News for hackers. Stuff that matters.

A comment on WhatsApp backdoor allows snooping on encrypted messages. Parent comment

Re:WhatsApp backdoor allows snooping on encrypted messages by lucb1e on Friday January 13, 2017 @06:57AM (#13390131)
He never said it was. Google services aren't isolated like normal apps either, as far as I know they can access other app's data (when installing cyanogenmod, I had to install google apps in some weird way from the bootloader because it has to change protected things on the phone). His point of requiring google's stuff to be installed is valid, even if he wrote it thinking payload gets sent over it.
[ Parent | on HN ]
Re:WhatsApp backdoor allows snooping on encrypted messages by qznc on Friday January 13, 2017 @07:38AM (#13390339)
Even if you don't install Gapps, large parts of Android/CyanogenMod are from Google as well. How does installing Gapps make the security worse?
[ Parent | on HN ]
Re:WhatsApp backdoor allows snooping on encrypted messages by antocv on Friday January 13, 2017 @07:59AM (#13390453)
Good question.

Stock Android does not, by inspecting network traffic, contact Google servers.

Google play services and other GApps, do, and they can be exploited in this traffic, or told by Google to activate other backdoors.

Signal with GApps, Google can know which phones, and which users, are using Signal, thats a security vulnerability. Google can infer from their Google-messaging thing, that notifications are sent, and have a high probability of knowing if it is to Signal. Who talks when is leaked to Google.

[ Parent | on HN ]
Re:WhatsApp backdoor allows snooping on encrypted messages by svkkfnisgkcn3ta on Friday January 13, 2017 @10:27AM (#13391493)
>Stock Android does not, by inspecting network traffic, contact Google servers.

It does to check for internet access upon connecting to wifi.

https://github.com/copperhead/bugtracker/issues/194

[ Parent | on HN ]
Re:WhatsApp backdoor allows snooping on encrypted messages by lucb1e on Friday January 13, 2017 @07:47AM (#13390387)
Because it's likely someone would have noticed if every AOSP phone called third party servers (or something like that). Plenty of people made Android derivatives, modded it, or just compiled it to toy with. Of course there's no guarantee without a full audit (and even with an audit, they might miss something), but I trust AOSP a lot more than a closed source app suite.
[ Parent | on HN ]