WhatsApp backdoor allows snooping on encrypted messages | Technology | The Guardian
▻https://www.theguardian.com/technology/2017/jan/13/whatsapp-backdoor-allows-snooping-on-encrypted-messages
WhatsApp vulnerability explained : by the man who discovered it | Tobias Boelter | Technology
/whatsapp-vulnerability-facebook
-
-
Même pas étonnant.
De toute façon, les gens préfèrent que l’état puisse lire leurs données plutôt que Mark Zuckerberg. C’est con, WhatsApp permet plutot l’inverse. -
“WhatsApp has the ability to force the generation of new encryption keys for offline users, unbeknown to the sender and recipient of the messages, and to make the sender re-encrypt messages with new keys and send them again for any messages that have not been marked as delivered.
The recipient is not made aware of this change in encryption, while the sender is only notified if they have opted-in to encryption warnings in settings, and only after the messages have been re-sent. This re-encryption and rebroadcasting effectively allows WhatsApp to intercept and read users’ messages.”
-
Mais surtout:
“[the researcher] reported the vulnerability to Facebook in April 2016, but was told that Facebook was aware of the issue, that it was “expected behaviour” and wasn’t being actively worked on.”
-
La dénégation de Moxie Marlinspike au nom de son entreprise Open Whisper Systems qui a travaillée sur le logiciel WhatsApp.
Je ne sais pas trop quoi en penser...
There is no WhatsApp ’backdoor’
moxie0 on 13 Jan 2017
▻https://whispersystems.org/blog/there-is-no-whatsapp-backdoorThe WhatsApp clients have been carefully designed so that they will not re-encrypt messages that have already been delivered. Once the sending client displays a “double check mark,” it can no longer be asked to re-send that message. This prevents anyone who compromises the server from being able to selectively target previously delivered messages for re-encryption.
The fact that WhatsApp handles key changes is not a “backdoor,” it is how cryptography works. Any attempt to intercept messages in transmit by the server is detectable by the sender, just like with Signal, PGP, or any other end-to-end encrypted communication system.
The only question it might be reasonable to ask is whether these safety number change notifications should be “blocking” or “non-blocking.” In other words, when a contact’s key changes, should WhatsApp require the user to manually verify the new key before continuing, or should WhatsApp display an advisory notification and continue without blocking the user.
Given the size and scope of WhatsApp’s user base, we feel that their choice to display a non-blocking notification is appropriate. It provides transparent and cryptographically guaranteed confidence in the privacy of a user’s communication, along with a simple user experience. The choice to make these notifications “blocking” would in some ways make things worse. That would leak information to the server about who has enabled safety number change notifications and who hasn’t, effectively telling the server who it could MITM transparently and who it couldn’t; something that WhatsApp considered very carefully.
-
-
Et une réponses aux réponses :
WhatsApp vulnerability explained : by the man who discovered it - Tobias Boelter ▻https://www.theguardian.com/technology/2017/jan/16/whatsapp-vulnerability-facebook?CMP=share_btn_tw
Il pointe notamment une évidence qui semble « échapper » à l’Electronic Frontier Foundation : WhatsApp n’étant pas un logiciel libre et le réseau WhatsApp n’étant pas accessible à des logiciels clients tiers : il n’est pas possible de vérifier le comportement réel de WhatsApp. Bref il n’est pas possible d’affirmer que WhatsApp est sécurisé.
-
-
