7 ms·

There is not any evidence of encryption on WhatsApp, source code is closed so you can never be safe.

by btczeus 11y ago

muppetman 11y ago
People have sniffed the wire for the WhatApp client (on Android, towards another Android) and seen that it is encrypted. But your point stands - there's no UI to indicate if it was secure or not and the code isn't open so you can't know for sure.
- ikawe 11y ago
  I'm ignorant. How can you prove that it's encrypted in any meaningful fashion vs, say rot13?
  - lovemenot 11y ago
    We can disprove the existence of strong encryption with a wireshark, but cannot prove it. Entropy of a rot13 message would be much lower than that of a properly encrypted channel. High entropy is not proof of "meaningful encryption", mind you, since a compressed rot13 or plaintext message would have high entropy too.
- aw3c2 11y ago
  Encryption on the transport != end-to-end encryption if you consider the users as the ends. The encryption might very well just be from your device to WhatsApp.
  - glogla 11y ago
    Or it might be like with skype - where according to some report (I don't have link right now, sadly) the encryption is used mostly for obfuscating the protocol and to make building alternative clients harder, but it is give so small entropy pool that it's useless for security.
- ulam2 11y ago
  I tried TextSecure through bluestacks and captured the stream to find out that it is using TLSv1. I am a noob in computer security, but isn't TLSv1.2 more secure?
visualpipe 11y ago
Even if it's open source, we should say that unless the binary can be reproduced exactly by end user, you can never trust what you are using is actually what you think it is.
- reagency 11y ago
  Is thst possible, in general? If someone published an open source app to Play, could I compare the Play downloaded app to a local build, and set config appropriately, and get a match?
  - epmatsw 11y ago
    Sometimes? It's been done for TrueCrypt https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/ https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie...
  - lcampbell 11y ago
    > Is thst possible, in general? (Deterministic|reproducible) (compilation|builds) are a fairly recent endeavor; though they're not yet common they are technically feasible. The two efforts I'm aware of are Debian[1] and Chromium[2], though I'm not sure what state they're currently in. From their site, Chromium appears to include Android builds. There may be Android-specific concerts w.r.t the JVM's JIT, but if you can't trust the onboard runtime, you've already lost IMO. -- [1] https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds [2] https://www.chromium.org/developers/testing/isolated-testing/deterministic-builds https://www.chromium.org/developers/testing/isolated-testing...
    - leni536 11y ago
      F-droid[3] is supposedly working on reproducible builds for Android too. [3] https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds https://f-droid.org/wiki/page/Deterministic,_Reproducible_Bu...
  - pigeons 11y ago
    The tor browser bundle and bitcoin use bitcoin's gitian deterministic reproducible build system: https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-building.md https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-bu... https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/BuildingWithGitian https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser... https://blog.torproject.org/blog/deterministic-builds-part-two-technical-details https://blog.torproject.org/blog/deterministic-builds-part-t...
nly 11y ago
This code is closed? https://github.com/WhisperSystems/TextSecure https://github.com/WhisperSystems/TextSecure
- JupiterMoon 11y ago
  I think that OP refers to Whatsapp?

There is not any evidence of encryption on WhatsApp, source code is closed so you can never be safe.

by btczeus 11y ago

There is not any evidence of encryption on WhatsApp, source code is closed so you can never be safe.

People have sniffed the wire for the WhatApp client (on Android, towards another Android) and seen that it is encrypted. But your point stands - there's no UI to indicate if it was secure or not and the code isn't open so you can't know for sure.

ikawe 11y ago
I'm ignorant. How can you prove that it's encrypted in any meaningful fashion vs, say rot13?
- lovemenot 11y ago
  We can disprove the existence of strong encryption with a wireshark, but cannot prove it. Entropy of a rot13 message would be much lower than that of a properly encrypted channel. High entropy is not proof of "meaningful encryption", mind you, since a compressed rot13 or plaintext message would have high entropy too.
aw3c2 11y ago
Encryption on the transport != end-to-end encryption if you consider the users as the ends. The encryption might very well just be from your device to WhatsApp.
- glogla 11y ago
  Or it might be like with skype - where according to some report (I don't have link right now, sadly) the encryption is used mostly for obfuscating the protocol and to make building alternative clients harder, but it is give so small entropy pool that it's useless for security.
ulam2 11y ago
I tried TextSecure through bluestacks and captured the stream to find out that it is using TLSv1. I am a noob in computer security, but isn't TLSv1.2 more secure?

visualpipe 11y ago

Even if it's open source, we should say that unless the binary can be reproduced exactly by end user, you can never trust what you are using is actually what you think it is.

reagency 11y ago
Is thst possible, in general? If someone published an open source app to Play, could I compare the Play downloaded app to a local build, and set config appropriately, and get a match?
- epmatsw 11y ago
  Sometimes? It's been done for TrueCrypt https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/ https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie...
- lcampbell 11y ago
  > Is thst possible, in general? (Deterministic|reproducible) (compilation|builds) are a fairly recent endeavor; though they're not yet common they are technically feasible. The two efforts I'm aware of are Debian[1] and Chromium[2], though I'm not sure what state they're currently in. From their site, Chromium appears to include Android builds. There may be Android-specific concerts w.r.t the JVM's JIT, but if you can't trust the onboard runtime, you've already lost IMO. -- [1] https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds [2] https://www.chromium.org/developers/testing/isolated-testing/deterministic-builds https://www.chromium.org/developers/testing/isolated-testing...
  - leni536 11y ago
    F-droid[3] is supposedly working on reproducible builds for Android too. [3] https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds https://f-droid.org/wiki/page/Deterministic,_Reproducible_Bu...
- pigeons 11y ago
  The tor browser bundle and bitcoin use bitcoin's gitian deterministic reproducible build system: https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-building.md https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-bu... https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/BuildingWithGitian https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser... https://blog.torproject.org/blog/deterministic-builds-part-two-technical-details https://blog.torproject.org/blog/deterministic-builds-part-t...

nly 11y ago

This code is closed? https://github.com/WhisperSystems/TextSecure https://github.com/WhisperSystems/TextSecure

JupiterMoon 11y ago
I think that OP refers to Whatsapp?