3 ms·
I wonder if this is similar to Snapchat. Snapchat uses AEC-ECB encryption (which you should never use) with a single key that is not-so-carefully hidden in eve
by habosa 13y ago
I wonder if this is similar to Snapchat. Snapchat uses AEC-ECB encryption (which you should never use) with a single key that is not-so-carefully hidden in every binary file they've ever distributed to a mobile device. The kind folks at Gibsonsec revealed Snapchat's "security by obscurity" and documented the API so well that I was able to make a Java Snapchat client in a few hours.
I hope that's not the case for WhatsApp, they have a lot more to lose.
- meowface 13y agoIs this just a key to encrypt chat logs local to the phone? I'm assuming they're not using this to encrypt messages in transit... If it's just local storage, then obviously it'd be easy for anyone to figure out how the app reads the logs. 95% or more of chatting programs and apps do not even encrypt chat logs in the first place.
- habosa 13y agoNot sure. Snapchat uses that in transit.
- hkphooey 13y agoWhat does YCombinator have to lose? What does HackerNews have to lose? Why has this story been killed so it doesn't appear on the front page? I feel there is technical merit in discussing the poor security practice of WhatsApp, so that others don't copy their example.
- beedogs 13y ago> Why has this story been killed so it doesn't appear on the front page? Looks like it's back, for now.