News for hackers. Stuff that matters.

A comment on Attack of the Week: Group Messaging in WhatsApp and Signal.

Re:Attack of the Week: Group Messaging in WhatsApp and Signal by ktpsns on Thursday January 11, 2018 @04:26AM (#16122495)
"Do we trust the WhatsApp server?" -- could be also formulated as: "Do we trust the WhatsApp client?". It is obviously made by the same people. Both are closed source and the protocol is reverse engineered. What's the point if they made an auditing but do not communicate the results? It's probably not too surprising if reverse engineering points out vulnerabilities. It's a fenced ecosystem which claims to establish a secure communication but does not.
[ Parent | on HN ]
Re:Attack of the Week: Group Messaging in WhatsApp and Signal by sasas on Thursday January 11, 2018 @06:17AM (#16122932)
> It's a fenced ecosystem which claims to establish a secure communication but does not.

Your concern extends for all systems that require centralisation. Possibly one example of a chat client which addresses the concerns you raise is Ricochet [1].

Your Ricochet messaging client instance acts as a Tor hidden service. Your add contacts by their ricochet ID which is derived from an onion address. There is no central server / service involved. Everything is direct p2p between your messaging client and your peers.

The source code has been audited by NCC group [2].

It's limited - text only, no attachments, no voice.

If your threat model includes adversaries such as nation states, then this is perhaps the tool to use for simple text messaging.

[1] https://ricochet.im/

[2] https://ricochet.im/files/ricochet-ncc-audit-2016-01.pdf

[ Parent | on HN ]
Re:Attack of the Week: Group Messaging in WhatsApp and Signal by george3383 on Thursday January 11, 2018 @06:21AM (#16122944)
Having an open source client and server would help how? How would you know the server is running that software? Or that the binaries distributed via the App Store don't have some special spice?

And as far as I know the whatsapp protocol is simply tokenised XMPP.

[ Parent | on HN ]
Re:Attack of the Week: Group Messaging in WhatsApp and Signal by Karliss on Thursday January 11, 2018 @06:58AM (#16123085)
If you have proper end to end encryption protocol and client which correctly implements the protocol without additional backdoors then it doesn't matter what the server runs. If the client is open source you can verify and build it yourself or download the binary from source that you trust.
[ Parent | on HN ]