissing in bottles and burn outs and still make huge profits.
      - vocatus_gate 7y ago
        I left the NSA after 4 years because I didn't want to support some of the things going on there. Can't dismantle it, but can at least not contribute.
    - paulddraper 7y ago
deogeo 7y ago
> If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Careful - you're right that WhatsApp is untrustworthy, but laws that force them to add backdoors could well be applied to open-source code as well. Or make possession of non-backdoored software, open or not, illegal. Or compel OS/hardware manufacturers on which the code runs. The law is a dangerous thing to ignore.
- brenden2 7y ago
  If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everything on the screen and forwards it to some other entity, but in practice it's not so easy because of bandwidth limitations, etc. I suppose it would be much easier to create a physical keyboard that phones home over a mobile network, although it would only give you half the conversation. *edit: added the word "audited".
  - shawnz 7y ago
    No, you would also have to audit the entire codebase. You could also decompile the Whatsapp APK and do the same thing (it's Java after all).
    - ajconway 7y ago
      WhatsApp contains significant amount of native code, making it much more difficult to analyze.
    - colejohnson66 7y ago
      > No, you would also have to audit the entire codebase Look no further than the OpenSSL Heartbleed vulnerability
throwaway826732 7y ago
> They could easily include a keylogger in WhatsApp and bypass the e2e encryption, for example, and us regular folk have no way of knowing. This would be quickly detected by anyone looking at the data the WhatsApp app was sending back to the server (this isn't hard to do on a jailbroken device).
maxerickson 7y ago
It's entirely possible to analyze the compiled program. And it's actively done…
resters 7y ago
I agree with this, but I think the main problem is the centralization of trust, or the user having to place trust in one or two entities. Imagine if 10 or 20 different organizations all had access to the source code and could vouch for the checskum of a each build. While it would be nice if we could trust FB, Apple, etc., it would be much better if we didn't have to, and could simply trust others who have less to lose from alienating government officials.
skybrian 7y ago
Trust isn't binary. You can trust a company to keep your conversation private for most purposes without it being safe from a government wiretap. We do that whenever we use a phone.
- ZoomZoomZoom 7y ago
  Your phone conversations are only presumably private. There's no guarantee and you can't know for sure.
jedberg 7y ago
>What lawmakers do or don't say is just noise. Back in the day, it was illegal to export "good" encryption. There was nothing stopping it from happening technically, just like there is nothing stopping you from stealing from a convince store, except for the threat of enforcement. But the threat of enforcement can have a strong chilling effect.
- TheRealPomax 7y ago
  Bad analogy - exporting "good" encryption was illegal and while for individuals that was basically irrelevant, _companies_ would absolute follow that law. The analogy is not between "you stealing from a convenience store", it's "you running a company that has a known practice of robbing convenience stores". It's so incredibly illegal, you're not going to. There is no realistic hypothetical in which that decision would even remotely make sense.
UncleMeat 7y ago
Bull. You still get an apk, which is easy to decompile and investigate. People absolutely can (and have) audited the WhatsApp code.
feanaro 7y ago
> If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. It's still nice to see this spelled out since I've seen many people claim that WhatsApp being closed source is not that problematic. This is definitive confirmation that it cannot be trusted anymore and it's time to start working on the problem (both from a legislative point and by seeking out and moving to technological alternatives).
deleted 7y ago
[deleted]
drdaeman 7y ago
Unless you have reproducible builds, having access to the source code can be deceiving. Audits should start with the actual binary. Only if you can ensure that the binary was build from a specific source code and does not contain any other logic in there (i.e. it was build by a trusted compiler), you can happily skip the decompilation process and analyze that source instead.

EvgeniyZh 7y ago

If the source code is available for audit by 3rd parties, but nobody you trust have actually audited it (depending on your paranoia, this may be only yourself), then it was never really "secure" anyway.

londons_explore 7y ago

The Whatsapp binary is sufficiently transparent to enable someone determined to write their own client. Thats enough info for an expert to verify their "messages are end to end encrypted and we don't know the key" claim. The fly in the ointment is the client might have additional functionality to leak the e2e encryption key. That is far harder to find, but if it's use were widespread, it would be found by researchers. The whole point is moot though - whatsapp is designed to (by default) upload cleartext chat logs to google/apple servers. Since all chats have 2+ recipients, the conversation is only safe from snooping if nobody in the chat has backup enabled, which is unlikely.

brenden2 7y ago
Yep, the chat log backup basically renders WhatsApp completely insecure. They also constantly nag you inside the app to enable it. This is how they caught Michael Cohen (and presumably others). Unfortunately Signal does it, too.
- gsich 7y ago
  Signals backups are encrypted.
  - uoylj 7y ago
    And local.. whatsapp tries to get you to send unencrypted backups to google drive.
  - vbezhenar 7y ago
    How are they restored? Is it password-encrypted?
    - gsich 7y ago
      you copy them to your new phone. yes.
    - henryaj 7y ago
      Yes, you're given a random password when you enable backups that you need to use when restoring. They don't get uploaded to the cloud. On iOS there's no backup feature at all AFAIK.
- thekyle 7y ago
  I don't think that Signal uploads the backups to the cloud though. It seems like they're stored on device and encrypted.
- commandersaki 7y ago
  At least on iOS - whatsapp doesn't seem to nag about backups (i don't think i've ever enabled it), but you can do a local backup/restore if you replace handset. Signal encrypts your chats locally (but not binary blobs/video/images) but they cannot be backed up and restored locally.
sschueller 7y ago
Attack or cooperation with custom soft keyboard makers is much easier. It may only give you one side of the conversation but no ones seems to care if those are secure. As long as they do a good job of spell checking.
pmlnr 7y ago
It doesn't have to be whatsapp that "steals" the key, we have zigote and google play services to do that.
deleted 7y ago
[deleted]
samsonradu 7y ago
Having a 'secure' conversation definitely implies trust in Google/Apple, regardless of the Whatsapp binary behaving flawlessly (e2e encryption, solid PRNG, no logs etc.) They could indeed serve you a different binary from the app-store. "Do you think that's Whatsapp you're using?"
- londons_explore 7y ago
  Trust in the OS made by Google/Apple is slightly different from trust in the ability of Google/Apple to keep your data stored on their servers secure against nation states. I have much more trust in the former than the latter.

antpls 7y ago

Wouldn't someone from inside the Facebook/Whatsapp team denounce it if that was the case? Like a whistle blower

brenden2 7y ago
FB's history suggests they have a culture of not blowing the whistle when shady things are going on. I suspect most people want to keep their $500k+/year jobs instead of sticking their necks out. My friends who work at FAANG are largely mentally checked out, and just do it to collect their monies and retire ASAP. You can't pay rent with good feelings.
- pmlnr 7y ago
  > You can't pay rent with good feelings. So just keep making the world shittier. Gotta love individualist capitalism.
  - brenden2 7y ago
    I quit my (good paying) job to burn through my savings and start my own company because I want to fix this, so it's not everyone who behaves that way :)
    - cakemuncher 7y ago
      Look into B Corporations and read the last third of the book Lab Rats. You can make your company serve society and it's employees right without adopting shitty cultures that breeds suicides, pissing in bottles and burn outs and still make huge profits.
    - vocatus_gate 7y ago
      I left the NSA after 4 years because I didn't want to support some of the things going on there. Can't dismantle it, but can at least not contribute.
  - paulddraper 7y ago

deogeo 7y ago

> If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. Careful - you're right that WhatsApp is untrustworthy, but laws that force them to add backdoors could well be applied to open-source code as well. Or make possession of non-backdoored software, open or not, illegal. Or compel OS/hardware manufacturers on which the code runs. The law is a dangerous thing to ignore.

brenden2 7y ago
If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren't any backdoors (excluding perhaps hardware level backdoors--but that's why we do the encryption in software). Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen/monitor that just captures everything on the screen and forwards it to some other entity, but in practice it's not so easy because of bandwidth limitations, etc. I suppose it would be much easier to create a physical keyboard that phones home over a mobile network, although it would only give you half the conversation. *edit: added the word "audited".
- shawnz 7y ago
  No, you would also have to audit the entire codebase. You could also decompile the Whatsapp APK and do the same thing (it's Java after all).
  - ajconway 7y ago
    WhatsApp contains significant amount of native code, making it much more difficult to analyze.
  - colejohnson66 7y ago
    > No, you would also have to audit the entire codebase Look no further than the OpenSSL Heartbleed vulnerability

throwaway826732 7y ago

> They could easily include a keylogger in WhatsApp and bypass the e2e encryption, for example, and us regular folk have no way of knowing. This would be quickly detected by anyone looking at the data the WhatsApp app was sending back to the server (this isn't hard to do on a jailbroken device).

maxerickson 7y ago

It's entirely possible to analyze the compiled program. And it's actively done…

resters 7y ago

I agree with this, but I think the main problem is the centralization of trust, or the user having to place trust in one or two entities. Imagine if 10 or 20 different organizations all had access to the source code and could vouch for the checskum of a each build. While it would be nice if we could trust FB, Apple, etc., it would be much better if we didn't have to, and could simply trust others who have less to lose from alienating government officials.

skybrian 7y ago

Trust isn't binary. You can trust a company to keep your conversation private for most purposes without it being safe from a government wiretap. We do that whenever we use a phone.

ZoomZoomZoom 7y ago
Your phone conversations are only presumably private. There's no guarantee and you can't know for sure.

jedberg 7y ago

>What lawmakers do or don't say is just noise. Back in the day, it was illegal to export "good" encryption. There was nothing stopping it from happening technically, just like there is nothing stopping you from stealing from a convince store, except for the threat of enforcement. But the threat of enforcement can have a strong chilling effect.

TheRealPomax 7y ago
Bad analogy - exporting "good" encryption was illegal and while for individuals that was basically irrelevant, _companies_ would absolute follow that law. The analogy is not between "you stealing from a convenience store", it's "you running a company that has a known practice of robbing convenience stores". It's so incredibly illegal, you're not going to. There is no realistic hypothetical in which that decision would even remotely make sense.

UncleMeat 7y ago

Bull. You still get an apk, which is easy to decompile and investigate. People absolutely can (and have) audited the WhatsApp code.

feanaro 7y ago

> If the source code isn't available for audit by 3rd parties (or yourself), and you can't build it from source, then it was never really "secure" anyway. What lawmakers do or don't say is just noise. It's still nice to see this spelled out since I've seen many people claim that WhatsApp being closed source is not that problematic. This is definitive confirmation that it cannot be trusted anymore and it's time to start working on the problem (both from a legislative point and by seeking out and moving to technological alternatives).

deleted 7y ago

[deleted]

drdaeman 7y ago

Unless you have reproducible builds, having access to the source code can be deceiving. Audits should start with the actual binary. Only if you can ensure that the binary was build from a specific source code and does not contain any other logic in there (i.e. it was build by a trusted compiler), you can happily skip the decompilation process and analyze that source instead.