Re:SS7 MITM Attack Against WhatsApp and Telegram
by nexxer on Wednesday May 11, 2016 @10:58AM
(#11675896)
My mother stopped using Whatsapp completely when she saw the "your chats are now encrypted" message the first time, until she reached out and I explained it was OK.
Re:SS7 MITM Attack Against WhatsApp and Telegram
by feld on Tuesday May 10, 2016 @10:37PM
(#11672274)
Why would the key change? This makes no sense. You generate once and never again unless they replace their phone.
I really hope it's not a new set of keys every time Whatsapp updates...
Re:SS7 MITM Attack Against WhatsApp and Telegram
by sievebrain on Wednesday May 11, 2016 @05:31AM
(#11673819)
Because people do replace their phone, and also uninstall/reinstall the app or wipe app data etc.
You could argue (and I have done) that a key change event should be surfaced in the UI as "Your contact has switched to a new $MODEL_NAME phone" so if it occurs in the middle of a conversation or you happen to know they really haven't upgraded, it can lead people to tap it and learn more. An alert like "Contact key has changed" would be meaningless. But it's also the case that notifications that seem useless to people rapidly get phased out, and unfortunately any notification that boils down to "you MIGHT be being attacked by your own government but PROBABLY your friend just dropped their phone" is a non starter.
Spamming users with warnings that 99.9999% of the time will not be understandable let alone actionable is a quick way to get another SSL warning dialog scenario.