Security researchers call for Guardian to retract false WhatsApp backdoor story
techcrunch.com
techcrunch.com
So it's a classic tradeoff - convenience vs. security, and the Guardian story correctly reported it.
> and WhatsApp offers people security notifications to alert them to potential security risks.
which is not enabled by default.
Sounds to me like apart from the hyperbolic use of the word "backdoor" (which apparently has now been removed), The Guardian is in the clear here.
The Guardian needs to retract and sanction its editor. The story is journalistic malpractice and puts people at risk.
This is not about word use, but about publishing stories that are already causing people in high-risk places to move off of a secure messenger to SMS.
Signal doesn't make that bad trade-off, for example. There are viable alternatives.
There's empirical evidence that people switch off to SMS. In places like Egypt, people share phones, swap SIM cards routinely, and Signal's nondelivery behavior is a non-starter. Zeynep does research on this and has written a lot about it; it's fascinating (and depressing) reading.
The point is that these are not hypothetical scare scenarios. We have the data and that's why it's so urgent to chastise this kind of reckless coverage.
The only message those people are getting is "WHATSAPP BAD, SWITCH". And switch they are, but not to Signal (none of their friends on are on Signal). Nope, they're adopting insecure alternatives, where they can actually talk to their peers.
The flaw is as follows: I'm trying to send you a message, but your phone is offline and lost. When you get a new phone, your key has changed, but WhatsApp will deliver my message before informing me of the key change. This applies also to calls and such (which shouldn't be "delivered" if the other person is offline).
Why could this be bad? WhatsApp could exploit it as follows (maybe under orders from the govt.):
1) Make it seem like a user lost their phone.
2) Wait for a message to be delivered to the user's account.
3) Bring the user back online with a new key (generated by WhatsApp themselves).
4) Read the "encrypted" message.
It's a real vulnerability in the protocol, but the severity depends on your threat model. As I said above, this might be an acceptable trade off for messaging, but not for things like calls, where if the user is offline you don't want the call to go through anyway. All this has been pointed out clearly by the student who discovered it.
Making Signal show white-on-white text would make it more secure against attackers reading over your shoulder. So why doesn't Signal do that?
These are legitimate trade-offs that the Guardian is portraying as vulnerabilities.
Anyway, I don't think it's a reasonable choice. How any times do people change phones?!? Even if you're rich you don't do that more than once a year. It doesn't happen often enough for the user to become "accustomed" to warnings and simply click through them.
But you don't, because shoulder surfing is not the threat model for Signal. And individually targeted MITM attacks by governments that can take over a server are not the threat model for WhatsApp.
If it even works to enhance the privacy of 0.1% of users, it's helped a million people in ways that SMS has not.
I see all these people come in defense of WhatsApp using bizarre statistics about domestic violence (big correlation with hacking?). Then someone (tptacek?) was going around saying not a single crypto expert disagrees with their consensus (trucking all over the original source, Tobias Boelter). Then there are all these jokey "Is WhatsApp Backdoored Yet?" expressions. It's a frenzy.
There seem to be a whole bunch of people who take The Guardian article as "omg, after this article, people will drop WhatsApp and use something like Messenger instead!". Which, sure enough, maybe a common scenario, and worse. However, the article was obviously meant to push people outside of Facebook gardens, and into a more secure alternative. It's supposed to make you go "WhatsApp is unsafe, I will use Signal instead". One of those "trade-offs" you're talking about in the first place, just like the security vs. purity one. In this case, erring on the side of activism.
As a sideline observer with very little crypto knowledge, I think Boelter presented an interesting case, while the anti-Guardian crowd reacted like crazy people, pulling fire alarms, hurling insults, and Streisand-effect-ing the story into a huge controversy.
I mean, the EFF article itself, in defense of WhatsApp and against The Guardian, says:
https://www.eff.org/deeplinks/2017/01/google-launches-key-tr...
> If you are a high-risk user whose safety might be compromised by a single revealed message, you may want to consider alternative applications. As we mention in our Surveillance Self-Defense guides for Android and iOS, we don't currently recommend WhatsApp for secure communications.
It goes on to qualify this statement by saying that's a rare threat model. However, that right there, is enough to justify the original piece. The idea, I think, is that everyone should be on something like Signal, so that merely using Signal wouldn't be taken as a reason for suspicion. If you disagree, your argument could surely be better than jokes about white text.
Just my two cents as a nobody.
Honestly, would a 'recipient key changed; resend message?' be the worst prompt in the world?
Referrence to a clear demonstration of a security vulburability in the protocol as a lie, is a demonstrably false statement
https://www.theguardian.com/technology/2017/jan/13/whatsapp-...
And the "Should I stop using WhatsApp?" section is basically exactly what the letter is railing against.
Asking the proverbial Johnny to make a security decision each time happens will result in alert fatigue. The overwhelming majority of users will always accept the new key because they just want the app to work.
They are not a magical panacea that makes MitM attacks go away. There are two good solutions to this for users who care, however:
- Verify keys with each other in person
- Move to Key Transparency / CONIKS-like systems for auditing key serversIt's interesting that you make this comparison. For a while now I've been of the position that web browsers should scrap all TLS user interface stuff (padlocks, green bars, invalid cert warnings, self signed cert warnings etc), because it doesn't communicate any information that the average user can make any use of.
It's only one aspect of what makes a site 'secure' for users, and probably one of the far less important ones. The vast majority of attacks on users (info being stolen, malware being served etc) come from the site itself being compromised, not from MitM attacks by their ISP. The vast majority of warnings about bad certs are due to somebody forgetting to update it or config issues, not because of real MitM attacks. The vast majority of people just click through cert warnings. The padlock icon in the browser doesn't even do the one thing it promises since it's no guarantee that TLS is being applied all the way to the actual web server. XSS is a bigger threat to the average user but browsers don't warn about sites that aren't using CSP.
My theory is that browser devs always knew the padlock icon was bullshit snake oil, but they implemented it at the demand of the e-commerce industry. At the time it was difficult to get people to trust the web enough to enter their credit card details. Providing a meaningless 'security' icon was needed to bootstrap consumer trust in the industry.
The green EV certificate stuff is what's supposed to tell you that you're safe from MitM and phishing, because you can verify the legal identity of the entity you're talking to.
Really the biggest problem is browsers like Chrome that use green padlock/text for DV certs, because that's misleading and either makes people trust the DV certs more than they should, or distrust EV certs. Safari does this much better, using a grey padlock (and no other text) for DV certs, and showing Green padlock + green text for EV certs.
Implement something for their benefit and the masses who don't care. When called out point to an a setting somewhere and call it a non-issue, "you can turn this on if you care". So they do what they want and can easily deflect all criticism. Facebook is not the first here and certainly not the last.
WhatsApp has something like a billion users. Virtually none of them asked for end-to-end encryption. They don't know that they want it, but they got it anyways when Whisper worked with WhatsApp to add Signal Protocol to WhatsApp.
But just because they don't want it doesn't mean they don't need it. Many WhatsApp users badly need messaging security that works better than their alternatives. They don't know it, but with the flip of a switch, they got that security. More than anything else, this is why Dan Boneh and the RealWorldCrypto steering committee awarded Moxie Marlinspike and Trevor Perrin the Levchin crypto prize this year.
Comes now The Guardian with a story saying "WHATSAPP BACKDOORED, BAD, SWITCH". None of WhatsApp's users are close to being able to evaluate what that means. But they know what "bad" and "switch" means. And in the global-scale game of telephone we're all playing now, that's what they're doing. You don't have to wonder: Zeynep will tell you it's happening.
Nerds on Twitter are puzzled. Isn't this a good thing? Signal is even stricter about security than WhatsApp. Wouldn't it be better for all these people to be on Signal? WhatsApp users will in fact probably try installing Signal. They'll even use it for a couple minutes. But their peers aren't on Signal, and they're switching immediately to messengers where they can find their friends. Not WhatsApp, though: The Guardian (or their shrill uncle on Facebook) told them not to. Nope, they're switching to SMS.
State security services could not be happier about this. You can't buy this kind of PR for money; you have to spend security researcher vanity to get it. Zeynep will tell you about this too: there are state telecom and security apparatuses right now signal-boosting The Guardian's irresponsible report. And there are activists circulating warnings to switch from WhatsApp to other messengers. It's a disaster: the lie is outrunning us.
The Guardian must retract this story, clearly and loudly. There's a way to report on the tradeoffs WhatsApp made, but this wasn't it; this was "VACCINES MAY CAUSE AUTISM". Don't take my word for it: look at who signed the letter, including Matthew Green, Bruce Schneier, Matt Blaze, Steve Checkoway, Chris Palmer, Dave Adrian, Bart Preneel, Jonathan Zdziarski, Steve Bellovin, and Emin Gür Sirer.
> But just because they don't want it doesn't mean they don't need it. Many WhatsApp users badly need messaging security that works better than their alternatives. They don't know it, but with the flip of a switch, they got that security.
Most of them probably don't know they have it, either. This is a good thing: People can be safe without knowing how safe they are. The industry should be moving more people towards secure defaults.
Yes, security nerds will want something harder to attack in the middle. That's fine: They can build their own perfect security tools, and nobody will use them.
Let's look at what the Guardian actually wrote:
> A security vulnerability that can be used to allow Facebook and others to intercept and read encrypted messages has been found within its WhatsApp messaging service.
> Facebook claims that no one can intercept WhatsApp messages, not even the company and its staff, ensuring privacy for its billion-plus users. But new research shows that the company could in fact read messages due to the way WhatsApp has implemented its end-to-end encryption protocol.
This is an accurate summary of the facts, expressed reasonably. The Guardian was right to report it. If people are really switching to even less secure services then I share your concern (though arguably people are safer using a known-insecure service than a service which claims more security than it actually has). But lying to the public or concealing research from them cannot possibly be the correct way to handle this and I will not endorse it. I guess I know who not to take any more security advice from.
But it gets worse for your argument.
First, the story The Guardian originally wrote is still there in the slug: "WhatsApp backdoor allows snooping on encrypted messages". That headline was the top story on HN for most of a day.
WhatsApp ran this story with a single technical source, and then peripheral color-commenting sources that weren't technical and were commenting based on the premise that the "backdoor" story had been vetted. As you can see, virtually all the expertise in the field disagrees with that premise.
What I quoted from the Guardian article is true on its face, none of the experts denies that much. I don't know what has caused this bizarre departure from how researchers have responded to 20+ years of crypto flaws, because this time isn't any different. A crypto flaw is still a crypto flaw, and reporting the truth to the public is still the right thing. This is a "there are four lights" situation for me at this point.
One linguist armed with a very strong argument rooted in verifiable facts.
But this open letter doesn't disagree with any of the technical claims! The letter disputes a) the interpretation of Facebook's motives behind their technical decision b) the judgement regarding informing the public - both subjects on which the Guardian has far more expertise and reputation than any of the letter's signatories.
As someone who uses PGP, but doesn't use WhatsApp this is the key piece of context that makes this a questionable trade-off instead of a crazy one. It would be better if the default was for there to be a notification and for there to be an option to disable resending messages on key change, but I can at least understand why they would sacrifice some security in order to make E2E encryption transparent to users who don't know they need it.
It is a good thing that there is both a messenger like Signal that tries to be ultra-strict about key changes and a messenger like WhatsApp that tries to be transparent about it. Signal's smaller user base of people interested in cryptography functions as a laboratory for crypto UX. WhatsApp, over the long term, can adopt the innovations that make sense, while Signal remains free to experiment.
That's why there's both Signal and WhatsApp, and why they don't directly interoperate.
Maybe the Guardian article prompted thousands of people to learn more about cryptography? This is probably the first time many people have learned that a security protocol can have flaws.
To me it sounds like a bunch of security experts are angry that they weren't quoted in the most prominent security story of the year.
There are users who could literally (yes, literally) have their lives saved by using whatsapp rather than SMS. But because of this article, they won't. You don't have to take my word for that. Zeynep works with those people, and will tell you the same thing.
I would argue that at this point it is either Messenger (facebook) or Snapchat.
The security experts you're complaining about are citing empirical evidence that people mostly switch back to SMS if they stop using WhatsApp. They are right, and you are wrong.
> Maybe the Guardian article prompted thousands of people to learn more about cryptography? This is probably the first time many people have learned that a security protocol can have flaws.
Everyone in this discussion agrees that there is no 100% correct answer here, and that this is all a question of tradeoffs. The security community wants the option that minimizes harm to the most people, and the Guardian's reporting is doing the opposite of that. Yes, a few people may have been more informed about cryptography. The overwhelming evidence is that many more people instead are switching to a less-secure alternative because they didn't understand what they were reading.
> To me it sounds like a bunch of security experts are angry that they weren't quoted in the most prominent security story of the year.
I don't know where to begin with this. You just told us not to assume the worst of ordinary people but seem happy to do that with domain experts.
There is no actual empirical evidence presented in the letter, just a paragraph with anecdotal evidence that people are unsure what to do, and assertions that the author's years of experience show that the Guardian's article has bad effects.
The letter complains that the journalist did not ask any established security researchers, and discredits the source as a 'single well meaning graduate student'.
I honestly don't understand why all these domain experts are getting so riled up over a single story; instead of welcoming the attention it brings, they are asking a paper to retract a factually correct article, because the presented flaw should be described as a sensible tradeoff, instead of as a back door.
The only ones "too" excited about this article seem to be the guys who signed the letter (and you, if you are not part of that letter ;-))
"How serious this is depends on your threat model. If you are worried about the US government -- or any other government that can pressure Facebook -- snooping on your messages, then this is a small vulnerability. If not, then it's nothing to worry about."
https://www.schneier.com/blog/archives/2017/01/whatsapp_secu...
And then we were freaking out last week when a KCI was found in an open source project :)
Now we have the same thing with What's App: we have to trust them with the key exchange. It's marginally better, since they have an optional way to enable notifications after a key was changed.
I applaud the Guardian to run with the story. Whether to call it a back door / flaw / trade-off is just quarreling over semantics, when the important part is that you need to trust a central service.
If you want to be sure that noone can intercept your messages, use PGP or S/MIME, (preferably encrypting your message on an air-gapped computer)
Saying that we shouldn't worry about state-level actors is a bit naive after PRISM was revealed.
If you are doing something that someone in power might dislike, you should not rely on Whats App.
I think this is writing off a significant portion of the meta-story here, semantics matter very much in journalism. While the technical nuances of trust are important, they won't be understood or digested by the average reader. What will be remembered is the headline, which doesn't say "Whatsapp is as secure as iMessage" it just says "Whatsapp has a backdoor".
The story you tell is framed by the audience that's listening, and the framing the Guardian chose unfairly paints Whatsapp as not just secure, but less secure than alternatives by singling them out. That's not an accurate story.
The list of names at the end of Zeynep's article is pretty much a who's who of people you don't want to be publicly called wrong by when reporting on security.
(see my response here for the explanation of the scare quotes on security: https://news.ycombinator.com/item?id=13445337)
But putting "VACCINES CAN KILL" as a headline in a mass-circulation paper would be just as wrong, and for the same reasons.
So you admit it's true, but it's wrong to write it as a headline?
It's interesting to see people put their head in the sand regarding the Signal/Whatsapp security flaws.
The "appeal to authority" fallacy occurs when someone is cited outside their area of expertise or is not an expert.
Qualified authorities in one century may be shown to be completely wrong. For example bloodletting, phlogiston, or even the age of the earth before radioactivity was discovered. Feynman talks about this... how the number stays close to the others until finally they jump to the right one.
"A new scientific truth does not triumph by convincing its opponents and making them see the light, but rather because its opponents eventually die, and a new generation grows up that is familiar with it." - Max Planck
So while, yes, he is accurate that our knowledge of the world around us and of Science changes over time, that has nothing to do with the fallacies we're discussing.
"use whatsapp" is the correct recommendation for everyone who is not ready to use opsec recommendations from grugq, same as "TLS everywhere" is a very good recommendation regardless of all the issues we know about TLS.
Let's make pervasive passive collection impossible. Then we can work on stuff like endpoint security for everyone.
Just so you know, tptacek signed this letter. I did as well.
Calling it a backdoor was outright dishonest. I've written backdoors. I even won a cryptography backdoor contest at DEFCON with one of my designs.
https://underhandedcrypto.com/2015/08/08/crypto-privacy-vill...
https://paragonie.com/blog/2016/01/on-design-and-implementat...
If it's to be said that there is a vulnerability, then it is simply, "If there are any messages that haven't been delivered yet, and the recipient changes keys, the client will re-encrypt to the new public key before alerting."
Okay, a lot of security experts wouldn't make that trade-off, especially if they were trying to compete with Signal. But WhatsApp isn't a Signal competitor. The alternative means of contacting someone you'd normally use WhatsApp for is SMS, because that's what people are using today.
Most WhatsApp users aren't interested in encryption. It just works for them. They may still need it, but they don't care about it.
Even if you could exploit this, you get:
- Any undelivered messages (if any)
- No past messages
- No stealth either; the user does get alerted
WhatsApp is not a secure communications platform. Claiming otherwise is disingenuous.
IF the user opts in, they have the option of being notified. Most users do not know this option exists or care to enable it, so I'm not sure the above is strictly true.
I think the over-reaction to the stance of the security community is that it gives the vibe that the flaw is minimized. For the layman, every security flaw, every vulnerability is a totally obscure, incomprehensible jargon-filled techno mumbo-jumbo. Now we have the case that sometimes the experts go wild over the dangers of a flaw, sometimes they say "Ah, better than nothing". It gives the impression that WhatsApp is been let off the hook.
I think the argument would have been better framed by stating simply that WhatsApp's decision is a security flaw, that it should be fixed from a security POV, but it's still better than most alternatives and leave it at that.
That whole dance about it being an acceptable compromise would have been better off omitted. The letter commits the same error as the Guardian: in trying to be too comprehensive and precise, it muddies its point.
They're not acceptable in general.
They're acceptable within the context of the problem they are trying to solve, which isn't "make crypto nerds happy". Their users, by and large, know absolutely nothing about cryptography. Any attempt to add key verification will either:
- Spook them
- Intimidate them
- Confuse them
- Make them move to an insecure platform that their contacts
already use; i.e. SMS
- All of the aboveIf something is actually true, then why is it preferable not to say it publicly (including in a headline)? As long as the qualifying statements are made alongside it (eg probabilities)?
Why should governments have so much classified information and secrets? What if they just operated entirely transparently? (Except for short term tactics for raids and investigations of suspected criminals and terrorists.)
Heavily de-contextualised true information can be just as misleading as actual lies. Hence the vaccine example.
The probability can be conditioned on some relevant assumption to make the story sensationalized. But as long as the probability and assumption is clearly spelled out, I don't see what other context should be required for PUBLIC disclosure. Maybe also the total incidence number.
For example: Jihadist terrorists can kill you! With a 0.001% probability for every hour you spend in a large crowd. It has happened in two crowds so far.
Or: 97% of climate scientists agree the rise in greenhouse gases is mostly attributable to human activities. That is 97% of 35 PEOPLE in the world.
(the climate scientist number is probably closer to 35,000; and when talking of surveys and samples, reporting the sample size causes everyone not professionally trained in statistics - that is, almost everyone - to underestimate the "power" of the survey.)
Don't they end up being lies of omission at that point?
People come away thinking "vaccines are bad". In this case, the Guardian put the tech equivalent of "vaccines can kill you" in a headline.
https://www.schneier.com/blog/archives/2017/01/whatsapp_secu...
A realist would, however, see this as a news outlet unable to own their mistake and instead doubling down as you said, in a failed attempt to save face. A journalist wrote this story seemingly by the seat of her pants, and her employer is on a noble if misguided campaign to defend her article.
I'm taking the realist path on this one; I don't think there's any grand conspiracy behind their baffling decision to stand behind obviously shoddy reporting. The fact that so many top security researchers -- who certainly aren't going to be influenced by any particular government or corporate interest -- are calling for a retraction is all the assurance I need that the story is baseless and the Guardian is inexplicably enjoying the taste of shoe leather.
---
This wasn't negligent disinformation (post-revision of the usage of 'backdoor') on the part of the Guardian. The reaction to the information presented on the part of the public - to switch to SMS in significant numbers - was irrational.
That said, there is a productive issue raised by the Guardian that has been smoked out into the open, namely the revelation of two contradictory assumptions underlying the decision, as discussed by Moxie in the previous HN thread, to defend against state level snooping.
The rationale goes a bit like this: 1 - People change keys in the regular course of using Whatsapp. It therefore needs to accept that without impeding usability.
2 - Most users do not care about security enough to prefer one service to another for the Whatsapp market segment - Those users use Signal or other offerings.
3 - Whatsapp's lack of 'post consent' resending is intentional, and designed to prevent the server from knowing who is monitoring the status of their keys.
4 - As such, Whatsapp effectively defends against dragnet surveillance! As security minded individuals will note inappropriate key changes once a MITM attack begins, confer, and determine they have been compromised at scale.
The key flaw here is that 2 and 3 mean that for targeted surveillance, powerful attackers are unlikely to be uncovered while exfiltrating specific communications, and likely don't see very much reputational or legal risk to potentially triggering a key change event.
So people are vulnerable to feasible, targeted message exfiltration, contrary to what they may have believed when E2E was rolled out. That's newsworthy.
The fact that the security community is striking back makes me feel like they are circling the wagons now that the Guardian has caught them with their pants down - They should have been the ones raising these issues and providing the appropriate framing to protect the public.
I don't believe the piece was not 'newsworthy', though, and I believe the security industry's response should have been one of collaboration rather than admonition - it leaves a bad taste in my mouth to see an industry with a clear communication problem striking at their best potential ally. The Guardian are not the 'bad guys' for trying to inform us of a vulnerability.
This is my ultimate takeaway as well; their intent was good, it was their implementation that fell short. I'm just really bothered that they are unwilling to own their mistake and retract the article, or at the very least allow a counter-editorial to be written and published by them.
They need to retract.
If your list of sources is full of anonymous rumors and things that can't be fact checked, or other stories with poor sourcing, I ignore the entire article and its conclusions. It's an interesting exercise for how you consume news (and especially "news") and I recommend it to everyone.
That's part of what makes reading purely technical discussions so much more enjoyable. We're not talking about random internet rumors, we talk about code and anyone with a compiler, debugger, etc. can verify things directly. There's much less room for BS, because someone can call you on it and prove you wrong in ways that everyone can verify independently.
What makes you so sure? The Guardian is fundamentally devoted to reporting the truth even - especially - when it's hostile to the government - the organisation is structured deliberately to ensure its independence. Can the quoted experts say the same about their payroll?
>If you use WhatsApp as a way to avoid government surveillance due to its end-to-end encryption service, you should stop using it immediately.
In the wake of the UK snoopers charter having sailed through parliament, this seems odd. Occam's razor tells us that it's coincidence and bad reporting, but still.
The Guardian must retract this story, loudly and clearly.
Moreover, in the future, The Guardian and every outlet like it needs to understand that stories like this require more than one source. If you've got a legitimate story about a crypto backdoor in a popular product, security researchers will fall over themselves to comment on it.
As you can see in this case, they're falling over themselves to disavow it. In the last hour, we've added Collin Mulliner, Matt Blaze, Peter Honeyman (\o/), Chris Kanich, and Nicolas Christin --- and all we're doing is circulating the letter on Twitter. It'll pick up steam from there.
This is not a position The Guardian or any other major news outlet should ever find itself in. This situation is what the concept of "retraction" was invented to cover.
The Guardian should have inserted caveats stating that this flaw is highly unlikely to have been exploited, but I would argue that not telling the people of the flaw is as bad as telling them that it's backdoored.
The problem with yellow journalism and sensationalism is that purportedly respectable institutions spin narratives that are dangerous.
I'd be curious to see some empirical data on the impact of this story, i.e. how many users switched from WhatsApp to Signal or vanilla SMS.
It's funny, I hadn't worked out that it's pointless to cancel a subscription if I don't first tell them why.
Ironically, if they fix this, you may have kept a subscriber with them who'd otherwise have left!
Signal and whastapp have different behaviors regarding this. (Signal does not have the issue of re-sending messages as was previously reported here).
This letter signed by a lot of very serious security cryptographers means that there is a consensus among the community about the "best" behavior in terms of security, trade-offs, etc.
If there is indeed a consensus about what the "best" behavior is, then both Whatsapp and Signal should adopt this "best" behavior.
However Whatsapp and Signal do not have adopted the same behavior. So the consensus does not seem to be there, otherwise both Whatsap and Signal would have adopted the "best" consensual behavior.
So by first order logic... There is no consensus on this?
It's not about ideal UX. Nobody knows what that UX is yet. WhatsApp is the first messenger with a world-scale userbase to tackle this problem; they're on the vanguard of work on this problem. Signal has a much smaller userbase and, importantly, that userbase adopts Signal specifically to get cryptographic security. Signal can innovate in different directions than WhatsApp, and WhatsApp can in the long term adopt the techniques Signal comes up with that actually work out.
It's a good thing that there is both a messenger that protects a billion people without them having to understand public key crypto and another messenger that protects a much smaller number of people but that also serves as a laboratory for crypto UX.
If you understand just one thing about the WhatsApp/Guardian dilemma, understand this: 99.99% of WhatsApp's users don't care about cryptographic security. They don't even know what that means. But that doesn't mean they don't need cryptographic security. Many of them need it badly whether they know it or not. But they're only going to use messengers that will allow them to talk to their peers, and none of their peers are on Signal. If you tell them WhatsApp is bad, they move to SMS.
For a product with a billion users, where the threat model is mass surveillance, it is a good trade-off to never drop messages.
For a product with more specialized users, who may be individually targeted, it is a good trade-off to not deliver buffered messages after a key change, and warn instead.
There is no "best" behavior in the abstract, you have to take into account the setting.
I wonder what people here would say if browsers would act with certificates the way WhatsApp handles key renewal.
We even discuss certificate pinning etc. in the web space.
It is so very tempting to think that we experts not only know the facts better than the public, which we usually do, but that we also know what's best for the public. But I fear that withholding valid but easily misinterpretable information from the public is a dangerous road to go down. It puts us in the position of making choices for people.
You can see how, if we start withholding information from the public because we feel they are too ignorant to handle it, it creates a bit of a self-fulfilling prophecy.
2017 is really not a very good time for experts in any field to be telling others to do things "because we say so" or to ask that information be withheld because we know what's best for people. For better and worse, people are increasingly distrusting expertise and, as a consequence, (trying to) think for themselves. This can be a good thing if we let go of a little ego. On the other hand, our remaining credibility is fragile, and we need to spend it wisely.
It also does create the appearance of hypocrisy, although not necessarily the reality, when security researchers are in favor of full and public disclosure in some cases but not others.
Ancillary to that, imagine a major story about vaccine risk that didn't talk to any doctors. That's what the Guardian did here.
A request for retraction is very close to a request to do just this. I will explain more below, though.
> major story about vaccine risk that didn't talk to any doctors
I think this analogy is not quite right. In a story about vaccine risk, you'd maybe talk to one epidemiologist, one immunologist, one pharmacologist, etc. In this story, they have done something similar: Boelter as the expert (yes, only a PhD student, not optimal to be sure) on the technical aspects of the vulnerability, and several others commenting on the broader social and privacy implications.
And this is very important because the letter writers and the EFF admit, when pressed, that it is indeed a vulnerability, or threat, or what-have-you. They would prefer the framing of "UX tradeoff", but that is because their core criticism here is seemingly not about anything technical, it's the fear, as you have said and which I do not deny is legitimate, that people will use this information the wrong way.
It is this point I was responding to. If the authors of the open letter do not have valid technical concerns (other than "backdoor", which was edited), their work is done, both on the philosophical grounds I listed above, and on the practical grounds that experts do not get to dictate tone, implications, or framing to journalists.
The oddest thing about it all is that the researchers seem to even agree with the Guardian that Signal is more secure. So to recap, the technical aspects of the vulnerability are not disputed, and even the recommendation of using product X over Y if you care about security is not disputed. It is the fear that people will use product Z, which the Guardian did not even mention, instead of Y that is the problem! It is based on these facts plus the call for a retraction that I have concluded that the security researchers in this case are trying to withhold, or at least control, the flow of information to the public based purely on the (justified) fear that some of the public will react incorrectly.
Just imagine how the conversation between the Guardian and the US and UK governments must have gone during the Snowden revelations. I am sure they were bombarded with many consequentialist arguments about why publishing them have all kinds of bad effects. But the role of journalists isn't to decide what's good or bad, or how people should use what they publish, it's simply to publish factual information. The only grounds for retraction should be factual inaccuracy.
But the story is really more like "Complications associated with Vaccine A" when several alternative vaccines without those risks exist.
The split seems to be:
- Some people are OK with compromise for usability
- Others think being uncompromising is the only way to eventually achieve security. (This group is also, rightly imo, suspicious of WhatsApp/Facebook or any centralized product)
I do understand the latter mindset. Often the only way to get high security is dogged attention to detail, letting nothing slide. Attackers love to promote products which provide the illusion of security, but contain flaws or backdoors; and often the illusion of security is worse than nothing.
But I'm with the group that favors usability compromise here. Open source projects have successfully built high security products, but rarely gotten mass consumer adoption, precisely because of an unwillingness to make concessions to usability.
Without usability concessions, we end up with 30 character random login passwords - written on stickies on the terminal.
Even if you don't agree with the particular compromises in this case, please engage with those who do. There's no reason to think they are shills trying to undermine security. Favoring usability here is at least reasonable, with the same shared end goal of increased security for end users - this should be acknowledged, especially given the mass adoption success of WhatsApp/OWS.
> There's no reason to think they are shills trying to undermine security.
Moxie's comments about OpenPGP are ample reason. And in any case our response needs to be robust against the possibility that they are.
> this should be acknowledged, especially given the mass adoption success of WhatsApp/OWS.
The mass adoption is precisely why it's so important.
WhatsApp is an unqualified success in this regard. That it makes trade-offs unsuitable for dissidents of world governments does not diminish this.
This is reassuringly the overwhelming majority of the market that WhatsApp is eating into.
> To the extent that it's displacing Skype/Facebook Messenger/..., meh
And in this case, it's at least not worse. Although I will argue it's still much better. As has been discussed elsewhere ad infinitum, this tradeoff in WhatsApp still allows savvy users to enable notifications. And the fact that some people will do this (and it stands to reason, the people who do this are precisely the ones who are likely to be targeted) is an effective deterrent for doing it at all.
> To the extent that people using it assume it's secure against a hostile Facebook when it isn't, that is terrible. Fake security is worse than no security.
Security is not a boolean. It is unequivocally more secure than Facebook Messenger, which we can assume is not E2E encrypted. Facebook or governments with appropriate authority can surveil this en masse. They can not do this for WhatsApp messages. Attempts to surveil these messages even at a small scale carry a high risk of tipping their hand that they're doing this surveillance at all.
1/7th of the world's population is now using E2E-encrypted messaging thanks to collaboration between WhatsApp and OWS. The number of people who need to consider Facebook or governments with control over it an active threat against them perhaps number in the hundreds to low thousands, and this affords good (if not perfect) protection even to them through a toggle, and some protection even to those who don't enable the toggle.
Anyone who is in this last group is either aware of these limitations, or is completely fucked anyway because achieving practical security against a determined, well-funded governmental adversary is frighteningly difficult and requires ongoing effort and attention.
Agreed, but those few are the only people for whom E2E-encrypted is a substantial advantage over transport-encrypted.
> Anyone who is in this last group is either aware of these limitations
Largely thanks to the good offices of the Guardian.
WhatsApp claimed to have true E2E security. And it doesn't. The public needed to be told.
I could not disagree more.
This is the difference between large-scale, passive, implicit surveillance of an entire population and small-scale, active, explicit interception of handfuls of individuals at best.
> WhatsApp claimed to have true E2E security. And it doesn't. The public needed to be told.
You have to stop treating security like it's a binary thing. Threat models are important. It does have E2E security, it just has a tradeoff that allows for the interception of a single message by a nation-state attacker, with the probability of this event being detected increasing dramatically with the number of users they do.
This is not even close the same thing as not having true E2E security.
The large-scale passive surveillance you're talking about in the transport-encryption case could only be happening with the provider's cooperation. I can maybe see Facebook/Microsoft/etc. cooperating with the NSA in that way, but certainly not with the governments mentioned in the letter's rhetoric.
And note that a cooperating WhatsApp could do large-scale, passive, implicit surveillance of WhatsApp metadata and use that for targeting active attacks.
> You have to stop treating security like it's a binary thing. Threat models are important. It does have E2E security, it just has a tradeoff that allows for the interception of a single message by a nation-state attacker, with the probability of this event being detected increasing dramatically with the number of users they do.
An attacker with control of WhatsApp could continue to MitM indefinitely, no? They would be detected only when the users met up and compared security codes, which I suspect even dissidents wouldn't be doing frequently.
I agree that WhatsApp is probably more secure, and certainly no less secure, than apps with zero effort at E2E (I more-or-less endorse the preference order given at https://copperhead.co/android/docs/usage_guide ). But this is a real vulnerability that makes WhatsApp substantially less secure than was previously thought and claimed, and substantially less secure than what someone who just heard "end-to-end encrypted" would expect. It needed to be publicised.
As a user of WhatsApp, I'd prefer if it was fully robustly end-to-end encrypted, in an auditable App, if it was still usable enough I could talk to my family with it. I think all the more privacy conscious folk on HN could agree with that ideal. But I don't think we (yet) know how to achieve that ideal. [The hard part being getting family/friends on it reliably].
What is on offer is: End-to-end encryption which has some usability tradeoffs, that leaves it vulnerable to[0]:
- A code backdoor of some form in the App
- [As in this issue] an attack where the server MITMs it in limited circumstances by switching recipient keys for undelivered messages.
First off, this secures against mass passive monitoring on the wire, or even in the internal data center infrastructure, which the non-e2e transport encryption you mention does not.
Second, exploiting either of these issues en masse would run the risk of FB/WhatsApp getting caught. Maybe through a black-box audit of the App, or someone detects mass MITM'ing because they have key change notifications turned on. [Lets leave out the scenario of someone internal leaking what's happening.]
So my best judgement, as a user, is that these attacks are not likely to be happening en masse, because they would result in a large business risk to WhatsApp.
> If you're going to "compromise" that far you might as well just use any number of centralised messengers with transport encryption.
In that case [without e2e] the server would see all the messages in the clear. Absent a leak, there's no way they would be caught supporting a mass-monitoring program. They could allow their infrastructure to be passively monitored, giving plausible deniability while cooperating. That's clearly a different threat model.
I don't see why WhatsApp would have introduced this feature, and then compromised it in a way that risks getting caught. That would be a huge business risk for dubious benefit.
I could see they could be forced to do an attack on a limited number of individuals, risking getting caught. Again, I'm hoping that is an expensive enough business risk that it doesn't happen often, if ever.
But in this model, 1B peoples messages will be secure the vast majority of the time against pervasive monitoring.
[0] based on my understanding of these issues; obviously as a spectator I don't claim to have an exhaustive list of vulnerabilities/issues.
Lets suppose I'm human right activist in Egypt. If I enabled security notification in WhatsApp and other person's phone is captured by authorities but they cannot unlock it so they make it that user lost their phone. Now, if I send the message to that user, is this message received by other party with warning that is not encrypted or it is not delivered at all?
Second Question:
Is there any guarantee that server cannot change settings on the client?
It's delivered and then you see the warning.
> Is there any guarantee that server cannot change settings on the client?
No. Prior to this story I would have assumed there would at least be some risk of being caught by security professionals, but I guess the security community would be falling over itself to explain how the backdoor was an accident or a legitimate usability choice.
As soon as the message is delivered it cannot be resent anymore, but could the attacker refuse to provide the delivery confirmations, then perform the attack (getting all messages that weren't yet marked as delivered, potentially over a large timeframe, while also showing the warning)? If so, I'd say it is a thing to worry about.
A smart attacker could wait until one party is switching phones, so that the warning is not considered suspicious, and since they could swap the new-correct key in immediately afterwards, users would be likely to dismiss the missing checkmarks and double key-change notification (at least before this news was published).
Also, for phone calls, WhatsApp only shows the warning after the call.
I don't believe these are backdoors, but I'm surprised WhatsApp isn't taking it more seriously and trying to address it.
They trust that the Guardian, a highly reputable newspaper, has spoken to experts in the field, done the research, and made this evaluation, which it accurately reflected in the headline.
That trust is misplaced. That's why this is a fake story.
This is not a "well, actually" nerdfight. This is about putting real people in danger through egregiously irresponsible reporting.
No, please, do. None of us will be bored by this.
Signal is only a more secure alternative in _some_ threat models. The most obvious counterexample is that, in some contexts, using WhatsApp marks you as a person who owns a smartphone, while using Signal marks you as a dissident. There are other contexts where losing messages while not being actively attacked (not even just due to this design decision; Signal ultimately just does not have as reliable infrastructure as WhatsApp) is more dangerous than WhatsApp's resend behavior.
In general I want potential issues like this to be noted (when properly defined and characterized) and debated.
These experts are arguing that WhatsApp makes the best possible trade offs given their user base. I don't agree and think it's worthy of discussion. The tradeoff they refer to is really a UX/product design decision.
Do you think that Tobias Boelter faked his research?
That's what your comparison implies....
And headlining it that way in The Guardian would be just as grossly negligent as what they did.
ˈˌbak ˈdô(ə)r/
noun
noun: backdoor
1. the door or entrance at the back of a building.
2. a feature or defect of a computer system that allows surreptitious unauthorized access to data.
Seems like a backdoor to me. The reality is that the way it is implemented allows a foreign government to see messages it is not supposed to see...and that is a defect. I thank the Guardian for taking the lead on this and bring this issue to light.
All it takes is a rumor.
Basically everyone in this thread who are NOT signatories to the open letter could spend their time a lot worse than by listening to the segment with Alec Muffatt.
I may disagree with some of his opinions on the desired UX, but the technical details and threat model considerations are very thorough and thought out.
https://rbth.com/news/2017/01/16/whatsapp-helps-chechen-poli...
Binaries aren't magic.
Is the claim the full WhatsApp stack is open to regular indepedent third party security audits from multiple firms?
The client-server architecture is irrelevant here.
Read this, then flip the roles: https://paragonie.com/blog/2016/03/client-authenticity-is-no...
Reverse engineer the client-side app. You now know what the client-side app (the part that people want to be open source) is doing. You don't need to know what the server's code is doing.
If the client is open source: What the server is doing is irrelevant as long as the client is secure.
If the client is closed source: What the server is doing is irrelevant as long as the client is secure.
If the server can compromise the client, whether or not the client is open source does not matter.
People who believe that open source is a prerequisite for security are disregarding the entire discipline of reverse engineering which is a large chunk of software security expertise.
> The behavior described in your article is not a backdoor in WhatsApp. This is the overwhelming consensus of the cryptography and security community. It is also the collective opinion of the cryptography professionals whose names appear below. The behavior you highlight is a measured tradeoff that poses a remote threat in return for real benefits that help keep users secure, as we will discuss in a moment.
What real benefits are gained from making it easy for ISP-level attackers to mount man-in-the-middle attacks? Security from your spouse snooping on your phone? What's the threat model here and why are these experts so adamant in minimizing the security risks?
Moxie went as far as to ignore the opt-in aspect of the (very benign looking) key change notification, but he's on the payroll. What's the motivation of the other experts in this sudden "overwhelming consensus"?
Also, why would the key change be hidden by default when the phone number doesn't change? This is the actual mechanism described by Tobias Boelter in his report: https://tobi.rocks/2016/04/whats-app-retransmission-vulnerab...
Is this done to facilitate the "same SIM, lost local storage" scenario? Then the phone number is not only username but also a password and anybody able to steal the phone (or just the number) can impersonate a WhatsApp user. Is this the level of security these experts are protecting?
Calling it a fake new site says more about you than it says about the Guardian.
There's a big gap between theory and practice.