Am I missing something here? I don't see how this attack would be useful against end-to-end encrypted messaging apps (well, properly implemented ones at least).
Maybe it's something else I'm missing, which is why it would be good for Moxie or Whatsapp to clear up this puzzling choice.
Also I hope both the Whatsapp and Signal teams think of ways to encourage security code authentication through better UI. Viber, for instance, has taken an interesting approach to encouraging easier authentication. It probably still doesn't go far enough to make it easy enough for just about anyone to want to authenticate their contacts, but I'd like to see more of this sort of UI experimentation:
https://support.viber.com/customer/portal/articles/2017401-v...
Moxie did not make Whatsapp. He made the protcol originally designed for Signal/TextSecure that Whatsapp uses. It's a little extreme to blame him for what is basically a UX/GUI decision on an app that just uses his protocol.
Spamming users with warnings that 99.9999% of the time will not be understandable let alone actionable is a quick way to get another SSL warning dialog scenario.
I really hope it's not a new set of keys every time Whatsapp updates...
You could argue (and I have done) that a key change event should be surfaced in the UI as "Your contact has switched to a new $MODEL_NAME phone" so if it occurs in the middle of a conversation or you happen to know they really haven't upgraded, it can lead people to tap it and learn more. An alert like "Contact key has changed" would be meaningless. But it's also the case that notifications that seem useless to people rapidly get phased out, and unfortunately any notification that boils down to "you MIGHT be being attacked by your own government but PROBABLY your friend just dropped their phone" is a non starter.
Against what, though? The key that Whatsapp asserts is valid for the other user?
As far as I am aware there's no way to access and visually eyeball-compare the raw keys in Whatsapp, just what the app presents as a signature or QR code. Open to correction.
No, against the other person sitting at the table with you via QR code scanning.
Or their voice speaking the public key via another channel.
> just what the app presents as a signature or QR code. Open to correction.
What's wrong with the QR code? That QR code is a hash of the public key and exactly what you need for this identity verification purpose.
If the pubkey changes after you've scanned it, you know you've got to verify that person again before sharing anything private over that channel.
I have no way to verify that.
If WhatsApp is trustworthy and secure, then the QR code might be a hash of the public key, but to be completely frank, it could be anything.
* I don't have the source code.
* Nobody I know has the source code
* Nobody I know has bothered to jailbreak their device and/or decompile the binary. I just got an update recently, and my friends are busy.
If I had access to my own public and private key, I (or someone I know) could conceivably verify that I'm using it by decrypting my messages using another device (e.g. using wireshark).
I appreciate that you might have the source code, or know someone with the source code, or might have reverse engineered the most recent update and have more confidence than I do, but you cannot transmit that confidence to me by simply insisting that it is the hash of the public key.
The problem being solved here is validating that another Whatsapp user's key belongs to a flesh-and-blood person you know. We're taking it on faith at this point that Whatsapp's application is trustworthy. If it's not, validating keys is useless -- the app could upload all your chat transcripts in the background for all we know.
No.
This is completely and totally wrong.
This isn't a court of law on US television: You aren't trustworthy until proven otherwise.
If your argument is "let's not trust Whatsapp", then it helps not to confuse it with discussion about QR codes.
We're bad at it, because we can't tell the difference between a "QR code is a hash of the public key", and a "QR code is something WhatsApp tells us represents this other person."
Why not just use pictures of puppies? Pick the puppy you've seen represent this person before, and be suspicious if the puppy's changed! Try talking to them in person about the puppy icon used for them and make sure they match! That is actually more secure than the QR code, even if it still doesn't protect you from WhatsApp.
The reason we're talking about QR codes is because they seem more secure than puppies; to make someone think that this QR code is actually security measure! While this attack may be "foiled" by E2E cryptosystems, it's important to note the big fucking trapdoor that means WhatsApp isn't actually providing E2E protection.
Conflating this simple fact with the overarching boogeyman of "validating software" does the discussion a disservice.
Good. You appear to understand the problem now.
I already alluded to the solution here:
> If I had access to my own public and private key, I (or someone I know) could conceivably verify that I'm using it by decrypting my messages using another device (e.g. using wireshark).
and here:
> That's why providing the keys (or better: being able to supply my own) is essential.
See, if I have the keypair, then for WhatsApp to subvert my conversation it needs to send the private key to itself -- something it can only do when it's not looking.
This means it would need to let me download the keys before it does any networking. If it absolutely must network before letting me have the keys, then it can allow me to install my own (new) keys. Then, WhatsApp doesn't know when I'm not looking.
If WhatsApp made it possible to catch them being dishonest, then it only takes one person to catch them and their name becomes mud.
Of course, the mere possibility that moxie could be compromised or even make a mistake is clearly too big a leap for HN these days...
> This means it would need to let me download the keys before it does any networking. If it absolutely must network before letting me have the keys, then it can allow me to install my own (new) keys. Then, WhatsApp doesn't know when I'm not looking.
Look up signed Diffie-Hellman. Have fun trying to capture that with Wireshark. You'd need a custom MITM tool. That or you're suggesting the developer gives up forward secrecy and passive attack resistance.
Sure, but we're talking about this specific attack's effect on WhatsApp, if you want to debate the relative merits of open source vs closed source End-To-End encryption tools, you may have a point, but it's not one that's relevant here as it has nothing to do with this attack. Unless the attack can be used to update the app or something with a modified malicious version.
Say it were Signal instead of WhatsApp if you must. Is there any effect made by this attack?
This is what's known as a false dichotomy.
Both systems are as implemented not secure from this attack for the reason I just said.
If you are using a mobile phone you have already lost in the security stakes.
Now to authenticate a user out of band you can just have a shared secret that both users need to enter. You can share that secret via another channel in hope that it is not man-in-the-middled (or at least not by the same attacker). But then it is close to a trust on first use (TOFU) security: often "good enough", sometimes not (SMS).
Now if you're looking for cool ways to force the user to do it IRL, there are things like Bluetooth and NFC that would help.
There are also easier ways to do that, as ashitlerferad says, that we use for larger problems like mail and www: web of trust (WOT) and public key infrastructure (PKI).
This fails for two anonymous people... but that's "by design" of being anonymous.
It's almost like a tautology: by definition, someone who is anonymous has no identity to authenticate.
Central authorities: SSL, DNSSEC
TOFU: SSH, OTR etc
Web of trust: OpenPGP
Not sure, but I think Signal/WhatsApp a combination of central authority, TOFU and in-person 2 party verification, but no web of trust.
It can be handy to ask questions such as "Where did we go last Friday", perhaps even allowing for users to ask multiple questions for added confidence.
Security flaws are found with any software on a regular basis. To say that it will 'devastate' a project is completely blown out of proportion. The first TrueCrypt had a lot of flaws and it still were to become the most popular encryption software. The whole point of updates is that something can be improved when flaws are found.
>For WhatsApp, everything is end to end encrypted by default, so the attacker doesn't get any message history. All of the contacts for the MITM'd user also get a notice that their contact's security code changed, and a comparison will fail to match. This is exactly what E2E was built to protect against.
All of this 'safety' is rendered false hope when we can't conclude that WhatsApp isn't backdoored. Trusting a closed source project by Facebook is completely nonsensical imo.
The reason that end to end encryption exists is precisely because man in the middle attacks are possible, and always will be. This kind of attack is devastating for Telegram, because by default they don't use end to end encryption, and instead store the entire plaintext history of every message you've ever sent or received, all of which an attacker instantly gets access to.
For WhatsApp, everything is end to end encrypted by default, so the attacker doesn't get any message history. All of the contacts for the MITM'd user also get a notice that their contact's security code changed, and a comparison will fail to match. This is exactly what E2E was built to protect against.