News for hackers. Stuff that matters.

A comment on “Why Using WhatsApp Is Dangerous“.

Re:“Why Using WhatsApp Is Dangerous“ by nnx on Friday January 31, 2020 @05:25AM (#22200544)
The whole article is disingenuous:

- This kind of vulnerability could happen in any app, including Telegram (similar issue also happened in the past with iMessage)

- WhatsApp conversations are all end-to-end encrypted by default, Telegram does not (have to explicitely create "secret chat")

- If this vulnerability used privilege escalation to access some data outside WhatsApp, iOS indeed had additional vulnerability (and Android too)

[ Parent | on HN ]
Re:“Why Using WhatsApp Is Dangerous“ by dancemethis on Friday January 31, 2020 @06:51AM (#22200917)
There is no way to prove WhatsApp didn't tamper with OpenWhisper internally.
[ Parent | on HN ]
Re:“Why Using WhatsApp Is Dangerous“ by joshuaissac on Friday January 31, 2020 @08:02AM (#22201268)
Even if they did, it would just mean that Facebook (WhatsApp's parent company) could now see your messages, but that is still no worse than the default Telegram setting, which guarantees that the company will be able to decrypt your messages. And what prevents Telegram from tampering with their own end-to-end encryption for the binary they upload to app stores? Hardly anyone compiles their own apps if they can download it from a convenient app store instead.
[ Parent | on HN ]
Re:“Why Using WhatsApp Is Dangerous“ by wrboyce on Friday January 31, 2020 @08:23AM (#22201430)
Telegram clients are open source and have reproducible builds. There is so much FUD being spread in the comments here which could probably be resolved by sticking your HN comment directly into your search engine of choice.

https://core.telegram.org/reproducible-builds

[ Parent | on HN ]
Re:“Why Using WhatsApp Is Dangerous“ by joshuaissac on Friday January 31, 2020 @10:28AM (#22202430)
They started having reproducible builds since the start of this month, when they released v5.13, and I admit that I had not checked to see if it had changed since the last time I looked.

However, this still lets Telegram decrypt people's messages (on the default setting), which makes it less secure than WhatsApp and Signal.

The article itself is riddled with FUD about WhatsApp, and the author has written similar FUD/unfounded claims before.

1. https://www.independent.co.uk/life-style/gadgets-and-tech/ne...

2. https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15

[ Parent | on HN ]
Re:“Why Using WhatsApp Is Dangerous“ by dancemethis1 on Friday January 31, 2020 @12:54PM (#22203758)
FUD "against" proprietary software is pretty much the "reverse racism" of technology.

Again, there is no proof OpenWhisper wasn't tampered with. It'd take WhatsApp becoming Free Software and having independent audits to be reliable as a communications platform. Suspiscion is but a matter of survival, and chances will continue to be usually against the most vulnerable party: the users.

[ Parent | on HN ]
Re:“Why Using WhatsApp Is Dangerous“ by UncleMeat on Friday January 31, 2020 @02:39PM (#22204832)
Why would it need to be Free? Surely a license for modifying the code has exactly nothing to do with being able to audit it. They could distribute the source in a different manner if you really really really need to be able to see it in order to audit it (professionals don't).
[ Parent | on HN ]
Re:“Why Using WhatsApp Is Dangerous“ by UncleMeat on Friday January 31, 2020 @02:37PM (#22204818)
There's no way to prove that any client hasn't tampered with a protocol. Halting problem and all that.

But reading closed source code isn't hard. Most of whatsapp on android is implemented in dalvik bytecode, which is basically like reading source without good names or comments. And there are piles of professionals who are very skilled at reading decompiled binaries for the native code in the app. The idea that oss code is easy to verify and closed source code is impossible to verify is just bogus.

[ Parent | on HN ]