Does anyone know what the disclosure story is here?
Have WhatsApp and Signal had a chance to respond?
Have WhatsApp and Signal had a chance to respond?
"The researchers say that Open Whisper Systems, the non-profit that runs and maintains Signal, nonetheless responded to their work, saying that it's currently redesigning how Signal handles group messaging. Open Whisper Systems declined to comment on the record to WIRED about the Ruhr researchers' findings."
"In a phone call with WIRED, a WhatsApp spokesperson confirmed the researchers' findings. [...]And the WhatsApp spokesperson also noted that preventing the Ruhr University researchers' attack would likely break a popular WhatsApp feature that allows anyone to join a group simply by clicking on a URL." So I don't think WhatsApp will fix it.
And for those concerned about the issue, you can monitor the member list and make sure you carefully check all messages. If you're really concerned about encryption that's what you should do anyway.
I think this is false, I wrote that on the Wired thread, but here's a way to fix it:
1. when you create a joining link, it creates a secret uuid
2. this uuid is shared with the rest of the group
3. if Alice joins the group, every uuid created is shared to Alice (except the one Alice used, if Alice used a joining link)
4. when Bob attempts to join the group via the group id, if Bob does not have a known code Bob is refused
5. if Bob uses a known code, Bob is accepted and everyone deletes the code
This does not prevent different participant views to be created, but this is already a problem in WA anyway.
This was quite some time ago, so they have been aware of that it was lacking somehow, possibly even before this was discovered.
Guessing the 128-bit number is non-trivial, and once someone has the ability to access the group id, all is already failed.