4 ms·

Reading this article, I was thinking that Durov was really over-exagerating when saying that WhatsApp plant backdoors, while it was simply security flaws. But

by phh 7y ago

Reading this article, I was thinking that Durov was really over-exagerating when saying that WhatsApp plant backdoors, while it was simply security flaws. But then I looked at the flaws, and that definitely raises questions. At least two of the flaws are in mp4 parsing done by WhatsApp itself, while both Android and iOS provide hardened platform tools for that. There are two reasons you would want to do that: - Increase security. Yeah that's a bit paradoxal considering what I said before, but it is possible you could want to do that, because Android devices are barely updated, and even though the mp4 parsing is hardened, there are known not fixed flaws on many devices. If that was the intent, then the very first thing they would have done, is have this run inside a dedicated sandboxed process (Android allows that pretty easily), with no access to either the data or the internet. Or they could have written it in a managed language, where the worst case of failed parsing is crashing/DoS-ing. Or they could do it in rust of course :-) - Increase compatibility with a wider range of mp4 files. As far as I know, mp4 support of those platforms should be good enough for most cases, but ok, let's say such a case exist, that means that they don't actually care about the security. As Durov say, they are using "end-to-end encryption" to say they are secured, but don't seem to care much past that. I'm still not convinced those are actual purpose-built backdoors, but I will at least agree that security doesn't seem to be a core value of WhatsApp.

culturestate 7y ago
> At least two of the flaws are in mp4 parsing done by WhatsApp itself, while both Android and iOS provide hardened platform tools for that. I imagine this choice was made at least partly for consistency across platforms, because WhatsApp supports a lot of devices and OS versions. You can use the current apps on Android back to 2.3.7 (2011) and on iOS 8+ (2014). Until 2018, WhatsApp also ran on BlackBerry 7+ (2011).
londons_explore 7y ago
Video decoding ability on Android devices varies widely device to device, and on some devices if you try to play a video it is incapable of playing, you have no way to know the user is looking at a blank screen. On a few devices, trying to play a bad file even results in an instant device reboot. You 100% don't want to be sticking untrusted data into the platform media api's, and in fact I'd caution against using them at all unless power usage is so important you need hardware accelerated decodes. Considering that, I can completely see why WhatsApp decided to bundle their own libraries.
- phh 7y ago
  In my understanding, they are using only mp4 files, and control the mp4 writers, so they should be fine with most devices' Android MediaPlayer. Though yeah, I'd personally rather go to ExoPlayer to have a managed, maintained solution that already contains most fucked up hardware workarounds you might need. Sure it's not cross-platform, but just define a high-level player api, use iOS' native player, ExoPlayer on Android, vlc on other platforms, and you're good to go. As for "sticking untrusted data into platform media api's", well the power consumption of reading a video with CPU is absurdly high. You'd be going from 6 hours view time on a standard smartphone to 2 I'd say? You could decide that you value security /that much/. But then if you do, the very first thing to do is to run the player in a dedicated isolated process. I doubt WhatsApp is doing software video decoding, but if they are, it is all the more ridiculous.

by phh 7y ago

culturestate 7y ago

> At least two of the flaws are in mp4 parsing done by WhatsApp itself, while both Android and iOS provide hardened platform tools for that. I imagine this choice was made at least partly for consistency across platforms, because WhatsApp supports a lot of devices and OS versions. You can use the current apps on Android back to 2.3.7 (2011) and on iOS 8+ (2014). Until 2018, WhatsApp also ran on BlackBerry 7+ (2011).

londons_explore 7y ago

Video decoding ability on Android devices varies widely device to device, and on some devices if you try to play a video it is incapable of playing, you have no way to know the user is looking at a blank screen. On a few devices, trying to play a bad file even results in an instant device reboot. You 100% don't want to be sticking untrusted data into the platform media api's, and in fact I'd caution against using them at all unless power usage is so important you need hardware accelerated decodes. Considering that, I can completely see why WhatsApp decided to bundle their own libraries.

phh 7y ago
In my understanding, they are using only mp4 files, and control the mp4 writers, so they should be fine with most devices' Android MediaPlayer. Though yeah, I'd personally rather go to ExoPlayer to have a managed, maintained solution that already contains most fucked up hardware workarounds you might need. Sure it's not cross-platform, but just define a high-level player api, use iOS' native player, ExoPlayer on Android, vlc on other platforms, and you're good to go. As for "sticking untrusted data into platform media api's", well the power consumption of reading a video with CPU is absurdly high. You'd be going from 6 hours view time on a standard smartphone to 2 I'd say? You could decide that you value security /that much/. But then if you do, the very first thing to do is to run the player in a dedicated isolated process. I doubt WhatsApp is doing software video decoding, but if they are, it is all the more ridiculous.