9 ms·

"Absolutely no way"? I'm sorry to be impolite about it, but that's a bit of an exaggeration: one could jailbreak their phone, pull the binary into their compute

by davisr 11y ago

"Absolutely no way"? I'm sorry to be impolite about it, but that's a bit of an exaggeration: one could jailbreak their phone, pull the binary into their computer, decompile it, and inspect it for implementation structures that would be coherent with how the two or three most popular encryption algorithms are commonly implemented. The expertise to be able to accomplish it doesn't come cheap, but it's certainly in the realm for anyone willing to invest the time. If anyone out there does it, feel free to post your findings to http://imfreedom.org/ http://imfreedom.org/. I'd be willing to bet that WhatsApp has some competent programmers, and looks very similar to how Apple's built iMessage. I think everyone is entitled to the most security possible, but unfortunately when you're at the scale of WhatsApp, perfect security would make all that ultra-tantalizing data pretty hard to analyze. They're a business, they have a responsibility to their investors to grow the business, and data right now is a _big_ business.

JupiterMoon 11y ago
So you've probably just broken the law by doing so. And you have to do this everytime the app gets updates. And you have to be sure that the encryption is actually getting used on every message. And that the key is strong and not known to Whatsapp. And also that the recipients copy of the app is behaving the same as yours. So I guess the question is, if you had something to hide would you bet your life on it? Whereas with Textsecure. Well it just works...
- jsprogrammer 11y ago
  >So you've probably just broken the law by doing so. By modifying your own device? I don't think so.
  - JupiterMoon 11y ago
    Many countries have laws against reverse engineering programs. Whilst I think these laws are stupid I would prefer to just use the open source program than mess around with the closed source alternative.
    - nitrogen 11y ago
      According to Wikipedia[0], reverse engineering is generally legal in the US: In the United States even if an artifact or process is protected by trade secrets, reverse-engineering the artifact or process is often lawful as long as it has been legitimately obtained. [0] https://en.wikipedia.org/wiki/Reverse_engineering#United_States https://en.wikipedia.org/wiki/Reverse_engineering#United_Sta...
      - aw3c2 11y ago
        And that is one country out of ~200.
        blfr 11y ago
        Yes but it has 350M people living in it, half the HN, Silicon Valley, and Moxie with his team. It's not honest to say the US is just another country among 200.
        lostlogin 11y ago
        Ones answer to that probably depends on where they live.
        tP5n 11y ago
        yep, in other words around 4% of the world's population live in the US and of course this pales in comparison to actually large nation states, like india or china.
        celticninja 11y ago
        it is honest to say that, it's just that americans like to think they are special.
        celticninja 11y ago
        it is honest to say that, it's just that americans like to think they are special.
      - 11y ago
higherpurpose 11y ago
At the very least I would want Whatsapp to: 1) add authentication with other users 2) make a public statement about it (believe it or not, that hasn't happened yet. Perhaps it will come when the iOS versions supports it - or perhaps it never will) 3) commit to the new encryption system in their privacy policy (make it at least somewhat legally binding - which could also be used against abusive law enforcement orders)
mightybyte 11y ago
> one could jailbreak their phone, pull the binary into their computer, decompile it, and inspect it for implementation structures that would be coherent with how the two or three most popular encryption algorithms are commonly implemented. There's a much easier way. Turn off your phone's cellular connection, but turn on wifi and connect it to a wifi network you control. Then just sniff the packets.
- stouset 11y ago
  Not unless you have discovered a novel technique for distinguishing between good crypto and bad crypto over the wire.

by davisr 11y ago

JupiterMoon 11y ago

So you've probably just broken the law by doing so. And you have to do this everytime the app gets updates. And you have to be sure that the encryption is actually getting used on every message. And that the key is strong and not known to Whatsapp. And also that the recipients copy of the app is behaving the same as yours. So I guess the question is, if you had something to hide would you bet your life on it? Whereas with Textsecure. Well it just works...

jsprogrammer 11y ago
>So you've probably just broken the law by doing so. By modifying your own device? I don't think so.
- JupiterMoon 11y ago
  Many countries have laws against reverse engineering programs. Whilst I think these laws are stupid I would prefer to just use the open source program than mess around with the closed source alternative.
  - nitrogen 11y ago
    According to Wikipedia[0], reverse engineering is generally legal in the US: In the United States even if an artifact or process is protected by trade secrets, reverse-engineering the artifact or process is often lawful as long as it has been legitimately obtained. [0] https://en.wikipedia.org/wiki/Reverse_engineering#United_States https://en.wikipedia.org/wiki/Reverse_engineering#United_Sta...
    - aw3c2 11y ago
      And that is one country out of ~200.
      - blfr 11y ago
        Yes but it has 350M people living in it, half the HN, Silicon Valley, and Moxie with his team. It's not honest to say the US is just another country among 200.
        lostlogin 11y ago
        Ones answer to that probably depends on where they live.
        tP5n 11y ago
        yep, in other words around 4% of the world's population live in the US and of course this pales in comparison to actually large nation states, like india or china.
        celticninja 11y ago
        it is honest to say that, it's just that americans like to think they are special.
        celticninja 11y ago
        it is honest to say that, it's just that americans like to think they are special.
    - 11y ago

higherpurpose 11y ago

At the very least I would want Whatsapp to: 1) add authentication with other users 2) make a public statement about it (believe it or not, that hasn't happened yet. Perhaps it will come when the iOS versions supports it - or perhaps it never will) 3) commit to the new encryption system in their privacy policy (make it at least somewhat legally binding - which could also be used against abusive law enforcement orders)

mightybyte 11y ago

> one could jailbreak their phone, pull the binary into their computer, decompile it, and inspect it for implementation structures that would be coherent with how the two or three most popular encryption algorithms are commonly implemented. There's a much easier way. Turn off your phone's cellular connection, but turn on wifi and connect it to a wifi network you control. Then just sniff the packets.

stouset 11y ago
Not unless you have discovered a novel technique for distinguishing between good crypto and bad crypto over the wire.