Hacker News Reader

Comment by felixrieseberg | Hacker News Reader

This is probably the most sensational text I've read all weekend. Yes, Android has security flaws (that have been previously covered in-depth).

The bar for "hacking WhatsApp" should be dramatically higher than installing an app on the very device that decrypts the message. Heck, you could probably just use the NotificationListenerService[0]. There, I hacked all messaging apps that use notifications. I didn't even need "servers deep in the remote mountains of Colorado".

[0]: https://developer.android.com/reference/android/service/noti...

View on HN

See my other comment.

For governments (the groups that ostensibly WhatsApp cares about the most) and "hackers" it is fairly trivial to get an install on both ends of a communications chain - especially if the target/mark is high enough priority. So that doesn't absolve them.

WhatsApp stops you from getting caught in dragnets and requires someone to explicitly target you, with an actual cost for the attacker - when the malicious app is detected, the vulnerabilities it uses will be patched, requiring new ones to be found or bought. The more people targeted, the greater the odds of detection. So, while every single person is pretty much as vulnerable as ever, as a population this is still a big improvement.

That's scary (the NotificationListenerService part). I had no idea security on Android was that bad. So any app can silently copy all notifications to a remote service? Mail subjects and body previews, facebook messages, etc etc etc?

Edit: Even though perhaps this hack isn't WhatsApp specific, the end result is the same - full compromise of WhatsApp privacy. Which is what matters to end users.

The user has to allow the app to listen to all notifications manually. It can't be done automatically / from within the app and is part of the Settings app on Android.

That said, this is quite useful for services like PushBullet for forwarding your notifications etc.

Reply on news.ycombinator.com