12 ms·

Given that we have the man himself onboard - can I urge you to ask the WSJ to remove the comment at the start of the article about WhatsApp implementing your en

by tw04 11y ago

Given that we have the man himself onboard - can I urge you to ask the WSJ to remove the comment at the start of the article about WhatsApp implementing your encryption schema? Unless I've missed something, there's absolutely no way for an end-user to determine if their messages are being encrypted (with whatsapp). Or how they're being encrypted for that matter. I feel like WhatsApp latched onto your groundwork (potentially even with good intentions) - but never actually has opened up about the implementation, opened the code to audit, or been forthright about exactly who/how many users are covered. I fear articles like this just make the average joe think "oh, whatsapp == secure" when recent events have proven that's far, far from the truth. http://arstechnica.com/tech-policy/2015/06/intercepted-whatsapp-messages-led-to-belgian-terror-arrests/ http://arstechnica.com/tech-policy/2015/06/intercepted-whats...

tedunangst 11y ago
Start with the linked reddit comment? https://www.reddit.com/r/Android/comments/34ecja/the_heise_security_team_investigated_whatsapps/cqtygha https://www.reddit.com/r/Android/comments/34ecja/the_heise_s...
Permit 11y ago
Part way through the article they say: >Last fall, WhatsApp added Mr. Marlinspike’s encryption scheme to text messages between users with Android smartphones, but there is no easy way to verify that the encryption software is actually turned on. So they're being pretty open about the fact users can't determine if their messages are truly encrypted.
- xerophyte12932 11y ago
  Yes but that's so deep down. A large number of people read the beginning and skim to the end. They might miss it. So it is a bit misleading IMO. Disclaimers should be more obvious
  - deleted 11y ago
    [deleted]
davisr 11y ago
"Absolutely no way"? I'm sorry to be impolite about it, but that's a bit of an exaggeration: one could jailbreak their phone, pull the binary into their computer, decompile it, and inspect it for implementation structures that would be coherent with how the two or three most popular encryption algorithms are commonly implemented. The expertise to be able to accomplish it doesn't come cheap, but it's certainly in the realm for anyone willing to invest the time. If anyone out there does it, feel free to post your findings to http://imfreedom.org/ http://imfreedom.org/. I'd be willing to bet that WhatsApp has some competent programmers, and looks very similar to how Apple's built iMessage. I think everyone is entitled to the most security possible, but unfortunately when you're at the scale of WhatsApp, perfect security would make all that ultra-tantalizing data pretty hard to analyze. They're a business, they have a responsibility to their investors to grow the business, and data right now is a _big_ business.
- JupiterMoon 11y ago
  So you've probably just broken the law by doing so. And you have to do this everytime the app gets updates. And you have to be sure that the encryption is actually getting used on every message. And that the key is strong and not known to Whatsapp. And also that the recipients copy of the app is behaving the same as yours. So I guess the question is, if you had something to hide would you bet your life on it? Whereas with Textsecure. Well it just works...
  - jsprogrammer 11y ago
    >So you've probably just broken the law by doing so. By modifying your own device? I don't think so.
    - JupiterMoon 11y ago
      Many countries have laws against reverse engineering programs. Whilst I think these laws are stupid I would prefer to just use the open source program than mess around with the closed source alternative.
ytdht 11y ago
even if an Android application would communicate with others 100% securely, Google has wireless administrator privileges and can be served secret letters that can order Google to do anything, so technically they could log the data before it's encrypted.
- venomsnake 11y ago
  Only if you have google services installed.
  - aw3c2 11y ago
    Without which TextSecure does not work.
    - em3rgent0rdr 11y ago
      But what about the fork https://github.com/SMSSecure/SMSSecure https://github.com/SMSSecure/SMSSecure which can be installed on via f-droid google-less phone?
      - psykovsky 11y ago
        The fork only handles SMS/MMS. There are no IM features in it.
      - aw3c2 11y ago
        It has no push messages which means bad experience for non-SMS messages.
- jMyles 11y ago
  Will an I/O audit of the network interface will detect this?
  - drcross 11y ago
    No. How do you propose that it would?
jsprogrammer 11y ago
> there's absolutely no way for an end-user to determine if their messages are being encrypted (with whatsapp) Watch the network traffic with Wireshark?
- drcross 11y ago
  You cant see into the encrypted traffic to see if it's implemented or not.
  - jacquesm 11y ago
    But in the worst case you'll be able to see that it is plaintext.
    - em3rgent0rdr 11y ago
      I would expect any messaging app these days woud never send pafkets with plain text.

by tw04 11y ago

tedunangst 11y ago

Start with the linked reddit comment? https://www.reddit.com/r/Android/comments/34ecja/the_heise_security_team_investigated_whatsapps/cqtygha https://www.reddit.com/r/Android/comments/34ecja/the_heise_s...

Permit 11y ago

Part way through the article they say: >Last fall, WhatsApp added Mr. Marlinspike’s encryption scheme to text messages between users with Android smartphones, but there is no easy way to verify that the encryption software is actually turned on. So they're being pretty open about the fact users can't determine if their messages are truly encrypted.

xerophyte12932 11y ago
Yes but that's so deep down. A large number of people read the beginning and skim to the end. They might miss it. So it is a bit misleading IMO. Disclaimers should be more obvious
- deleted 11y ago
  [deleted]

davisr 11y ago

"Absolutely no way"? I'm sorry to be impolite about it, but that's a bit of an exaggeration: one could jailbreak their phone, pull the binary into their computer, decompile it, and inspect it for implementation structures that would be coherent with how the two or three most popular encryption algorithms are commonly implemented. The expertise to be able to accomplish it doesn't come cheap, but it's certainly in the realm for anyone willing to invest the time. If anyone out there does it, feel free to post your findings to http://imfreedom.org/ http://imfreedom.org/. I'd be willing to bet that WhatsApp has some competent programmers, and looks very similar to how Apple's built iMessage. I think everyone is entitled to the most security possible, but unfortunately when you're at the scale of WhatsApp, perfect security would make all that ultra-tantalizing data pretty hard to analyze. They're a business, they have a responsibility to their investors to grow the business, and data right now is a _big_ business.

JupiterMoon 11y ago
So you've probably just broken the law by doing so. And you have to do this everytime the app gets updates. And you have to be sure that the encryption is actually getting used on every message. And that the key is strong and not known to Whatsapp. And also that the recipients copy of the app is behaving the same as yours. So I guess the question is, if you had something to hide would you bet your life on it? Whereas with Textsecure. Well it just works...
- jsprogrammer 11y ago
  >So you've probably just broken the law by doing so. By modifying your own device? I don't think so.
  - JupiterMoon 11y ago
    Many countries have laws against reverse engineering programs. Whilst I think these laws are stupid I would prefer to just use the open source program than mess around with the closed source alternative.

ytdht 11y ago

even if an Android application would communicate with others 100% securely, Google has wireless administrator privileges and can be served secret letters that can order Google to do anything, so technically they could log the data before it's encrypted.

venomsnake 11y ago
Only if you have google services installed.
- aw3c2 11y ago
  Without which TextSecure does not work.
  - em3rgent0rdr 11y ago
    But what about the fork https://github.com/SMSSecure/SMSSecure https://github.com/SMSSecure/SMSSecure which can be installed on via f-droid google-less phone?
    - psykovsky 11y ago
      The fork only handles SMS/MMS. There are no IM features in it.
    - aw3c2 11y ago
      It has no push messages which means bad experience for non-SMS messages.
jMyles 11y ago
Will an I/O audit of the network interface will detect this?
- drcross 11y ago
  No. How do you propose that it would?

jsprogrammer 11y ago

> there's absolutely no way for an end-user to determine if their messages are being encrypted (with whatsapp) Watch the network traffic with Wireshark?

drcross 11y ago
You cant see into the encrypted traffic to see if it's implemented or not.
- jacquesm 11y ago
  But in the worst case you'll be able to see that it is plaintext.
  - em3rgent0rdr 11y ago
    I would expect any messaging app these days woud never send pafkets with plain text.