SS7 MITM Attack Against WhatsApp and Telegram

Re:SS7 MITM Attack Against WhatsApp and Telegram by avar on Tuesday May 10, 2016 @02:41PM (#11669518)

For anyone looking for it: Settings -> Account -> Security -> "Show security notifications = on".

[ Parent | on HN ]

Re:SS7 MITM Attack Against WhatsApp and Telegram by mtgx on Tuesday May 10, 2016 @05:55PM (#11670986)

I hope Moxie can share with us why this feature is disabled by default. Does Whatsapp really think the notification would quickly become very annoying for regular users? How often would someone's closest friends really change their phones or uninstall Whatsapp? I imagine not that often for this to be a huge inconvenience, which is why I don't understand why the setting is off by default.

Maybe it's something else I'm missing, which is why it would be good for Moxie or Whatsapp to clear up this puzzling choice.

Also I hope both the Whatsapp and Signal teams think of ways to encourage security code authentication through better UI. Viber, for instance, has taken an interesting approach to encouraging easier authentication. It probably still doesn't go far enough to make it easy enough for just about anyone to want to authenticate their contacts, but I'd like to see more of this sort of UI experimentation:

https://support.viber.com/customer/portal/articles/2017401-v...

[ Parent | on HN ]

Re:SS7 MITM Attack Against WhatsApp and Telegram by AdmiralAsshat on Tuesday May 10, 2016 @09:43PM (#11672077)

I hope Moxie can share with us why this feature is disabled by default. Does Whatsapp really think the notification would quickly become very annoying for regular users? How often would someone's closest friends really change their phones or uninstall Whatsapp? I imagine not that often for this to be a huge inconvenience, which is why I don't understand why the setting is off by default.

Moxie did not make Whatsapp. He made the protcol originally designed for Signal/TextSecure that Whatsapp uses. It's a little extreme to blame him for what is basically a UX/GUI decision on an app that just uses his protocol.

[ Parent | on HN ]

Re:SS7 MITM Attack Against WhatsApp and Telegram by mtgx on Wednesday May 11, 2016 @10:10AM (#11675389)

I didn't blame him, though, but I thought he could share why the Whatsapp team decided to do that.

[ Parent | on HN ]

Re:SS7 MITM Attack Against WhatsApp and Telegram by sievebrain on Tuesday May 10, 2016 @06:51PM (#11671322)

He has said before that key changes in the wild are an extremely common event. I imagine even just the notification that chats are now encrypted caused a lot of confusion and upset given the enormous size of the userbase.

Spamming users with warnings that 99.9999% of the time will not be understandable let alone actionable is a quick way to get another SSL warning dialog scenario.

[ Parent | on HN ]

Re:SS7 MITM Attack Against WhatsApp and Telegram by nexxer on Wednesday May 11, 2016 @10:58AM (#11675896)

My mother stopped using Whatsapp completely when she saw the "your chats are now encrypted" message the first time, until she reached out and I explained it was OK.

[ Parent | on HN ]

Re:SS7 MITM Attack Against WhatsApp and Telegram by feld on Tuesday May 10, 2016 @10:37PM (#11672274)

Why would the key change? This makes no sense. You generate once and never again unless they replace their phone.

I really hope it's not a new set of keys every time Whatsapp updates...

[ Parent | on HN ]

Re:SS7 MITM Attack Against WhatsApp and Telegram by sievebrain on Wednesday May 11, 2016 @05:31AM (#11673819)

Because people do replace their phone, and also uninstall/reinstall the app or wipe app data etc.

You could argue (and I have done) that a key change event should be surfaced in the UI as "Your contact has switched to a new $MODEL_NAME phone" so if it occurs in the middle of a conversation or you happen to know they really haven't upgraded, it can lead people to tap it and learn more. An alert like "Contact key has changed" would be meaningless. But it's also the case that notifications that seem useless to people rapidly get phased out, and unfortunately any notification that boils down to "you MIGHT be being attacked by your own government but PROBABLY your friend just dropped their phone" is a non starter.

[ Parent | on HN ]