3 ms·

WhatsApp uses the Signal encryption subsystem and they only allow one other machine. What is FB doing that allows this on Whatsapp but not Signal. What a What

WhatsApp uses the Signal encryption subsystem and they only allow one other machine. What is FB doing that allows this on Whatsapp but not Signal. What a WhatsApp users opening themselves up for here?

bool3max 5y ago
Maybe read the article?
- blowski 5y ago
  HN Guidelines: > Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."
ikawe 5y ago
The Signal app never did the "primary device serves message contents to companion devices" like WhatsApp did. Ever since Signal introduced the desktop client, its multidevice functionality has involved fully fledged signal-protocol sessions between each device. It sounds like WhatsApp is now adding something like this to their client, though it sounds like some of the details of the scheme differ. In principal the signal protocol works fine for a multidevice scenario.
david_arcos 5y ago
> The WhatsApp server maintains a mapping between each person’s account and all their device identities. When someone wants to send a message, they get their device list keys from the server. Oh, no...
- alfongj 5y ago
  What's your concern?
  - ev1 5y ago
    > they get their device list keys from the server Which means the server can just substitute keys in.
    - alfongj 5y ago
      Right, but that doesn't compromise the security of the service necessarily. Users can catch a malicious server injecting incorrect keys by looking at security notifications and comparing security codes. This is part of the Signal protocol. This may be tedious but only needs to be done in the event of phone keys getting reset (a once in a year event?), as all companion device keys are automatically verified with signatures provided from an account owner's primary (phone) device Source: https://www.whatsapp.com/security/WhatsApp_Security_Whitepaper_v4_Preview.pdf https://www.whatsapp.com/security/WhatsApp_Security_Whitepap...

bool3max 5y ago

Maybe read the article?

blowski 5y ago
HN Guidelines: > Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."

ikawe 5y ago

The Signal app never did the "primary device serves message contents to companion devices" like WhatsApp did. Ever since Signal introduced the desktop client, its multidevice functionality has involved fully fledged signal-protocol sessions between each device. It sounds like WhatsApp is now adding something like this to their client, though it sounds like some of the details of the scheme differ. In principal the signal protocol works fine for a multidevice scenario.

david_arcos 5y ago

> The WhatsApp server maintains a mapping between each person’s account and all their device identities. When someone wants to send a message, they get their device list keys from the server. Oh, no...

alfongj 5y ago
What's your concern?
- ev1 5y ago
  > they get their device list keys from the server Which means the server can just substitute keys in.
  - alfongj 5y ago
    Right, but that doesn't compromise the security of the service necessarily. Users can catch a malicious server injecting incorrect keys by looking at security notifications and comparing security codes. This is part of the Signal protocol. This may be tedious but only needs to be done in the event of phone keys getting reset (a once in a year event?), as all companion device keys are automatically verified with signatures provided from an account owner's primary (phone) device Source: https://www.whatsapp.com/security/WhatsApp_Security_Whitepaper_v4_Preview.pdf https://www.whatsapp.com/security/WhatsApp_Security_Whitepap...