7 ms·

Belgium Arrests Two in Probe Over Returning Syria Fighter

76 points by Errorcod3 11y ago

caminante 11y ago
Though, does this mean that the encryption was compromised?
- jhallenworld 11y ago
  Even with encryption they can probably track who you're communicating with. Perhaps they pushed an insecure version on the suspects.
- deleted 11y ago
  [deleted]
deleted 11y ago
[deleted]
solarexplorer 11y ago
AFAIK end-to-end encryption can only be used with Android clients. http://www.heise.de/ct/artikel/Keeping-Tabs-on-WhatsApp-s-Encryption-2630361.html http://www.heise.de/ct/artikel/Keeping-Tabs-on-WhatsApp-s-En... tl;dr end-to-end encryption in WhatsApp is not really useful (yet)
- zeeed 11y ago
  which, if you rely on it, defeats at least one "end" in "end-to-end" if you don't know what device your peer is using. So much for end-to-end encryption in Whatsapp...
  - morganvachon 11y ago
    That's exactly what I was thinking. If WhatsApp was an Android-only app, it might be able to claim end-to-end security. Even then a quirk in a certain version of Android on one end, or even a hardware quirk with a certain model phone, could impact security. Of course if you want the most secure communication possible with someone, you won't use a smartphone in the first place. There isn't a cellphone on the planet that's 100% secure from eavesdropping.
    - Cederfjard 11y ago
      >If WhatsApp was an Android-only app, it might be able to claim end-to-end security. Have they made this claim though, or stated it as a goal?
      - morganvachon 11y ago
        They did a while back: http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ http://www.wired.com/2014/11/whatsapp-encrypted-messaging/
  - jokr004 11y ago
    I've never used Whatsapp, but maybe they inform you whether or not the other end supports and is using encryption? It would certainly be easy for them to do something like that, hopefully they do.
    - solarexplorer 11y ago
      They don't...
mapgrep 11y ago
"In its initial phase, though, Whatsapp’s messaging encryption is limited to Android, and doesn’t yet apply to group messages, photos or video messages. " http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ http://www.wired.com/2014/11/whatsapp-encrypted-messaging/
phreeza 11y ago
Seems very unwise of them to disclose this capability, if it exists. Might be a red herring? Or maybe an accidental disclosure through due to belgian/US miscommunication.
- briandear 11y ago
  From an intelligence perspective this was profoundly dumb to reveal. This is the heart of what protecting sources and methods is all about. However, it really should go without saying that one should operate in the assumption that all digital communications are compromised, at least commercial services.
nly 11y ago
As much as I like and respect Moxie, I think it's a huge personal risk for him to associate himself with Facebook (WhatsApp)[0]. That said, come on... there's no user exposed key management in Whatsapp, or secure means to perform a handshake with your contacts. Even if they've really rolled out Moxies crypto protocol on Android, like they claim (go look at the source and verify... oh, wait), on features alone you can't trust it... you just can't create a secure channel unless you're in control of the keys. And on terrorists using Whatsapp... well, Whatsapp accounts are tied to your cell phone #. The authorities can work with WhatsApp to piece together who messaged who, and when, and where you both physically were at the time. This is enough to bust terrorists. Deploying E-to-E crypto was never about anonymity. [0] https://whispersystems.org/blog/whatsapp/ https://whispersystems.org/blog/whatsapp/
deleted 11y ago
[deleted]
dsjoerg 11y ago
Maybe you missed this — when end-to-end encryption was launched, they mentioned that they did not yet encrypt iOS, nor group chat. https://whispersystems.org/blog/whatsapp/ https://whispersystems.org/blog/whatsapp/ Did they make a subsequent announcement that they were encrypting those?
- higherpurpose 11y ago
  Who's they? Because Whatsapp has never said it uses end to end encryption - anywhere. Also, I guess it is possible that the so called terrorists used iPhones, but I think there's a higher chance they used Android phones. Of course we don't know exactly, but either way you shouldn't have assumed Whatsapp uses end-to-end encryption even before this. So those who thought Whatsapp was "safe", treat this as yet another warning sign that you shouldn't be using it for private conversations. Those who were already paranoid about it, you probably weren't using it already for that, so this changes nothing.
  - toong 11y ago
    Why do you think it's more likely they used Android phones ? As of May 2015, iOS has 53.5% of the mobile market Android 41.7% (in Belgium) - source: http://howwebrowse.be/ http://howwebrowse.be/
    - e28eta 11y ago
      My guess would be price, especially if they're periodically changing phones to reduce their chances of surveillance. OTOH maybe they weren't doing that.
    - Light2Yellow 11y ago
      I want to add that not only the price is crucial but a bit of security. Using a closed OS with belief you're not being tracked? Well, they are not so stupid. The best choice for such things is a chinese no-name-smartphone on Android or just an old Nokia on Symbian^3 or 9.4.
  - morganvachon 11y ago
simonvc 11y ago
Even if you do you use an app that always uses crypto end to end (e.g. signal/textsecure) https://whispersystems.org/blog/signal/ https://whispersystems.org/blog/signal/ There's no guarantee that apple/google/microsoft haven't been ordered to install a backdoored version. tl;dr RMS was right
- dogma1138 11y ago
  It's by far easier to force MSFT, Google or Apple to backdoor the device rather than an individual app. Especially since at least on Android devices you can always pull the APK you got form the store apart and see if it's being messed with.
tptacek 11y ago
You're not supposed to do this with story titles. The correct title for this story would be "Belgium Arrests Two in Probe Over Returning Syria Fighter".
- roryhughes 11y ago
  Yeah but OP is trying to point out a specific piece of information that's relevant for hacker news users. It wouldn't have been read through otherwise.
  - shepardrtc 11y ago
    OP has no information other than that Whatsapp was used. The title is not appropriate.
- flurdy 11y ago
  Unfortunately that title would not be very descriptive why the story is relevant on Hacker News.
- jokr004 11y ago
  To be fair, that doesn't shed any light on what the submitter is trying to point out.
- morganvachon 11y ago
  I think in this particular case the story title applies. The part of the story that is interesting/important to HN users is about WhatsApp's compromised encryption, not so much the arrest and charges. Perhaps a nod to the article's title would be better though; something like "Suspects Arrested in Probe Based On WhatsApp Eavesdropping". That covers both aspects of the story.
  - tptacek 11y ago
    https://hn.algolia.com/?query=author:dang%20editorialize&sort=byPopularity&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=author:dang%20editorialize&sor...
dogma1138 11y ago
As many have pointed out Whats App's E2EE isn't deployed on all platforms and messaging services. Furthermore they've only rolled it out about 6 months ago, there's a good chance that the information which lead to this case was collected before the E2E encryption was rolled out.
sehugg 11y ago
FWIW this is an article with a headline closer to the original, though with no additional information: http://www.businessinsider.com/whatsapp-may-have-gotten-16-alleged-terrorists-busted-2015-6 http://www.businessinsider.com/whatsapp-may-have-gotten-16-a...
comrade1 11y ago
Of course this turns into a debate about the article title on HN...
deleted 11y ago
[deleted]
speculation 11y ago
https://www.schneier.com/blog/archives/2015/06/us_identifies_a.html https://www.schneier.com/blog/archives/2015/06/us_identifies... In the comments on this unrelated story of identifying a terrorist people argued that it's possible the story is deliberate misinformation, it could also be the case here.
- late2part 11y ago
  To what end? To encourage Terrorists to use another mechanism, almost certainly better vetted?
kbart 11y ago
I find it funny that somebody could be really so naive to expect privacy from WhatsApp after it got acquired by Facebook. Especially after we've had similar lessons with Skype + Microsoft.
late2part 11y ago
It's called "Consumer Marketing of Encryption." Almost certainly Whatsapp is doing consumer to server encryption, but not end to end. If this is true, then Whatsapp holds or can decrypt the internal storage or transfer of messages. Alternatively, there is a likelihood that the encryption keys are escrowed or trivially encrypted. This is what we're seeing in the consolidating web giant world. Words don't match technical expectations, but they meet the letter of the law. We see/saw the same thing with privacy.
coolgirl43 11y ago
It's good that they are taking actions about it. I take chinese lessons on skype at http://preply.com/en/chinese-by-skype http://preply.com/en/chinese-by-skype and my teacher is really worried about Syria.

76 points by Errorcod3 11y ago

caminante 11y ago

Though, does this mean that the encryption was compromised?

jhallenworld 11y ago
Even with encryption they can probably track who you're communicating with. Perhaps they pushed an insecure version on the suspects.
deleted 11y ago
[deleted]

deleted 11y ago

[deleted]

solarexplorer 11y ago

AFAIK end-to-end encryption can only be used with Android clients. http://www.heise.de/ct/artikel/Keeping-Tabs-on-WhatsApp-s-Encryption-2630361.html http://www.heise.de/ct/artikel/Keeping-Tabs-on-WhatsApp-s-En... tl;dr end-to-end encryption in WhatsApp is not really useful (yet)

zeeed 11y ago
which, if you rely on it, defeats at least one "end" in "end-to-end" if you don't know what device your peer is using. So much for end-to-end encryption in Whatsapp...
- morganvachon 11y ago
  That's exactly what I was thinking. If WhatsApp was an Android-only app, it might be able to claim end-to-end security. Even then a quirk in a certain version of Android on one end, or even a hardware quirk with a certain model phone, could impact security. Of course if you want the most secure communication possible with someone, you won't use a smartphone in the first place. There isn't a cellphone on the planet that's 100% secure from eavesdropping.
  - Cederfjard 11y ago
    >If WhatsApp was an Android-only app, it might be able to claim end-to-end security. Have they made this claim though, or stated it as a goal?
    - morganvachon 11y ago
      They did a while back: http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ http://www.wired.com/2014/11/whatsapp-encrypted-messaging/
- jokr004 11y ago
  I've never used Whatsapp, but maybe they inform you whether or not the other end supports and is using encryption? It would certainly be easy for them to do something like that, hopefully they do.
  - solarexplorer 11y ago
    They don't...

mapgrep 11y ago

"In its initial phase, though, Whatsapp’s messaging encryption is limited to Android, and doesn’t yet apply to group messages, photos or video messages. " http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ http://www.wired.com/2014/11/whatsapp-encrypted-messaging/

phreeza 11y ago

Seems very unwise of them to disclose this capability, if it exists. Might be a red herring? Or maybe an accidental disclosure through due to belgian/US miscommunication.

briandear 11y ago
From an intelligence perspective this was profoundly dumb to reveal. This is the heart of what protecting sources and methods is all about. However, it really should go without saying that one should operate in the assumption that all digital communications are compromised, at least commercial services.

nly 11y ago

As much as I like and respect Moxie, I think it's a huge personal risk for him to associate himself with Facebook (WhatsApp)[0]. That said, come on... there's no user exposed key management in Whatsapp, or secure means to perform a handshake with your contacts. Even if they've really rolled out Moxies crypto protocol on Android, like they claim (go look at the source and verify... oh, wait), on features alone you can't trust it... you just can't create a secure channel unless you're in control of the keys. And on terrorists using Whatsapp... well, Whatsapp accounts are tied to your cell phone #. The authorities can work with WhatsApp to piece together who messaged who, and when, and where you both physically were at the time. This is enough to bust terrorists. Deploying E-to-E crypto was never about anonymity. [0] https://whispersystems.org/blog/whatsapp/ https://whispersystems.org/blog/whatsapp/

deleted 11y ago

[deleted]

dsjoerg 11y ago

Maybe you missed this — when end-to-end encryption was launched, they mentioned that they did not yet encrypt iOS, nor group chat. https://whispersystems.org/blog/whatsapp/ https://whispersystems.org/blog/whatsapp/ Did they make a subsequent announcement that they were encrypting those?

higherpurpose 11y ago
Who's they? Because Whatsapp has never said it uses end to end encryption - anywhere. Also, I guess it is possible that the so called terrorists used iPhones, but I think there's a higher chance they used Android phones. Of course we don't know exactly, but either way you shouldn't have assumed Whatsapp uses end-to-end encryption even before this. So those who thought Whatsapp was "safe", treat this as yet another warning sign that you shouldn't be using it for private conversations. Those who were already paranoid about it, you probably weren't using it already for that, so this changes nothing.
- toong 11y ago
  Why do you think it's more likely they used Android phones ? As of May 2015, iOS has 53.5% of the mobile market Android 41.7% (in Belgium) - source: http://howwebrowse.be/ http://howwebrowse.be/
  - e28eta 11y ago
    My guess would be price, especially if they're periodically changing phones to reduce their chances of surveillance. OTOH maybe they weren't doing that.
  - Light2Yellow 11y ago
    I want to add that not only the price is crucial but a bit of security. Using a closed OS with belief you're not being tracked? Well, they are not so stupid. The best choice for such things is a chinese no-name-smartphone on Android or just an old Nokia on Symbian^3 or 9.4.
- morganvachon 11y ago

simonvc 11y ago

Even if you do you use an app that always uses crypto end to end (e.g. signal/textsecure) https://whispersystems.org/blog/signal/ https://whispersystems.org/blog/signal/ There's no guarantee that apple/google/microsoft haven't been ordered to install a backdoored version. tl;dr RMS was right

dogma1138 11y ago
It's by far easier to force MSFT, Google or Apple to backdoor the device rather than an individual app. Especially since at least on Android devices you can always pull the APK you got form the store apart and see if it's being messed with.

tptacek 11y ago

You're not supposed to do this with story titles. The correct title for this story would be "Belgium Arrests Two in Probe Over Returning Syria Fighter".

roryhughes 11y ago
Yeah but OP is trying to point out a specific piece of information that's relevant for hacker news users. It wouldn't have been read through otherwise.
- shepardrtc 11y ago
  OP has no information other than that Whatsapp was used. The title is not appropriate.
flurdy 11y ago
Unfortunately that title would not be very descriptive why the story is relevant on Hacker News.
jokr004 11y ago
To be fair, that doesn't shed any light on what the submitter is trying to point out.
morganvachon 11y ago
I think in this particular case the story title applies. The part of the story that is interesting/important to HN users is about WhatsApp's compromised encryption, not so much the arrest and charges. Perhaps a nod to the article's title would be better though; something like "Suspects Arrested in Probe Based On WhatsApp Eavesdropping". That covers both aspects of the story.
- tptacek 11y ago
  https://hn.algolia.com/?query=author:dang%20editorialize&sort=byPopularity&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=author:dang%20editorialize&sor...

dogma1138 11y ago

As many have pointed out Whats App's E2EE isn't deployed on all platforms and messaging services. Furthermore they've only rolled it out about 6 months ago, there's a good chance that the information which lead to this case was collected before the E2E encryption was rolled out.

sehugg 11y ago

FWIW this is an article with a headline closer to the original, though with no additional information: http://www.businessinsider.com/whatsapp-may-have-gotten-16-alleged-terrorists-busted-2015-6 http://www.businessinsider.com/whatsapp-may-have-gotten-16-a...

comrade1 11y ago

Of course this turns into a debate about the article title on HN...

deleted 11y ago

[deleted]

speculation 11y ago

https://www.schneier.com/blog/archives/2015/06/us_identifies_a.html https://www.schneier.com/blog/archives/2015/06/us_identifies... In the comments on this unrelated story of identifying a terrorist people argued that it's possible the story is deliberate misinformation, it could also be the case here.

late2part 11y ago
To what end? To encourage Terrorists to use another mechanism, almost certainly better vetted?

kbart 11y ago

I find it funny that somebody could be really so naive to expect privacy from WhatsApp after it got acquired by Facebook. Especially after we've had similar lessons with Skype + Microsoft.

late2part 11y ago

It's called "Consumer Marketing of Encryption." Almost certainly Whatsapp is doing consumer to server encryption, but not end to end. If this is true, then Whatsapp holds or can decrypt the internal storage or transfer of messages. Alternatively, there is a likelihood that the encryption keys are escrowed or trivially encrypted. This is what we're seeing in the consolidating web giant world. Words don't match technical expectations, but they meet the letter of the law. We see/saw the same thing with privacy.

coolgirl43 11y ago

It's good that they are taking actions about it. I take chinese lessons on skype at http://preply.com/en/chinese-by-skype http://preply.com/en/chinese-by-skype and my teacher is really worried about Syria.