Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
DEAL: For $25 - Add A Second Phone Number To Your Smartphone for life! Use promo code SLASHDOT25. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. Check out the new SourceForge HTML5 Internet speed test! ×
Encryption Communications Privacy Security Software

WhatsApp Enables End-To-End Encryption For All Forms of Communications By Default 76

Popular instant messaging app WhatsApp, on Tuesday, announced that it is turning on end-to-end encryption for all its users by default. The company says that every call a user makes, every text message they send, all photos and videos they share will now be more secure. Furthermore, the encryption status of any chat is visible under the chat's preferences screen. The announcement comes a little over a year after the Facebook-owned company partnered with Open Whisper Systems, a nonprofit software group that develops collaborative open source projects with a mission to "make private communication simple." The end-to-end encryption feature is available on the latest version of the app. In a blog post, Open Whisper Systems further explains the feature: Once a client recognizes a contact as being fully e2e capable, it will not permit transmitting plaintext to that contact, even if that contact were to downgrade to a version of the software that is not fully e2e capable. This prevents the server or a network attacker from being able to perform a downgrade attack. In a blog post, WhatsApp writes: While WhatsApp is among the few communication platforms to build full end-to-end encryption that is on by default for everything you do, we expect that it will ultimately represent the future of personal communication. WhatsApp has also made available the technical details about how the two companies implemented this feature (PDF). For those of you who haven't heard of WhatsApp, it's an instant messaging and voice calling app. The free service, which is available across all popular platforms, is used by more than a billion people worldwide every month. A report on Wired says that a team of only 15 engineers enabled this security feature for over a billion users. Privacy researcher and activist Christopher Soghoian rightfully adds, "Google has no excuse."
This discussion has been archived. No new comments can be posted.

WhatsApp Enables End-To-End Encryption For All Forms of Communications By Default

Comments Filter:
  • Nice (Score:3, Insightful)

    by Anonymous Coward on Tuesday April 05, 2016 @01:48PM (#51847135)

    Nice, as it prevents dragnet surveillance. Still I don't want to use what's app just like signal as it doesn't work without GCM, with google/apple knowing my ip address all the time.

    The companies build their encryption so that only the data they are interested in and will monetize reaches them. But they still monetize your data. And for every encrypted messaging app that pops up, the moment you use a whatsapp bot or siri or google maps or whatever, they know your location.

  • by Anonymous Coward

    Honest questions: Does the user control the public/private keys that WhatsApp uses for this end-to-end encryption? How do they manage public key exchange, revocation, etc.?

    • by Meneth ( 872868 ) on Tuesday April 05, 2016 @04:09PM (#51848327)

      The user's device generates the private key, but only under the control of WhatsApp's closed-source app.

      The key exchange is done through WhatsApp's server, much like message exchange. There is no revokation, though I imagine a user who loses his private key could generate and register a new one. There are no certificates except for the connection to the server.

      An attacker would have to take control of WhatsApp's server, but once that is done, they could run classic MiTM attacks on all WhatsApp users.

      • by Anonymous Coward on Tuesday April 05, 2016 @05:26PM (#51848801)

        The user's device generates the private key, but only under the control of WhatsApp's closed-source app.

        The key exchange is done through WhatsApp's server, much like message exchange. There is no revokation, though I imagine a user who loses his private key could generate and register a new one. There are no certificates except for the connection to the server.

        An attacker would have to take control of WhatsApp's server, but once that is done, they could run classic MiTM attacks on all WhatsApp users.

        This is intellectually dishonest. Whatsapp allows you to verify the key signature either via barcode or via hash comparison.

      • by nospam007 ( 722110 ) * on Tuesday April 05, 2016 @06:08PM (#51849041)

        "An attacker would have to take control of WhatsApp's server, but once that is done, they could run classic MiTM attacks on all WhatsApp users."

        But in this case it would be THE MAN in the middle.

      • by Agripa ( 139780 )

        I have not used it but apparently the client has facilities to verify the key through an auxiliary communications channel manually (voice, text, whatever) so it would just take getting caught once to show that the WhatsApp server was compromised. I believe PGP phone had the same capability.

      • by beuges ( 613130 )

        It should be trivially easy to do the key exchange without WhatsApp being able to intercept the keys, even though they are relaying them between the two parties.*

        Assume Alice and Bob both use WhatsApp. Each generates a certificate with a private and public key. They publish their public keys via some directory service. Alice wants to chat to Bob securely. They currently don't have a relationship set up between them. So Alice looks up Bob's public key, and generates a random encryption key to be used for cha

  • by Torp ( 199297 ) on Tuesday April 05, 2016 @01:58PM (#51847231)

    ... in your living room will also be encrypted so only Facebook can data mine and sell it.

    • by Lumpy ( 12016 )

      I have Mark Zuckerberg hiding behind my entertainment center with a notepad and a parabolic microphone.

      • by Anonymous Coward

        That is a Chinese clone of Mark Zuckerberg. The real Mark Zuckerberg retired years ago and is living off his wealth stashed in a Patagonian bank held by a Panamanian firm.

        • by Lumpy ( 12016 )

          Nope it's the real deal... I think it's his new hobby.

          The fucker keeps stealing my pizza deliveries, and he puts the bluray disks in the wrong cases.

  • by xiando ( 770382 ) on Tuesday April 05, 2016 @02:00PM (#51847263) Homepage Journal
    Perhaps they really are implementing secure end-to-end but from their previous actions this announcement makes me suspect that something else which is actually secure is becoming so popular that an "approved" "secure" (but not really) needs to be pushed out to the ignorant masses.

    Show me the source code and I will consider trusting that this is secure. I am not going to just take their word for it because they have proved that it means nothing time and time again.
    • My first thought is less "they might be lying to us" and more "do they need some sort of penis-shaped sound wave"?

    • by rainwalker ( 174354 ) on Tuesday April 05, 2016 @03:44PM (#51848183)

      As I'm not a cryptographer, I have to trust what experts tell me (source code doesn't really help with this). Given that the people at Open Whisper Systems, who are fanatical privacy and security researchers and advocates, and who built the protocol that's being used and helped WhatsApp implement it, are giving this their stamp of approval, I'm just going to have to trust them. At some point, you have to pick that trust point, and Open Whisper Systems seems like a good point.

      • by unrtst ( 777550 )

        At some point, you have to pick that trust point, and Open Whisper Systems seems like a good point.

        You're doing it wrong.
        Think about any scientific breakthrough, algorithm, mathematical proof, etc. It's perfectly fine for all the work to originate at one person or closed group, but people don't trust it until it's been peer reviewed.

        I'm not claiming whether or not that's been done, or to what level, but it's not smart to pick a group of people and decide to trust them with a topic you admittedly don't know enough about just because they seem like good enough folks.

        At the very least, no; you do not have t

      • by Anonymous Coward

        Their cryptography and end-to-end encryption are not the issue. Let's assume they are perfect, given OWS' credentials. Lack of open source means that you have no idea if the Whatsapp app itself is taking your private key and sending it out elsewhere.

        I don't know how you'd prove it, but even if you proved that it doesn't for the current binary, updates are an issue. Apps update all the time. Updates either need to be audited (update frequency makes this hard), or you have to live without updating, which at s

        • by Etcetera ( 14711 )

          I don't know how you'd prove it, but even if you proved that it doesn't for the current binary, updates are an issue. Apps update all the time. Updates either need to be audited (update frequency makes this hard), or you have to live without updating, which at some point causes the app to not work.

          Yes, this is why hipster agile bullshit is often at odds with heavy certification processes, like FIPS-140-2 and other analysis.

      • by Pseudonymus Bosch ( 3479 ) on Tuesday April 05, 2016 @07:54PM (#51849467) Homepage

        In the words of Edward Snowden, "Use programs like Redphone, like Silent Circle â" anything by Moxie Marlinspike and Open Whisper System."

      • Thanks. Can not believe people smear Open Whisper.

      • by r0kk3rz ( 825106 )

        Sure as a layman you have to trust someone to verify the code for you. However wouldn't you want to place that trust in an open truly independent third-party code audit? I'm not saying that Open Whisper Systems is corrupt or untrustworthy, but they have likely been paid or contracted by Whatsapp to develop/certify this feature, and without a possible third-party code audit they have low risk of reputation damage if something dodgy was done.

    • by Threni ( 635302 )

      > I am not going to just take their word for it because they have proved that it means nothing time and time again.

      Who is "they"?

  • "more secure" than what? I'm glad people will feel better with end-to-end encryption. Of course the "end" of the encryption is the whats-app server, not the other party. That's a different "end-to-end". Otherwise how is Facebook/Whatsapp supposed to mine your data?
    • Re: (Score:3, Informative)

      by rahultyagi ( 924414 )
      Nope, in this case it really does look like the other "end" is the other party and not WhatsApp's servers. So, unless they are lying about it, it really does seem like user-to-user encryption (and hence, as you point out, no data mining for facebook).
      • by Dunbal ( 464142 ) *
        Free product. No advertising. Where are they getting their money? Sorry but I don't believe that whatsapp operates out of the kindness of Zuckerberg's heart. I'm willing to believe someone is lying. After all how liable can he be for a "product" you paid nothing for and clicked through a EULA for.
        • Re:Weasel words (Score:4, Informative)

          by Anonymous Coward on Tuesday April 05, 2016 @02:34PM (#51847651)

          The message content is opaque to them, but the meta-data of who talks to who, when, for how long and how often is not. Last I checked you still need a real phone number to sign up, so they can tie nearly all of their users to their real world identities. Considering that they are owned by facebook, all that meta-data gets fed in to facebook's behemoth databases of personal info.

          So it seems likely that even full-blown e2e is still revenue positive for them.

          That said, going full e2e, even with all the facebookian compromises is still an improvement in the baseline. This is a war of inches, so every inch matters, even when there is still a long road ahead.

  • Monetization? (Score:5, Interesting)

    by ramirodt ( 705616 ) on Tuesday April 05, 2016 @02:12PM (#51847413)
    How do they make money if they cannot sift through your data?
    • Well, some things are encrypted (contents of the conversation) some are not (who you talk to, and for how often). I read this an admission that FB's data mining through natural language is not nearly as valuable as their meta-data about networks. And that's probably because their AI isn't sophisticated enough yet.

      Which is only a matter of time, because FB can throw literal billions at natural language AI and it would be a reasonable expense.

    • This will merge into Facebook Messenger. People will get wise to needing secure end-to-end communications and would leave Facebook Messenger if it were not secure. This keeps people on Facebook. This improves the monetization through other parts of Facebook. Not every single piece of every single machine has to directly serve a single end goal.

  • Fully encrypted (Score:4, Insightful)

    by ThatsNotPudding ( 1045640 ) on Tuesday April 05, 2016 @02:16PM (#51847459)
    (except for all your data and metadata backdoor copied to the hivemind of Facebook). Why do you think they bought WhatsApp? To ensure they could NOT sell the product (users) to the customers (advertisers and TLAs)? Please. I wouldn't trust Zuckerburg farther than I could throw his precious snowflake (who is doomed to grow up to be an abject nightmare).
  • because Line is so much more usable, I really don't care if it has encryption or not, whatsapp just doesn't get a lookin any more

  • by grasshoppa ( 657393 ) <skennedy@NOSPAM.tpno-co.org> on Tuesday April 05, 2016 @03:22PM (#51848027) Homepage

    Meanwhile, in the land of the XMPP protocol, we've been end to end encrypted for over a decade.

    Seriously, why is it 2016 and this is NOT a standard feature of a chat protocol?

    • Meanwhile in real world nobody gives a damn about jabber.
      • Re: (Score:2, Insightful)

        by Anonymous Coward

        And this is why you don't have e2e encryption -- because you want to shit on the only protocol that has had e2e for over a decade.

        So to keep your snark going, dickhead:

        Meanwhile in the real world nobody really cares about end to end encryption because they could have had it by demanding and using XMPP but instead they decided to whore themselves out to the flashy and shiny Facebook and friends and agree to have their privacy raped and pillaged for no other reason than they needed to know what all of their "

      • by grasshoppa ( 657393 ) <skennedy@NOSPAM.tpno-co.org> on Tuesday April 05, 2016 @06:51PM (#51849243) Homepage

        That's more an indictment of the real world than jabber, wouldn't you say?

        That said, I don't know how popular the openfire server is, but that uses the same protocol ( XMPP ) as jabber. I know I use it quite extensively.

  • Who were quickly put to death after the encryption security was put in place so that no one can ever divulge their secrets!

    Now Pharaoh level security is available to everyone!

  • The few people with whom I exchange messages on whatsapp use so much shortcuts and abbreviations that conversations are very garbled, and I found myself unable to decode its meaning just after a few days. I don't see the need for adding further encryption here...
  • How does this work with web.whatsapp.com ?

    From https://blog.whatsapp.com/10000618/end-to-end-encryption/ [whatsapp.com]:

    "The idea is simple: when you send a message, the only person who can read it is the person or group chat that you send that message to. No one can see inside that message. [...] Not even us."

    But my browser connects to web.whatsapp.com ? Are the messages decrypted in the browser ? Is there a key in the cookies ?

    The first thing you do to connect is scan a QR code. I just tried scanning one with a g

    • There's something wrong with your keyboard. When you type a question mark it's inserting a space before it.

      Or maybe you're a retard.

"Catch a wave and you're sitting on top of the world." - The Beach Boys

Working...