Slashdot Mirror
Security Experts Rebut The Guardian's Report That Claimed WhatsApp Has a Backdoor (gizmodo.com)
William Turton, writing for Gizmodo: This morning, the Guardian published a story with an alarming headline: "WhatsApp backdoor allows snooping on encrypted messages." If true, this would have massive implications for the security and privacy of WhatsApp's one-billion-plus users. Fortunately, there's no backdoor in WhatsApp, and according to Alec Muffett, an experienced security researcher who spoke to Gizmodo, the Guardian's story is a "major league fuckwittage." [...] Fredric Jacobs, who was the iOS developer at Open Whisper Systems, the collective that designed and maintains the Signal encryption protocol, and who most recently worked at Apple, said, "Nothing new. Of course, if you don't verify keys Signal/WhatsApp/... can man-in-the-middle your communications." "I characterize the threat posed by such reportage as being fear and uncertainty and doubt on an 'anti-vaccination' scale," Muffett, who previously worked on Facebook's engineering security infrastructure team, told Gizmodo. "It is not a bug, it is working as designed and someone is saying it's a 'flaw' and pretending it is earth shattering when in fact it is ignorable." The supposed "backdoor" the Guardian is describing is actually a feature working as intended, and it would require significant collaboration with Facebook to be able to snoop on and intercept someone's encrypted messages, something the company is extremely unlikely to do. "There's a feature in WhatsApp that -- when you swap phones, get a new phone, factory reset, whatever -- when you install WhatsApp freshly on the new phone and continue a conversation, the encryption keys get re-negotiated to accommodate the new phone," Muffett told Gizmodo. Other security experts and journalists have also criticized The Guardian's story.
Does Skype even count as backdoored? It needs a new term, like glasshoused or NSAware.
Well, first off, I'm going to be a little suspicious of experts who find fuckwittage in their dictionary, when a stupid cacahead reference will do. I dunno that taking a temper tantrum reassures me all that much.
My guideline is that if it is allowed, it is visible to someone who wants to see it badly enough.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Muffet is saying it's "major league fuckwittage", while acknowledging that the main point is true: Facebook could in fact intercept messages.
Jacobs says "well duh, if you send a message without verifying keys" - and Whatsapp does just that, automatically resends the message before you have a chance to verify the key.
The Whatsapp client is proprietary and closed source.
It should be assumed to be compromised regardless of what anyone says about it.
A government is a body of people notably ungoverned - AC
Some disclaimer:
I have moderate IT Security experience. I'm admittedly not the ITSec convention-going type, but I've developed for solid security, done successful penetration testing on people's code and the likes... From the guardian's article, and from my POV, the major issue here is one of wording: a Backdoor is a feature, one intentionally added by developers and hidden from the end user-facing stuff such as UI and (R)TFM. This is definitely not a backdoor - it looks like a flaw, probably associated with different use cases of whatsapp vs the original API, considering it happens on verbose conditions, and it surely seems tricky to replicate without very explicit user behavior. Apparently even a change in defaults by whatsapp can solve this.
Now for the real issue:
How can anyone even start arguing about an article's guilt on this or Whatsapp intentions without tackling the subject that: every closed source app claiming privacy (such as whatsapp), however you paint it, can never do so as guaranteed without being open source. There is one way, and one way only, that privacy can be achieved without having to trust on privacy policies, disclosures, public legal action or even secretive court orders and it is to open source the damn thing and providing a way of building that outputs the same without the branding (think Chromium or the Mozilla suite in Debian).
Here's the deal: Whatsapp states it uses the Whisper API but they might as well not use it. Whisper and Signal might state they collaborate and trusts they do use it, but who is to say they aren't being paid for this, lying or even chain-trusting blindly in Whatsapp statements of use? Oh wait, so there's a legal binding document saying Whatsapp actually does this... BIG DEAL. There are also constitutions being RAPED EVERY DAY by US, Chinese, Russian, (every country?) security services.
Snowden advises on using Signal for two essential reasons that cannot be taken apart:
1. he has access to the shyt going on inside and...
2. he actually understands that shyt.
Number one is the big deal here, and number 2 is the reason he publicly admits his support for Signal - people trust his technical judgement. Granted, no.1 won't make much sense to 99% of the world at which point you have to start trusting on someone's technical ability, reputation and honor, and for fuck sake Whatsapp is a commercial application based in the US - they HAVE to lie about such things, they don't even get a choice. Just having no.1 is like placing your neck under the sword of the entire world community. It's a lot better than a feature list, and advert, a legal document, someone's word. it's everybody's word.
This is no conspiration theory, but logic beats trust, and most here, as engineers should be very aware of that. Even the trust in one's own actions isn't fallible - some people lie to themselves, some people don't know better than to believe they have failed at something and will trust blindly on their own ability. But sooner or later everybody finds out we are only as perfects as what we are made of. SHOW ME WHAT YOUR APP IS MADE OF and you will have the right for my complete blind trust (because it just isn't blind anymore). It can even be coded in esperanto (intentional bullshit here). It's the only way it is honestly submitted for scrutiny of your own statements of privacy and security.