The Coder Who Encrypted Your Texts

Re:The Coder Who Encrypted Your Texts by davisr on Thursday July 09, 2015 @11:15PM (#9862109)

"Absolutely no way"? I'm sorry to be impolite about it, but that's a bit of an exaggeration: one could jailbreak their phone, pull the binary into their computer, decompile it, and inspect it for implementation structures that would be coherent with how the two or three most popular encryption algorithms are commonly implemented. The expertise to be able to accomplish it doesn't come cheap, but it's certainly in the realm for anyone willing to invest the time.

If anyone out there does it, feel free to post your findings to http://imfreedom.org/.

I'd be willing to bet that WhatsApp has some competent programmers, and looks very similar to how Apple's built iMessage. I think everyone is entitled to the most security possible, but unfortunately when you're at the scale of WhatsApp, perfect security would make all that ultra-tantalizing data pretty hard to analyze. They're a business, they have a responsibility to their investors to grow the business, and data right now is a _big_ business.

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by JupiterMoon on Friday July 10, 2015 @12:20AM (#9862280)

So you've probably just broken the law by doing so. And you have to do this everytime the app gets updates. And you have to be sure that the encryption is actually getting used on every message. And that the key is strong and not known to Whatsapp. And also that the recipients copy of the app is behaving the same as yours. So I guess the question is, if you had something to hide would you bet your life on it?

Whereas with Textsecure. Well it just works...

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by jsprogrammer on Friday July 10, 2015 @01:41AM (#9862464)

>So you've probably just broken the law by doing so.

By modifying your own device? I don't think so.

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by JupiterMoon on Friday July 10, 2015 @02:53AM (#9862636)

Many countries have laws against reverse engineering programs. Whilst I think these laws are stupid I would prefer to just use the open source program than mess around with the closed source alternative.

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by nitrogen on Friday July 10, 2015 @03:03AM (#9862654)

According to Wikipedia[0], reverse engineering is generally legal in the US:

In the United States even if an artifact or process is protected by trade secrets, reverse-engineering the artifact or process is often lawful as long as it has been legitimately obtained.

[0] https://en.wikipedia.org/wiki/Reverse_engineering#United_Sta...

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by JupiterMoon on Friday July 10, 2015 @10:11AM (#9864028)

Actually have another look at that before you break the law on this yourself.

As far as I can see that article says that reverse engineering is legal in the case that: (1) the EULA doesn't mention it (I've no idea what Whatsapp EULA says - do you?). (2) it is done for the purpose of interoperability. What is being proposed by the GP is in fact not interoperability but security testing.

As I said before I think that the laws on this are stupid. But why worry about this when there is a great FOSS program in the same space?

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by aw3c2 on Friday July 10, 2015 @03:47AM (#9862753)

And that is one country out of ~200.

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by blfr on Friday July 10, 2015 @04:28AM (#9862851)

Yes but it has 350M people living in it, half the HN, Silicon Valley, and Moxie with his team. It's not honest to say the US is just another country among 200.

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by tP5n on Friday July 10, 2015 @07:39AM (#9863324)

yep, in other words around 4% of the world's population live in the US and of course this pales in comparison to actually large nation states, like india or china.

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by celticninja on Friday July 10, 2015 @08:39AM (#9863570)

it is honest to say that, it's just that americans like to think they are special.

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by lostlogin on Friday July 10, 2015 @05:24AM (#9862991)

Ones answer to that probably depends on where they live.

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by JupiterMoon on Friday July 10, 2015 @04:42AM (#9862881)

Assuming that nothing in the thing being reverse engineered is not encrypted or protected in some fashion right?

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by mightybyte on Friday July 10, 2015 @12:47PM (#9865080)

> one could jailbreak their phone, pull the binary into their computer, decompile it, and inspect it for implementation structures that would be coherent with how the two or three most popular encryption algorithms are commonly implemented.

There's a much easier way. Turn off your phone's cellular connection, but turn on wifi and connect it to a wifi network you control. Then just sniff the packets.

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by stouset on Friday July 10, 2015 @04:35PM (#9866560)

Not unless you have discovered a novel technique for distinguishing between good crypto and bad crypto over the wire.

[ Parent | on HN ]

Re:The Coder Who Encrypted Your Texts by higherpurpose on Friday July 10, 2015 @06:52AM (#9863193)

At the very least I would want Whatsapp to:

1) add authentication with other users

2) make a public statement about it (believe it or not, that hasn't happened yet. Perhaps it will come when the iOS versions supports it - or perhaps it never will)

3) commit to the new encryption system in their privacy policy (make it at least somewhat legally binding - which could also be used against abusive law enforcement orders)

[ Parent | on HN ]