News for hackers. Stuff that matters.

A comment on SS7 MITM Attack Against WhatsApp and Telegram.

Re:SS7 MITM Attack Against WhatsApp and Telegram by leecarraher on Tuesday May 10, 2016 @01:44PM (#11669059)
i can't say much for telegram as their encryption has been broken, and is not an openned, but whatsapp's new signal protocol designed by moxy marlinspike doesn't use sms to authenticate. It doesn't by default require authentication, but rather has it as an option and the option generates a long 80 character passcode or QR code, to be communicated in person or via some out of band communication channel, similar to threma. Maybe they are talking about old whatsapp?
[ Parent | on HN ]
Re:SS7 MITM Attack Against WhatsApp and Telegram by pfg on Tuesday May 10, 2016 @01:51PM (#11669120)
I think the article is referring to the fact that out-of-band key verification is optional and isn't something that most users will perform. If you're doing out-of-band key verification with all your contacts, and have enabled the setting that'll make WhatsApp notify you about key changes of your contacts, this doesn't concern you.
[ Parent | on HN ]
Re:SS7 MITM Attack Against WhatsApp and Telegram by moxie on Tuesday May 10, 2016 @02:25PM (#11669373)
Most users probably aren't worried about targeted attacks from adversaries who've compromised SS7, either. But the ones that are have an easy option.
[ Parent | on HN ]
Re:SS7 MITM Attack Against WhatsApp and Telegram by lunula on Tuesday May 10, 2016 @06:30PM (#11671218)
Do you have a link describing how the E2E encryption in telegram been broken? For what its worth, the client code where all the encryption happens is open source. It'd be so nice if whatsapp would do the same.
[ Parent | on HN ]
Re:SS7 MITM Attack Against WhatsApp and Telegram by imaginology on Tuesday May 10, 2016 @06:44PM (#11671284)
It's not broken. People keep echoing that accusation but nobody has ever provided a valid source.
[ Parent | on HN ]