Re:SS7 MITM Attack Against WhatsApp and Telegram
by snowpanda on Wednesday May 11, 2016 @04:23AM
(#11673485)
>This kind of attack is devastating for Telegram
Security flaws are found with any software on a regular basis. To say that it will 'devastate' a project is completely blown out of proportion. The first TrueCrypt had a lot of flaws and it still were to become the most popular encryption software. The whole point of updates is that something can be improved when flaws are found.
>For WhatsApp, everything is end to end encrypted by
default, so the attacker doesn't get any message history. All of the contacts for the MITM'd user also get a notice that their contact's security code changed, and a comparison will fail to match. This is exactly what E2E was built to protect against.
All of this 'safety' is rendered false hope when we can't conclude that WhatsApp isn't backdoored. Trusting a closed source project by Facebook is completely nonsensical imo.
Security flaws are found with any software on a regular basis. To say that it will 'devastate' a project is completely blown out of proportion. The first TrueCrypt had a lot of flaws and it still were to become the most popular encryption software. The whole point of updates is that something can be improved when flaws are found.
>For WhatsApp, everything is end to end encrypted by default, so the attacker doesn't get any message history. All of the contacts for the MITM'd user also get a notice that their contact's security code changed, and a comparison will fail to match. This is exactly what E2E was built to protect against.
All of this 'safety' is rendered false hope when we can't conclude that WhatsApp isn't backdoored. Trusting a closed source project by Facebook is completely nonsensical imo.