It seems as if WhatsApp is short circuiting this frustrating series of timeouts to improve a flaky seeming UX. That strategy does negatively effect people on the internet who register for WhatsApp with Saudi VoIP numbers when they're in France, but it is a much clearer UX for almost everyone who is actually a Saudi WhatsApp user or calling actual Saudi users. What the author is demanding is a worse UX for the same outcome.

It sounds like there might be room for improvement, but I have a feeling that if WhatsApp were recording their users' locations in order to provide a more advanced location-aware version of the same strategy, people would not be very happy about that.

They don't need to record your location. WhatsApp client can just query your IP address and silence the call-prohibiting UX if it finds out you're outside Saudi address space. This is an exceedingly obvious solution with no effect on user privacy.

Good luck convincing them that the location is not being logged permanently by WhatsApp servers -- or even sent to them in the first place.

On iOS, you would get an error saying "Call couldn't connect. X's mobile carrier or WiFi doesn't support WhatsApp calls".

In order to know when ZRTP will fail WhatsApp would need to maintain lists of address space where ISPs drop such packets. It would have to be done on the client side, but then clients can't easily discover their public address because NAT. The signaling server that sets up the call could check easily, but if the server decided when not to use encryption that would be a backdoor.

It's easier to just do it by country code, despite the drawbacks.

Signal does use ZRTP. It just doesn't use SIP. ZRTP is currently the best choice for voice.

I beg to differ. ZRTP is currently the best choice for voice when the caller and callee share no key material to begin with. In the context of Signal-the-app, the caller and callee often do share key material, but the protocol (to the best of my knowledge) doesn't bother to use that key material to authenticate the voice channel. This means that two users with the ability to securely text-message each other can still have their voice calls tapped if they fail to validate the short code each time.

The same omission also means that you cannot confirm that you have real end-to-end encryption by making a voice call and comparing the short authentication string on the screen.

I don't know whether Signal-the-protocol in WhatsApp is better designed, but calling ZRTP a good choice is ignoring the fact that current uses are not well thought out.

I think it's still a good idea for clients to display the SAS even when signed with another key. Especially when that session was established with a protocol which uses the TOFU model.

So I don't think saying "there's no way to tell" is entirely accurate

I assume that higher latency communication like WhatsApp's push-to-talk "voice notes" works just fine in SA though.

No one that worked there wanted to do it, but refusing to do so would be reason to have them dismissed from their jobs.

Many employees are expats; leaving their jobs would mean a loss of their residence and thus deportation.

Such is life in a police state.

> but refusing to do so would be reason to have them dismissed from their jobs.

I've quit jobs on principle before. The key is to have a nest egg.

> Many employees are expats; leaving their jobs would mean a loss of their residence and thus deportation.

Could they find another job?

Police states are very shitty indeed.

> I've quit jobs on principle before. The key is to have a nest egg.

A lot of the expats come from Lebanon, Syria, Pakistan, India, and occasionally Eastern Europe. Almost all of them that I know have families they need to support (immediate and sending remittances), and the money is a lifeline. Being deported back and/or being blacklisted from the GCC is a life-ruining scenario. Getting visas to the west is not always an option.

>Could they find another job?

It's possible, but all countries in the GCC operate under a Kafala (sponsorship) system. Having it revoked in one GCC member state raises complications in others.

For those wondering, GCC = Gulf Cooperation Council, not the compiler.

(edit for clarity)

All you need to do is profile for relatively constant data transfer rates over the course of many minutes that exceed a very low minimum.

If Whatsapp uses a media proxy for calls then you could just trigger on connections made to these servers where these data transfers in question occur.

But even if they don't use a media proxy they'll the clients will connect to specific IP's for call signalling and that's when you'll also know that a call was attempted.

I'm neither defending Saudi Arabia nor Whatsapp, just wanted to let you know that there are very simple ways to detect calls. I'm sure that there are even better, much more advanced techniques that are currently in use by both oppressive (and likely our) governments.

Once you have that you can block media transfer, or if the clients use peer to peer media transfer at least block the call signalling.

After this it is only a matter of keeping the list of IP's updated which you could easily do by ongoing logging of bandwidth used.

Bandwidth usage pops up in your logs that somehow resembles the profile of a call - investigate by doing a simple test and then block the IP.

Erm, well...I suppose this could be done if you're fond of the "navigating through the digestive terminus to arrive at the synovial hinge" method[1]. There are several much easier and much less lossy ways of blocking voice transmissions streams that doesn't involve continuous and arduous logging of IP addresses or even blocks of IP addresses.

---

[1] also known as "going through your ass to get to your elbow"

Still my point remains valid I believe: The OP claimed with certainty that no one could know if a call is being made which is wrong.

But you can outline your ideas on how to detect a call attempt without "going through your ass to get to your elbow" as you put it.

I still feel that blocking IP's or ports is an easy solution for governments that feel the need to censor.

I live in the UAE and it's exactly the same over here.

Write a bunch of different protocols and switch randomly - or use steganography - use machine learning to evade the block - buy a bunch of existing apps and hide the data in their protocols - put up a fake weak encryption, detect "dissident" talk, and in that case generate a long nonsense recording for the censors from the voices of the speakers, hiding the true message steganographically :-) - or basically anything they can come up with.

Or - Saudi Arabia is not such a big market - make a complete theatric fuss about it and complain about human rights and so on, close all FB and WhatsApp connections and burn all bridges, and milk it for publicity.

(Only being half serious here :-) but I would be really tempted to do something mischievous in their case rather than comply.)

Maybe it's just a use case they missed - but quite a significant one!