Hacker News Reader

Comment by myth_buster | Hacker News Reader

  WhatsApp, with more than 1.2 billion active users, is one of the easiest ways to send secure information.
  “With WhatsApp, it’s as simple as sending a text message — but it’s encrypted,” Mr. Dance explained.

I'm not a security expert but I think this is not exactly the best practice. This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage.

Also the departure of WhatsApp founders under uncertain terms, doesn't give me much confidence with usage of that app for clandestine operations.

Perhaps folks here who are well versed with the state of the app can chime in.

View on HN

Please don't use the code formatting for quotes. It makes them nearly unreadable on mobile.

HN could fix this trivially. It's been requested numerous times. They refuse. For years.

Sigh.

True, it would probably be a small change, and it'd be nice to have code blocks readable on mobile.

However, the generally accepted quote syntax on HN does not use code blocks in the first place.

  > *Quote goes here*

And that's how I write extended quote blocks generally.

Some users don't, there is no one unambiguously correct method, and the 2nd- most common variant I see has several obvious detriments.

The fact that the "show us your code" feature seems to be predominantly used for blockquotes, on a generally technological site, strongly suggests a failure to correctly match user expectations and needs.

Though as metacommentary in infotech, SV, and YC, the message couldn't be clearer.

I think you're reading too much into it.

Seems more likely that it's a lack of instruction on the comment page. Discord manages to fit all of its formatting into the whitespace under the chat input....

That would help. Many sites now offer formatting tools or a "help" link or expando. HN elects not to. Some of this may be part of its intentional asthetic. But more proximate hep might, er, help.

How would you suggest they fix it?

Make groups of `/^\s+> /` lines turn into a `<blockquote>`. Render it slightly indented and italicized.

I don't think the major problem is that `/^ {4}/` lines don't wrap in a way that's useful for quotes; it's that there's no way to format quotes so people use the only formatting element HN has.

there's no way to format quotes so people use the only formatting element HN has.

Technically, HN has a couple other formatting elements.

> I don't think the major problem is that `/^ {4}/` lines don't wrap in a way that's useful for quotes; it's that there's no way to format quotes so people use the only formatting element HN has.

It is a standing convention to use the following syntax for quotes here:

  > *Quote text here*

CSS:

    pre { whitespace: pre-wrap; }

https://www.w3schools.com/cssref/pr_text_white-space.asp

That's what I've included in my own HN Stylus stylesheet for years. Works on Desktop or Firefox/Android, but other mobile browsers don't support it, for lack of extension support.

Updating the HN markup to offer true blockquote support would be a more complete, though less trivial, solution.

I've suggested the first myself repeatedly.

pg asked how to fix this, and was given the solution, on HN, nine years ago:

https://news.ycombinator.com/item?id=592603

The suggestion's been made numerous times:

https://hn.algolia.com/?query=whitespace%20pre-wrap&sort=byP...

Markdown renderer?

I wish. Though that's .. only slightly ... less trivial.

It's not HN's job to inspect every code block to determine if it's _actually_ code. If you use the code syntax, it's code. That's the assumption that every markdown renderer makes, and I wouldn't expect anyone to assume otherwise.

Format your posts appropriately - that's the sole burden of the writer, no one else's.

If a design leads to a decade or more of frequent misuse to the point of derailing dicussions, it's a bad design.

Don't blame the user.

Not to mention if they have automatic backup enabled on the phone, it bypasses the E2E encryption and adds another third party to the list that can read the messages. You never know if the other person has it enabled or not.

https://www.engadget.com/2018/08/29/whatsapp-google-drive-ba...

> This may have been true pre-fb acquisition but there has been changes to how WhatsApp behaves, especially server side storage.

WhatsApp messages are encrypted end-to-end between each person using it. The whole point of end-to-end encryption is not having to trust the server-side storage.

Furthermore, WhatsApp uses the Signal Protocol-- the state-of-the-art for secure messaging protocols.

The worst that WhatsApp can see is "who's talking to who?"

Finally, the adoption of the Signal Protocol in WhatsApp came long after the Facebook acquisition.

So, no. It wasn't better off pre-fb.

> who's talking to who?

That can be a problem when you're a whistle blower contacting a journalist.

Sure, that can be a problem. However, it's completely irrelevant to the problem of server-side storage, as the comment I replied to was citing.

(Server-side storage is a non-issue, due to the encryption protocols in use. It doesn't matter if you distrust Facebook, they aren't going to be able to read your messages. End of.)

I avoid WhatsApp but this is correct AFAIK (given that they don't push a malicious client at some point.)

The main problems with WhatsApp are as I can see:

- they scoop up metadata

- they upload the data more or less plaintext to Google for backup. (I personally dislike but trust Google but not everyone trusts them.)

- they paid way to much for it to not try to monetize it in all kinds of crazy ways

> given that they don't push a malicious client at some point

How do we know this hasn't happened already?

How do we know it won't happen tomorrow?

Because there are a number of people constantly reverse engineering these clients to be sure that it doesn’t.

This doesn’t really help as much as you seem to hope for. As a counterpoint, I would like to introduce you to the Underhanded competitions:

http://www.underhanded-c.org

https://underhandedcrypto.com

> How do we know this hasn't happened already?

As has been pointed out here in the chat already: Scott (and others) have reverse engineered it.

> How do we know it won't happen tomorrow?

Consequences.

Even Facebook seems to realize that is the nuclear option.

That said there is a number of places this can still go wrong, but they are equally true for any mainstream client (edit:) and non mainstream clients have their own issues.

Personally neither like nor trust Facebook at all so I try to minimize contact.

Exactly you would never use electronic means to actually transmit information.

Thanks for clarifying. Even with E2E wouldn't you still want the code to be open source or an independent audit done? As I said, not an expert.

I'd want it, sure.

But I could also just dex2jar + JD-GUI the Android app and study the decompiled Java code to see what they're doing.

Edited to add: https://twitter.com/CiPHPerCoder/status/1042870740880637952

WhatsApp requires you send the server the entirety of your contact list. No thanks.

Not true.

I use WhatsApp without doing that (on iOS), but it does require other people to contact you first before you can have a conversation.

Really? So you don’t simply get this? :

https://share.icloud.com/photos/0xU-mTEbBSDtCRSgVUGGhp8Kw

Obligatory "don't forget to authenticate the other party. Encryption can be meaningless without authentication if someone MITMs the initial setup.

Follow-through on WatsApp's initial verification step using some other channel before you assume the communication is secret.

So why not just use Signal? Why even remotely trust Facebook?

Or Keybase? Signal has similar weaknesses as WhatsApp

> The worst that WhatsApp can see is "who's talking to who

Not really, given keys are centrally managed, it is fairly straightforward for WhatsApp to setup MITM intercept.

In fact they don't even need to push a malicious client etc, they just need to push a different public key than the sender/receiver's actual ones when contacts mutually add each other and this will quite simply allow MITM interception unless the people do key verification in person. If what the whistle blower is trying to do is stay anonymous - would they physically meet the reporter immediately?

They could even push new keys to existing mutual contacts and get away with it since most people don't display or again verify key change messages.

Lastly, most people turn on message backup in Google drive which is not encrypted - so a warrant or an account hack would suffice.

WhatsApp implementation can protect basically from malicious non state actors. That's a great thing in today's world in itself but be aware of the underlying tech.

In general you cannot be certain of anything in today's world with regards to security. You have to trust someone. Actually, you have to trust a lot of people: hardware vendors, compiler vendors, OS vendors, and application software vendors. Any one of these could, if they chose to, easily introduce a back-door into your "secure" system. The only way to be absolutely certain that no one has done this is to build your own hardware from discrete components and write all your own code from the bare metal on up, and even then you have to trust yourself not to have made a single mistake in a realm where even experts regularly do.

Personally, I don't trust FB, but for a non-technical person there aren't any clearly superior alternatives.

I believe Signal and Wire are both clearly superior alternatives when it comes to privacy and trust. Both are easy to use for non-technical people.

Signal's iOS app is really nothing to write home about (imho) and its desktop app is often downright unusable.

I have not used Wire beyond a test install but it indeed looked promising. In a sense it's even better than Telegram that allows you to just use usernames but you have to add a phone number anyway (also if the other Telegram user by any chance has your phone number in their contacts then your identity is revealed anyway).

But I'd say that Telegram's apps (mobile and desktop both) are superior too all the major IM apps around. I wish they could be more forthcoming about openness.

As far as I'm aware of, Facebook collects and stores all the meta-data WhatsApp generates. Which means, that it can provide a list of phone numbers, IP addresses, or even GPS coordinates(?) of the people who contacted the journalist at any specific time. So, even if the messages are encrypted, a person can still be tracked down.

myth_buster, lisper, & newscracker make interesting points.

In researching WhatsApp a while ago, I came across this in a Quora post "But one more point I want to stress here is that, though whatsapp is allowing end to end communication , it does not necessarily mean they can not analyse the encrypted data. in cryptography we call it Searchable Encryption." (https://www.quora.com/Now-that-WhatsApp-can-no-longer-read-y...)

I don't know whether it is accurate to WhatsApp, but it's certainly food for thought and also made me wonder how many other end-end encrypted systems use it.

I personally don't trust FB. WhatsApp is not open source, so I have to trust what FB says. I don't.

There are many important considerations in secure messaging and the EFF has done a reasonable job of trying to cover the subject in their series on messaging (https://www.eff.org/deeplinks/2018/03/secure-messaging-more-...)

You can reverse engineer any Android app in very little time. Professionals use frameworks like Lobotomy, but you can get by with dex2jar and JD-GUI for most of it.

It not being open source is a political argument, not a technical one.

EDIT: I ended up doing just that. It took roughly 5 minutes (most of that was making sure I had my PATH for Java set up correctly on this machine) to get decompiled Java code ready to inspect.

https://pbs.twimg.com/media/DnkFaKxU8AE4mFn.jpg

"It not being open source is a political argument, not a technical one."

If I can compare the open source to the reverse engineered code to see what I'm really using/getting, that seems like a technical advantage. Also, all of the reverse engineered code I've worked with has been difficult and time consuming to digest (missing var names, comments etc); open source gives me a technical advantage in analyzing and understanding the code. Lastly, looking at a companies open source lets me assess their technical sophistication and practices which also seems like a technical advantage.

I haven't spent much time thinking on this subject, but the political aspect seems to be the line of thinking that says: you will engender trust by making a project open source.

Is your reasoning similar?

Also are there good tools for reverse engineering iOS deployments?

There is one tangible benefit to open source: reproducible builds. Everything else comes down to personnel, budget, and scheduling.

I'm not an Apple consumer, I don't know anything about iOS in particular.

> Also are there good tools for reverse engineering iOS deployments?

There are many; since apps are native on iOS a standard disassembler would work. But there are many more specialized tools, such as class-dump and Hopper.

I know Telegram isn't something truly "open" either (and just to mention, neither is Signal) but I don't need to reverse engineer Telegram app. I actually had its repo cloned and synced and had built and tested it couple of times. Though at the time I ended up not using the Telegram as among my contacts few were using it.

My point is open sourced code is much more readable and hence more accessible and you can build it yourself and use it most of the times.

Whether or not it's open source is irrelevant to the trust issue. You would still have to look at the binary to check whether its behavior matches that of the putative source code. Either way, you end up examining the behavior of the compiled code.

It is not irrelevant. If you can't build the binary from code yourself you have no way to know if it is trustworthy. Step one in finding out if it is is to look at the source and then compile it. After that you can look if it does strange things because of something you missed in the code but without step one you might as well not start at all. It will always be at most guesswork.

Virtually no one who uses software compiles it themselves, so this is not a very interesting rebuttal.

Meanwhile, it's not 1994 anymore, and people who know how to look for bugs can (I know this is hard for some people to wrap their heads around) look inside of binaries and draw conclusions about how programs work. There's a name for it; it's a kind of engineering.

So, something like Matrix/Riot?

Build it yourself and host/use your own app builds and server instances. But then I'll have trust the company I bought my VPS from to host my Matrix instance, isn't it?

Even if the message contents is encrypted, doesn't whatsapp still log the source and destination and their phone number and associate these with real persons? It should be trivial enough to figure out who delivered which tip by knowing a particular person sent something to that tip line.

Yep. And to verify or to find out exactly what was written you just need to get the backups from either the sender or the receiver.

This can be done in a number of ways from subpoenas to hacking to threats/blackmail.

How can I as an iOS user know that the message is encrypted? I don't see how.

Like lisper said above, you cannot really be certain of anything. Taken to an extreme, you can’t even be certain if the padlock icon on your browser signifying a secure HTTPS connection is truly secure or not. You decide to trust certain things with the assumption that everyone else out there is not out to get you, and that those who’re considered experts in this domain do practice honesty and that there are people who do care more about the rest of the population than their own paychecks.

In the case of WhatsApp, we do have public confirmation of the Signal team working with WhatsApp to implement end-to-end encryption. [1]

[1]: https://signal.org/blog/whatsapp-complete/

Reply on news.ycombinator.com