10 ms·

Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?

sentenza 13y ago
What's troubling is, that their security track record has been abysmal from the start. In that regard, the acquisition sends entirely the wrong message.
- stingraycharles 13y ago
  What message does it send, other than valuation not being based on the reputation of technical superiority?
  - eropple 13y ago
    It sends a message that caring about your users' trust, that doing what's right for them, is for suckers. This is not a test of "technical superiority". This is working against your users' best interests. One mistake is understandable, and sometimes forgivable, but you don't bilge it twice so cavalierly if you rank on the give-a-damn scale. (I say "cavalierly" because, as I noted elsewhere in this thread, I can't shake the feeling that this is the result of a design decision, not a technical failure.)
- nathancahill 13y ago
  Sure, the message was sent. But does it have a read receipt?
- roc 13y ago
  The market's been sending that same message for years. Security is a cost center and potential source of user-friction. User Data Integrity is a "nice to have". Privacy is considered only from the angle of "what can other users see through normal operation". And that market is driven by the consumers themselves.
higherpurpose 13y ago
That's why you use TextSecure instead of insecure proprietary "popular" apps. Whatsapp could also use TextSecure's ratcheting protocol, too. Why aren't they? Beats me. Maybe they prefer weaker security for their users.
- mahyarm 13y ago
  No it isn't 'prefer'. It's that users don't care about this kind of security in practice, they only care about the kind of security from other people in their personal lives, which is more about privacy controls than actual security. Because of this, they get no reward from the market if they actually focus on security. Instead they focus on things the market DOES reward them for, which is being fast, never being down, being available everywhere, for the cheapest price, with no annoying ads. They only have 35 engineers, what they could do is limited. So security becomes priority #50 like for most start ups and only a few token hours efforts are put into place. That single AES key was probably implemented 3.5 years ago.
  - danielweber 13y ago
    Every security researcher goes through this phase when it dawns on them no one gives a shit about security. It leads to a few years of depression, and then going to work for people who, for whatever reason, really do care about security.
  - timjahn 13y ago
    "They only have 35 engineers, what they could do is limited." Um, am I the only one that thinks 35 engineers is a pretty good size team to get a good amount of work done?
    - yid 13y ago
      > Um, am I the only one that thinks 35 engineers is a pretty good size team to get a good amount of work done? It takes extraordinarily good engineering practices and discipline to get 35 engineers working as well as you'd imagine WhatsApp could have.
jcampbell1 13y ago
Just out of curiosity, where would you store the unique AES key, that wouldn't break the UX in many ways? For instance, not losing messages when you upgrade your phone.
- kllrnohj 13y ago
  Storing the key is easy, you put it in your app's private data folder. Which is where the database should have just been stored in the first place, and not on the public SD card. You could also have a user-supplied passphrase with email recovery. Or any of a dozen other best practices that exist. This isn't exactly a new problem, there are plenty of solutions that are far superior to rot13 (which is basically all this is)
  - jcampbell1 13y ago
    I don't think you are evaluating the tradeoff at all here. WhatsApp won by making a friction free experience. You are adding email and pass phrases, or any one of the dozen things that make it harder to use. I accept there is a good solution, but I don't think you are thinking about the problem broadly.
    - eropple 13y ago
      There is no "tradeoff" here for a reasonably vertebrate hominid. When you demand user trust, security is core. If it's not core, go home because you cannot be trusted to make adult decisions. The people using your software are more important than your fucking term sheets, man.
      - jcampbell1 13y ago
        You do realize all desktop software has this same vulnerability. I think you are being a tad hyperbolic. WhatsApp has some blame, but Google should have figured out how to let applications sandbox data on the SD card without having to do roll your own AES key management system. It could have been as simple as put the data in a folder named "private/appname/".
rhizome 13y ago
One might think Facebook did their due diligence and said, "DANG, you got all these users with this big of a hole just laying right out there? Here, have some money."
- not_paul_graham 13y ago
  Haha! But seriously given the leaked chat messages from when Zuckerberg was still not the polished CEO and less mature [1], your argument seems plausible. > ZUCK: yea so if you ever need info about anyone at harvard > ZUCK: just ask > ZUCK: i have over 4000 emails, pictures, addresses, sns > FRIEND: what!? how’d you manage that one? > ZUCK: people just submitted it > ZUCK: i don’t know why > ZUCK: they “trust me” > ZUCK: dumb fucks
  - rhizome 13y ago
    Are you the same person who posts this snippet every time FB is mentioned on HN?
    - not_paul_graham 13y ago
      This is actually the first time that I'm posting this, but yeah I don't fault Zuckerberg. That was one of the reasons that I added that he was perhaps less mature then. Thought processes & some beliefs change over time and I'm not saying he is the same person now that he was then.
      - rhizome 13y ago
        Then you're copying the guy(s) who do(es) post this snippet every time FB is mentioned on HN.
        not_paul_graham 13y ago
        I'm really not sure why that is relevant? Do you always check whether what you are about to write/post has been written before?
jaxytee 13y ago
>Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing? Cashing out billions why we criticize from a web forum.
deleted 13y ago
[deleted]

What's troubling is, that their security track record has been abysmal from the start. In that regard, the acquisition sends entirely the wrong message.

stingraycharles 13y ago
What message does it send, other than valuation not being based on the reputation of technical superiority?
- eropple 13y ago
  It sends a message that caring about your users' trust, that doing what's right for them, is for suckers. This is not a test of "technical superiority". This is working against your users' best interests. One mistake is understandable, and sometimes forgivable, but you don't bilge it twice so cavalierly if you rank on the give-a-damn scale. (I say "cavalierly" because, as I noted elsewhere in this thread, I can't shake the feeling that this is the result of a design decision, not a technical failure.)
nathancahill 13y ago
Sure, the message was sent. But does it have a read receipt?
roc 13y ago
The market's been sending that same message for years. Security is a cost center and potential source of user-friction. User Data Integrity is a "nice to have". Privacy is considered only from the angle of "what can other users see through normal operation". And that market is driven by the consumers themselves.

higherpurpose 13y ago

That's why you use TextSecure instead of insecure proprietary "popular" apps. Whatsapp could also use TextSecure's ratcheting protocol, too. Why aren't they? Beats me. Maybe they prefer weaker security for their users.

mahyarm 13y ago
No it isn't 'prefer'. It's that users don't care about this kind of security in practice, they only care about the kind of security from other people in their personal lives, which is more about privacy controls than actual security. Because of this, they get no reward from the market if they actually focus on security. Instead they focus on things the market DOES reward them for, which is being fast, never being down, being available everywhere, for the cheapest price, with no annoying ads. They only have 35 engineers, what they could do is limited. So security becomes priority #50 like for most start ups and only a few token hours efforts are put into place. That single AES key was probably implemented 3.5 years ago.
- danielweber 13y ago
  Every security researcher goes through this phase when it dawns on them no one gives a shit about security. It leads to a few years of depression, and then going to work for people who, for whatever reason, really do care about security.
- timjahn 13y ago
  "They only have 35 engineers, what they could do is limited." Um, am I the only one that thinks 35 engineers is a pretty good size team to get a good amount of work done?
  - yid 13y ago
    > Um, am I the only one that thinks 35 engineers is a pretty good size team to get a good amount of work done? It takes extraordinarily good engineering practices and discipline to get 35 engineers working as well as you'd imagine WhatsApp could have.

jcampbell1 13y ago

Just out of curiosity, where would you store the unique AES key, that wouldn't break the UX in many ways? For instance, not losing messages when you upgrade your phone.

kllrnohj 13y ago
Storing the key is easy, you put it in your app's private data folder. Which is where the database should have just been stored in the first place, and not on the public SD card. You could also have a user-supplied passphrase with email recovery. Or any of a dozen other best practices that exist. This isn't exactly a new problem, there are plenty of solutions that are far superior to rot13 (which is basically all this is)
- jcampbell1 13y ago
  I don't think you are evaluating the tradeoff at all here. WhatsApp won by making a friction free experience. You are adding email and pass phrases, or any one of the dozen things that make it harder to use. I accept there is a good solution, but I don't think you are thinking about the problem broadly.
  - eropple 13y ago
    There is no "tradeoff" here for a reasonably vertebrate hominid. When you demand user trust, security is core. If it's not core, go home because you cannot be trusted to make adult decisions. The people using your software are more important than your fucking term sheets, man.
    - jcampbell1 13y ago
      You do realize all desktop software has this same vulnerability. I think you are being a tad hyperbolic. WhatsApp has some blame, but Google should have figured out how to let applications sandbox data on the SD card without having to do roll your own AES key management system. It could have been as simple as put the data in a folder named "private/appname/".

rhizome 13y ago

One might think Facebook did their due diligence and said, "DANG, you got all these users with this big of a hole just laying right out there? Here, have some money."

not_paul_graham 13y ago
Haha! But seriously given the leaked chat messages from when Zuckerberg was still not the polished CEO and less mature [1], your argument seems plausible. > ZUCK: yea so if you ever need info about anyone at harvard > ZUCK: just ask > ZUCK: i have over 4000 emails, pictures, addresses, sns > FRIEND: what!? how’d you manage that one? > ZUCK: people just submitted it > ZUCK: i don’t know why > ZUCK: they “trust me” > ZUCK: dumb fucks
- rhizome 13y ago
  Are you the same person who posts this snippet every time FB is mentioned on HN?
  - not_paul_graham 13y ago
    This is actually the first time that I'm posting this, but yeah I don't fault Zuckerberg. That was one of the reasons that I added that he was perhaps less mature then. Thought processes & some beliefs change over time and I'm not saying he is the same person now that he was then.
    - rhizome 13y ago
      Then you're copying the guy(s) who do(es) post this snippet every time FB is mentioned on HN.
      - not_paul_graham 13y ago
        I'm really not sure why that is relevant? Do you always check whether what you are about to write/post has been written before?

jaxytee 13y ago

>Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing? Cashing out billions why we criticize from a web forum.

deleted 13y ago

[deleted]