Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Encryption United Kingdom Privacy News

Encrypted WhatsApp Message Recovered From Westminster Terrorist's Phone (indiatimes.com) 143

Bruce66423 brings word that a terrorist's WhatsApp message has been decrypted "using techniques that 'cannot be disclosed for security reasons', though 'sources said they now have the technical expertise to repeat the process in future.'" The Economic Times reports: U.K. security services have managed to decode the last message sent out by Khalid Masood before he rammed his high-speed car into pedestrians on Westminster Bridge and stabbed to death a police officer at the gates of Parliament on March 22. The access to Masood's message was achieved by what has been described by security sources as a use of "human and technical intelligence"...

The issue of WhatsApp's encrypted service, which is closed to anyone besides the sender and recipient, had come under criticism soon after the attack. "It's completely unacceptable. There should be no place for terrorists to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other," U.K. home secretary Amber Rudd had said.

Security sources say the message showed the victim's motive was military action in Muslim countries, while the article adds that though ISIS claimed responsibility for the attack, "no evidence has emerged to back this up."
This discussion has been archived. No new comments can be posted.

Encrypted WhatsApp Message Recovered From Westminster Terrorist's Phone

Comments Filter:
  • Bullshit. (Score:5, Insightful)

    by Frosty Piss ( 770223 ) * on Saturday April 29, 2017 @12:44PM (#54325365)

    The claim is dubious. Why would they inform all the Terrorists that they can decrypt WhatsApp with ease? They wouldn't. The reason for the "disclosure" is to influence Terrorists to use some other - perhaps less secure - means of communication because they CAN NOT decrypt WhatsApp.

    • Re:Bullshit. (Score:5, Interesting)

      by Anonymous Coward on Saturday April 29, 2017 @12:49PM (#54325381)

      It's possible that they didn't actually decrypt anything and, instead, managed to get into the phone. If the terrorist didn't secure his phone, then whatsapp could easily be opened and messages read. They had access to his phone, that was stated in the article.

      • by janoc ( 699997 )

        That. Or simply retrieved the content from some temporary file/cache/whatever Whatsapp uses. Another possibility is that they simply got the content from whoever the message was sent to - which would explain the "human intelligence" (aka interrogating someone) part.

        • Re:Bullshit. (Score:5, Informative)

          by monkeyzoo ( 3985097 ) on Saturday April 29, 2017 @01:28PM (#54325557)

          Lookup information on Open Whisper end-to-end encryption, which is what WhatsApp uses. You will see that the whole point of the system is to prevent police from "simply" doing what you have said. There are no unencrypted temporary files, caches, etc.

          Getting the contents from the recipient is a valid possibility however without defeating the technology.

          • Re:Bullshit. (Score:5, Insightful)

            by 110010001000 ( 697113 ) on Saturday April 29, 2017 @02:01PM (#54325679) Homepage Journal
            How do you know that is what WhatsApp uses? It is closed source. They could be doing anything, no matter what they CLAIM they are using. They could be sending all of your messages directly to the NSA. Why do people trust closed source apps?
            • Re:Bullshit. (Score:4, Insightful)

              by thegarbz ( 1787294 ) on Saturday April 29, 2017 @03:52PM (#54325981)

              Why do you trust open source apps? No really, do you read all the code and then compile it yourself?

              Just because something leaves an audit trail doesn't make it impervious to fraud.

              • Re:Bullshit. (Score:4, Insightful)

                by markdavis ( 642305 ) on Saturday April 29, 2017 @04:13PM (#54326059)

                >"Why do you trust open source apps? No really, do you read all the code and then compile it yourself?"

                At least it is POSSIBLE. With closed source, it is absolutely impossible for the end user to know what the program is doing. It means watchdog organizations can audit it and anyone can verify it. I don't look at much of my open source code, but you can bet someone is, and all it takes is one person to blow the whistle. And someone can compile it and compare the hashsum on distributed binaries to ensure it hasn't been tampered with downstream.

                • by johanw ( 1001493 )

                  For Android apps you can run it through a decompiler and check, although that is a lot more work.

                • At least it is POSSIBLE. With closed source, it is absolutely impossible for the end user to know what the program is doing.

                  Double bullshit. For example, with Apple's iMessage it would be absolutely possible to detect if Apple was performing a MitM attack instead of just encrypting the sender's message with the receiver's public key.

                  • How do you verify that iMessage is not sending your message to both the intended sender and someone else? How do you check whether the public key the message has been encrypted to is actually that one of your contact's? Oh, you trust the information that iMessage gives you...

                • At least it is POSSIBLE.

                  No it's not. For all but a tiny handful of people auditing the source is not possible as they lack the requisite skill or funding to get it done. How many open source programs out there actively get audited? And no, someone looking contributing to the code is not an audit. Many eyes are able to glaze over even the most simple of bugs.

                  but you can bet someone is

                  A bet that has been proven false over and over again in the past 5 years. From huge bugs discovered in very widely used software, to distrust in security software in general. W

              • Re:Bullshit. (Score:4, Interesting)

                by johanw ( 1001493 ) on Saturday April 29, 2017 @05:45PM (#54326333)

                In the case of Signal, I do build it myself from source because I want to make some changes, like adding a decent backup function that Moxie won't do in Signal for some reason he doesn't want to explain. But apart from that, they have reprodcable builds so you can check a self compiled version is the same as the one you download (except for the signature of course).

                • Did you audit the code base line for line as you went?

                  The point is that few people have the technical ability to do that. Even fewer would catch underhanded code. e.g. Truecrypt. Not a massively complicated program yet took a team 2 years to actually audit.

                  You can trust open source a bit more than closed source in that you can be sure actively underhanded backdoors are likely to be marginally obfuscated, and that's about it.

              • No really, do you read all the code and then compile it yourself?

                Thats what I would do if I had a particular need for security. But its really hard to do. Software I control on top of a kernel I don't control is no real help to me. I am seriously thinking about a micro controller solution.

            • by Xest ( 935314 )

              I know that this is a novel concept in this day and age, but some of us are still capable of understanding that closed source doesn't prevent reverse engineering of the product, it merely makes it harder.

              Something being closed source doesn't mean it's a closed book, that's why we've had everything from DVD Jon to hacked Playstations over the years.

          • Whatsapp is proven insecure and it is also not identical to whisper but in fact a derivative... Do not use it for secure messaging, only signal remains confidently secure end to end https://www.schneier.com/blog/... [schneier.com]
            • True. Open Whisper apparently partnered with WhatsApp on the implementation though. Other than the dubious decision regarding handling of key changes, there hasn't been any discussion of problems in the implementation of WhatsApp for end-to-end encryption. So this new finding is troubling!

          • by johanw ( 1001493 )

            However, WhatsApp tries to persuade you to make an unencrypted backup in the Google cloud if you run Android. And it won't take no for an answer, after refusing it tries again after some time.

            • Oh, so that's not just me? I always wondered why sometimes I would open WhatsApp and it was on the backup settings page. I always figured I had fat fingered it. ANNOYING!

        • Re:Bullshit. (Score:5, Interesting)

          by AmiMoJo ( 196126 ) <mojo AT world3 DOT net> on Sunday April 30, 2017 @02:11AM (#54327603) Homepage Journal

          The BBC reported that they simply got it from the phone of the recipient (which they knew from metadata) who cooperated with them. That person was innocent and uninvolved in the attack so simply gave them the message in plain text.

          Sorry no link, the BBC search engine is crap.

          • What puzzles me is why they didn't get it from Khalid Masood's phone. Unless he deleted the log, the message he sent is sitting on there.

            • by mjwx ( 966435 )

              What puzzles me is why they didn't get it from Khalid Masood's phone. Unless he deleted the log, the message he sent is sitting on there.

              Allegedly, WhatsApp does not keep local files.

              However unless he actually logged out of the app, they would have been able to retrieve it from the server.

        • Another possibility is that they simply got the content from whoever the message was sent to

          My first suspicion too.

      • Re:Bullshit. (Score:4, Interesting)

        by thewolfkin ( 2790519 ) on Saturday April 29, 2017 @12:55PM (#54325411) Homepage Journal
        exactly. physical security is the first security. given that was compromised. It seems more likely that was the vector they used.
      • by johanw ( 1001493 )

        Accessing WhatsApp messages on a phone is easy when you have access to the device, even if it's locked (but not encrypted). Or they managed to get access to the unencrypted backup WhatsApp wants to make on Google Drive if you allow it (and have a Google account active on the phone). Assuming it was Android, I don't know how well that works with Apple.

    • They want you to think that they think they can trick you to using what's app by saying they can decrypt it when they can so that you will think they are saying they can decrypt it so you will think they can't because they are saying they can.. And yes that also makes no sense, just like your post.

    • by gweihir ( 88907 )

      Or alternatively, a moron politician that cannot be punished for an exceptionally stupid mistake was told by accident and then thought it was a good idea to tell the whole world. But outside of that, giving away a valuable source like the ability to decrypt WhatsApp is not likely to happen, I completely agree. The only other reason I see is because that ability was already about to become public.

    • Re:Bullshit. (Score:5, Insightful)

      by TheOuterLinux ( 4778741 ) on Saturday April 29, 2017 @05:00PM (#54326209)

      WhatsApp is owned by Facebook. It's encryption is a joke when the right people are asked nicely, hence the "using techniques that 'cannot be disclosed for security reasons.' What they mean is they can't tell you how they did it because it would look REALLY bad if people realized how stupid it is to put your faith in a company that specializes in profiling and biometric data collection; https://www.whatsapp.com/faq/g... [whatsapp.com]. If you're using WhatsApp on Google anything (Android, Chrome, etc.), you're in even worse shape because it's Google for Christ's sake. Remember Dirty COW? Google waited until after the election to fix it while every other Linux-based OS did months ahead of them.

      But anyway, Facebook also invests huge amounts of money into cloud computing and AI. That combination one day will make all encryption and anonymity useless because we will all be digitally fingerprinted whether you have an account or not, especially if quantum computing advances, and you can assume your government will get a copy, just like they get copies of your DNA when you fall for the "fun and easy" TV advertised "ancestry" services. This "profile" is going to replace social security numbers. If you want real encryption (at least for now), use Signal (similar to Telegram but better) or a Tox client (similar to OpenVPN but for messaging). More importantly, use your brain. Both are free and open source and support text, talk, video, and file sharing. I would never use anything that important that I couldn't look at the code for. If you could look at WhatsApp's source code, I think security researchers would be horrified. And, Facebook gets caught spying on their mobile app all the time, so I don't see how WhatsApp would be any different. And just because a lot of people use it, doesn't make it the best. Matter of fact, that would make more of a target.

      Some of the above links are kind of old, but note the ISP one. Legally, your internet service provider in the U.S. can sell your browsing information. Because of this, intelligence agencies can just purchase your data for cheap rather than getting a warrant and paying a government employee to waste their time. I'm mentioning ISP because Facebook has been trying for over a year now to bring the Internet to all kinds of places. They would become an "Internet Service Provider." In any case, if the app has an advertisement, you can be tracked.

      The real note to take away from this is to realize data can be created and never destroyed and don't put anything on the internet you don't want found. I wish people would realize privacy settings are a joke; they only protect you from the average person. Anytime you see "convenient" or "secure" for a service, just assume it's complete BS because your government doesn't have the time or resources to actually physically search and seize everyone so they have software for it, contrary to "Martial Law" conspiracies; cloud computing makes it easier.

      And since this news regarding terrorism, do you know why it was so hard to find Osama? It's because so far as we know, the most technologically advanced thing he ever personally used was a kidney dialysis machine or the Cold War weapons the U.S. gave him. The wor

      • Whoa. Way to completely miss the point. Facebook messenger and WhatsApp are completely different apps. WhatsApp is using the Signal protocol which is pretty much the best there is at the moment. All the messages and calls are end-to-end encrypted with the kind of crypto nerds used to only dream about. Mass surveillance is not possible (even for Facebook) with WhatsApp, because the attacker would need to do a MitM attack on all the discussions, which is easily detectable. Another option is to install malware

        • Then why not just use Signal? It already supports text, talk, and video. Using a privacy app owned by Facebook seems like an oxymoron.
          • I do, but most of my friends don't. Pretty much everyone has whatsapp these days though.

            WhatsApp is not a privacy app. It's a messaging app which also happens to have a hard core crypto implementation under the hood. That's a huge win for normal people who think they don't have anything to hide and don't know or care about encryption. They still have all their messages end-to-end encrypted and they don't have to do anything about it.

    • by AHuxley ( 892839 )
      To heard interesting people to all kinds of other waiting networks that are security service fronts.
      A fancy new app everyone is talking about, that nice GUI, local language support, readable fonts, lawyers and statements about protecting all users rights. Vast funding that never stops.

      It's like buying crypto for an embassy or company in the 1950-80's. So many private sector options for a nation, gov or company to select from. Go with US, UK, NATO quality to keep the Soviet Union out?. Something from
  • WhatsApp backdoor. Can be nothing else.
    • by gweihir ( 88907 )

      Can be a lot of other things, including plain old misdirection. For example, the phone may have been compromised long before.

  • idiot (Score:5, Insightful)

    by ooloorie ( 4394035 ) on Saturday April 29, 2017 @01:00PM (#54325431)

    "It's completely unacceptable. There should be no place for terrorists to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other,"

    It is completely unacceptable that history majors like Amber Rudd, who evidently has not the slightest understanding of technology, end up in positions like Home Secretary. or "Secretary of State for Energy and Climate Change". Rudd seems to be an object lesson in how money and political connections trump competency and skill.

    • Re:idiot (Score:4, Interesting)

      by gweihir ( 88907 ) on Saturday April 29, 2017 @03:28PM (#54325909)

      Indeed. The whole statement is so utterly stupid and disconnected from reality _and_ misses what states that tried to get where she wants to go were like (Stalinism, 3rd Reich, etc.) that she cannot be any good at understanding history either. So they have a _bad_ history major as Home Secretary.

    • Re: (Score:3, Insightful)

      by Matt Bury ( 4823023 )

      OK, let's play with Rudd's statement for a little while. Since any weakening of internet security applies to everyone who uses the internet, not just the people Rudd would like it to affect, how substituting the keyword "terrorist" for something else and see how it sounds then?

      "It's completely unacceptable. There should be no place for [PLACEHOLDER] to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for [PLACEHOLDER] to communicate with each other,"

      Investment bankers? Grassroots political organisers? MI5 and MI6 agents? Any more ideas?

  • by Murdoch5 ( 1563847 ) on Saturday April 29, 2017 @01:00PM (#54325435)
    Regardless if the claim is true or not, all your data and messaging should be encrypted at all times PERIOD! I will gladly accept terror acts for the right to have my data protected and safely stored. Across all my computers and my phone, everything is encrypted when possible, including my emails, which are sent from a encrypted provider, my SMS messages, which are sent encrypted and almost everything else I do. Encryption is a right to not have your data / personal information exposed and one that must be protected, even if that means acts of terror are untracable / untrackable.
    • by Anonymous Coward

      Why.
      I'm still waiting on an answer to why folk think A) that they NEED to encrypt everything.
      B) what are you up to that you think you NEED to encrypt anything.
      C) that there are nearly always methods for getting at data before or after encryption.
      D) you don't think folk like yourself are the ones the spooks will spend resources on to answer the above questions.
      Me,I don't give a toss if the authorities realy want to know what I'm up to,they will find out one way or the other,I've been under almost constant wa

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Since you asked...

        A. I don't. But the more of my data that is encrypted, the less noticeable data that I critically need to be encrypted will be to would-be eavesdroppers. No sense in drawing any further attention to the occasions when I really do require it. Plus if I am always using it, then I don't have to especially remember to do anything out of the ordinary when I do actually need it.

        B. Anything that requires some security against malicious eavesdroppers who might use the information to cause

      • by Anonymous Coward

        Different AC.

        A. Because we believe the government, (or anyone else for that matter), has no business monitoring every little thing we do, regardless of the reason. If the government wants to monitor us, prove to a judge that we may have done something illegal and get a warrant. It's basic due process, one of the things promised to us by the U.S. Constitution and the Bill of Rights as citizens. For everyone else, too bad get over it and find something else to do other than attempting to frame others so you c

        • why does the government think that Terrorism, (or whatever excuse they want to use), gives them the moral right, ethical right, and legal authority to just ignore their own laws, rules, and promises, and do whatever the fuck they want?

          Because the spectre of terrorism (in the media) exists for precisely this reason.

  • by Anonymous Coward on Saturday April 29, 2017 @01:01PM (#54325445)

    (OBNOTE: they might have done something far different, but this is one way it could be done -- and it is being done in Brazil):

    1. Clone the victim's phone line (not chip, not iemsi, you just need to reassign its phoneline. Costs about US$100 in Brazil to get a sleazy, disgruntled phone-company-cellphone-outlet employee to do it for you).

    2. Using the rogue SIM that has the victims' phone number active for a while, install whatsup. Do the SMS verification, it will pass. And yes, that *does* mean you could use the same !@#$@#$ trick to invade banking accounts, steal accounts with SMS verification enabled, etc. Say, like google, microsoft, or DNS registrar (and from there, anything else, such as US$ 200k-worth twitter identities, etc).

    ==> IT IS NO JOKE that the newest US gov regulations *strongly recommends against* (read: FORBID) the use of anything phone-carrier-routed (SMS, voice, phone number, etc) for security id/validation.

    3. Whatsup will download the message history and contacts database, and you have access to the information.

    Now, if the target is not an imbecile, he has whatsup 2FA enabled. That means step (2) is a lot more difficult, *but not impossible*. Here's where human intelligence can help, phone hacking can help, and even a court order for whatsup to NOT nuke the account no matter how many failed tries (assuming this does not run afoul of whatever protections did not allow them to order whatsup to shell out the history directly) can help.

    IOW: have you removed the insanely dangerous "phone-number-based" recovery options of every account you treasure? If you did not, you better do now. It is quite possible to add defensive layers to SMS-based and voice-based recovery options, but all of them are of the "force several successful attempts over a *large* period of time, with random factors involved" so that the victim will notice what is happening, recover his phone number, and engage defensive measures. NOBODY implements this.

    • by ezdiy ( 2717051 )
      Here, telcos are not *that* corrupted to reroute a number, however social engineering tricks are to be played with PNM [wikipedia.org]. It is also why banks raise a fraud alert when you port your number to Google Voice, because you cut off the SIMtoolkit pairing. You need the original STK applet key to decode the bank's 2FA SMS handshake. Without it, the SMS will be delivered normally, and the bank will be notified it went somewhere where it shouldn't.

      As for police, they simply ask the telco to tee pipe SMS to them, or
    • by Anonymous Coward

      "==> IT IS NO JOKE that the newest US gov regulations *strongly recommends against* (read: FORBID) the use of anything phone-carrier-routed (SMS, voice, phone number, etc) for security id/validation."

      Tell that to google, it's constantly asking me to put in a phone # for recovery... Never mind I don't even have one but yes it would be stupid to use this for security

  • by mean pun ( 717227 ) on Saturday April 29, 2017 @01:03PM (#54325455)
    I must assume that the phrase 'the victim's motive' in the summary should be 'the terrorist's motive'.
  • by HalAtWork ( 926717 ) on Saturday April 29, 2017 @01:04PM (#54325459)

    If there's no place for terrorists to hide then there's no place for *anyone* to hide, and that is unacceptable considering how valuable it is to hide from oppression or the abusers of the system used to ensure there are no hiding spots, those who operate the system are disproportionately advantaged and with access comes the capability of concealing themselves, censoring, framing content and concealing context, etc.

    This idea is ridiculous and imbalanced off the bat.

    • by Anonymous Coward

      There is a very, very small chance that you'll ever encounter, let alone be killed by, a terrorist.

      There is a huge chance that people like Amber Rudd will intrude on and screw up your lives if they are left unchecked to carry out their statist power grabs.

      Terrorists are relatively easy to deal with, if one has the courage to simply not let terrorists into one's territory. Power grabbing cop-worshipping statists on the other hand are a purely domestic problem in pretty much every country, but they need deal

    • Re: (Score:2, Insightful)

      by gweihir ( 88907 )

      Alternatively, she just asked knowingly for full-blown Fascism. I really would not rule that out anymore. George Orwell seems to have had the number of the British political class.

      • As far as I can tell, Amber Rudd is trying to force her policy through by appealing to emotions and fear. She is willing to use the act of violence (admittedly, somebody else took care of the dirty work for her) to further her agenda. Now, isn't that the very definition of a terrorist?

        Then again, perhaps it's a moot point. The word "terrorist" has lost most of its meaning, and simply means enemy or opponent by now. So you could call her an enemy of the people, I suppose. That goes for a lot of people in pow

    • As a Brit: annoyingly, she's not the only one of our leaders who has no idea about technology. This probably won't be the last time they try to screw with the nuts and bolts of modern technology.

      We also had that stupid cookie law. [silktide.com] Rather than ruling that, say, e-commerce sites be required to provide the option to delete your credit-card details on request (something websites still aren't required to do), they forced websites to show a warning if they used cookies. Perhaps in some alternate universe, people

  • by Anonymous Coward

    'nuff said

    riddled with security weaknesses you could drive a truck through

  • Original article: (Score:5, Informative)

    by Gravis Zero ( 934156 ) on Saturday April 29, 2017 @01:16PM (#54325507)

    Here's the original article [independent.co.uk] that this is all based on.

  • by 93 Escort Wagon ( 326346 ) on Saturday April 29, 2017 @01:55PM (#54325657)

    They had a specifically targeted phone, they used "human and technical intelligence" to get into it. No broad request (specifically from them, anyway, in this case) to compromise everyone else's personal privacy and financial security in pursuit of their goal.

    On the face of it, at least, this seems to be what I would want them to do.

    • As pointed out above, and what I suspected already, most likely there is no encryption broken: they asked the recipient (one of the suspect's contacts) nicely, and recipient simply gave them the message. A much more likely scenario than breaking the encryption of a single message that happens to be of utmost importance.

      I for one mostly trust WhatsApp to put effort in working encryption. Why? It's their selling point, and the moment it's shown they're giving their messages to the NSA or whatnot it's on to th

  • by 110010001000 ( 697113 ) on Saturday April 29, 2017 @02:03PM (#54325687) Homepage Journal
    You don't know what the WhatsApp "app" is doing. It is closed source. It could be sending all your messages directly to the NSA. Why would you trust your communications to closed source running on a megacorporations system?
    • What's your alternative? An open source messaging app that no one uses and therefore can't be used to send messages at all to anyone?

      Even if I could convince people to use it, who has audited the code? That's beyond my capability. How do I know the compiled result I downloaded from an app store is the same as the compiled result from the code, I can't MD5 the app store. How do I know the compiled binaries published by the programmer actually represent the original code that is currently under review?

      If you

  • by Traverman ( 4909095 ) on Saturday April 29, 2017 @02:29PM (#54325767)

    In the US anyway, freedom is worth dying for. The best way to fuck the terrorists is to show them that they can't change anything about our social norms. As far as I'm concerned, Whatsapp should be considered an in-the-clear messenger which is only "encrypted" because the government happens not care about the sender at this particular moment. What this sort of "pretend encryption" approach does is let the terrorists know that we're willing to give up our core values so they won't kill anymore of us. Heck, why stop there? We all might as well convert to their perverted brand of Islam. Of course, this is all misguided because eventually they'll find out how to do more damage, encryption or not. Which means we'll still have terror attacks a century from now, but what we won't have is private messaging.

    What do we need in order to reclaim the freedom that our ancestors (in America, at least) literally died for? Open source everything, from the circuit diagrams in our chips all the way to the app layer. Is this happening? I hope I'm just ignorant, but the answer would seem to be "no". There's no "real money" in open source anything, and things are getting exponentially more complicated with time. So maybe there's something to be said for building a truly dumb "combox" for private messaging and nothing else, which actually could make money for the people behind it, and therefore be economically viable. Does anyone know of anything like this? And no, I'm not talking about some "brilliant" encryption app running on top of swiss cheese dogshit like Android.

  • by AcidPenguin9873 ( 911493 ) on Saturday April 29, 2017 @02:34PM (#54325787)

    Before encrypted electronic communications, criminals and terrorists had to use things like in-person meetings or unsecure communications methods (like analog telephony) to communicate. These were obviously vulnerable to being listened to for a determined party, but that was simply how it was, there was no other option. Law enforcement could use various human-powered means to target specific individuals or organizations, like tapping a particular phone line and having a human listen to it when it went active, or maybe stake out a particular meeting place with some high-power microphones. For the general non-criminal population, while it was technically possible for the government to listen to everyone all the time, it was realistically impractical because of the vast amount of manpower it would require.

    Today we're in the opposite situation. Law enforcement can now get ahold of all electronic communications through various taps, but if criminals and terrorists use the proper technology and best practices, it is *impossible* for law enforcement to know what is being said. (Yes, deep-cover operatives are still possible but are impractical for all but the absolute highest-priority things for reasons of time, risk, and the same old manpower problem).

    I don't have a great answer. Anything is either too insecure or seems too vulnerable to corruption. The only thing I've come up with is third-party escrow of encryption keys, but who is the third party and how do we know they aren't corrupt?

  • I understood WhatsApp covered the communication of the data (message) in motion (transit). If they have recovered a message from the phone, that is data at rest and WhatsApp's encryption seem to have little to do with it. Even if WhatsApp does encrypt the message locally, the keys are on the device, rendering the encryption moot.
  • Whatsapp is proven insecure and it is also not identical to whisper but in fact a derivative... Do not use it for secure messaging, only signal remains confidently secure end to end https://www.schneier.com/blog/... [schneier.com]
  • I know a sure-fire legal way to ensure apps like this don't allow terrorists to communicate:

    When you install it, it will ask, "Are you a terrorist? [Y/N]"

    You're welcome.

  • There should be no place for terrorists to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other," U.K. home secretary Amber Rudd had said.

    This can also be read by replacing "terrorists" with "government" with respect to harming the people they are supposed to be representing. Because naturally neither EVER lies to us nor do they have secret communications that only they are privy.

  • by RDW ( 41497 ) on Saturday April 29, 2017 @06:39PM (#54326461)

    Clearly our Home Secretary Amber Rudd has now found some people who "understand the necessary hashtags": http://mashable.com/2017/03/27... [mashable.com]

  • If there's no place for terrorists to hide then there's no place for anyone to hide.

  • by Meski ( 774546 )
    So, security by obscurity, but in reverse.

I find you lack of faith in the forth dithturbing. - Darse ("Darth") Vader

Working...