Re:WhatsApp backdoor allows snooping on encrypted messages
by whyever on Friday January 13, 2017 @02:10PM
(#13393720)
You can look at the published court documents:
https://www.documentcloud.org/documents/3120046-Open-Whisper...
The page I linked was the full data they disclosed.
Re:WhatsApp backdoor allows snooping on encrypted messages
by drdaeman on Friday January 13, 2017 @03:46PM
(#13394542)
Thanks.
Seems that they either somehow don't have contact info (but then - how contact discovery's working?) or they had failed to comply with court order. Or I'm really not getting something, which is also well possible (and quite probable) explanation.
Upd: Hmm... or maybe the user had no contacts.
Re:WhatsApp backdoor allows snooping on encrypted messages
by detaro on Friday January 13, 2017 @03:50PM
(#13394575)
I think they just don't keep the contact list. It is uploaded, but only matched against the list of subscribed users at the time of the upload and then deleted. Only downside is that if a contact joins later and does not have you in its contact list you don't get notified, or only when you recheck your contact list.
Your link above says at the end:
For TextSecure, however, we've grown beyond the size where that remains practical, so the only thing we can do is write the server such that it --- doesn't store the transmitted contact information ---, inform the user, and give them the choice of opting out.
Which must mean either I'm misunderstanding something (e.g. things had changed since the blog post was published and relevant GitHub issues were closed), or they had not disclosed some information they have to the US government, or they (or word of mouth, retelling the story) is misinforming users about what was disclosed.
(Upd: Yes, it would be a good idea to go through Signal source code and see what exactly is sent, before making any suggestions that may look like an accusation, but... sorry, the code is quite complicated and I don't think I can figure this out any fast. I found ContactTokenDetails class, but lost my way trying to trace its usage and how it's wrapped/encrypted/etc.)