WhatsApp backdoor allows snooping on encrypted messages

[jeuia3e9x74uxu6wk0r2u9kdos 30]

https://www.theguardian.com/technology/2017/jan/13/whatsapp-backdoor-allows-snooping-on-encrypted-messages

[LZ1 673]

Hello!

 

Thank you for sharing. Although I struggle to imagine how anyone could be surprised, given who's involved

[jeuia3e9x74uxu6wk0r2u9kdos 30]

Hello!

 

Thank you for sharing. Although I struggle to imagine how anyone could be surprised, given who's involved

Yeah you are right but it's different guessing about something and knowing it for sure

[zhang888 1066]

This is an overhyped bug. Just a usability enhancement to still push the first message even if the keys are changed.

Without it users who have no idea of the key exchange concept will have hard time communicating.

This is why Signal is usually more recommended for security minded people, the defaults are stricter, that's all.

Definitely not a backdoor, anyone who calls it a backdoor lacks the understanding of this meaning.

Some credible sources who actually know about infosec, unlike the Guardian journalists:

 

https://slashcrypto.org/2017/01/13/WhatsApp_backdoor/

https://twitter.com/matthew_d_green/status/819910068325990400

[Ricnvolved1956 51]

Maybe so, zhang. But I still wouldn't use it. Telegram..... ChatSecure..... Signal.

[LZ1 673]

Maybe so, zhang. But I still wouldn't use it. Telegram..... ChatSecure..... Signal.

Telegram isn't much to shout about though.

[zhang888 1066]

Telegram is much less secure than WhatApp, for that matter. Even worse defaults, and obscure proprietary crypto. 

[Ricnvolved1956 51]

Alrighty then... what about ChatSecure and Signal?

[LZ1 673]

Signal is fine.

[pr1v 36]

With a smarphone (android or ios) you willl never be secure.

[Kepler_452b 77]

https://www.theguardian.com/technology/2017/jan/13/whatsapp-backdoor-allows-snooping-on-encrypted-messages

Thanks for the heads up

[NinjaThunderbolt 4]

Hello!

 

Thank you for sharing. Although I struggle to imagine how anyone could be surprised, given who's involved

 

If you trust the company, the company is the backdoor.

[Ricnvolved1956 51]

With a smarphone (android or ios) you willl never be secure.

Why so?

 

What about Conversations (Jabber/XMPP)? Is it a good private/secure IM app for Android?

[pr1v 36]

Using them will expose you to a host of monitoring protocols and you will not be protected from the device itself, and they are not 100% opensource. If you only want to change your IP address then it's fine, but if you are looking for privacy then avoid them. Find out by yourself.

[routeninja 23]

I recommend Wire, open source fully encrypted, and has fantastic features.

 

https://wire.com/

 

route

[anonusr 1]

I recommend Wire, open source fully encrypted, and has fantastic features.

 

https://wire.com/

 

route

https://crysp.uwaterloo.ca/opinion/wire/

 

The problems listed above weaken the security of Wire relative to competitors like Signal, but the problems are not insurmountable. The chat features offered by Wire have a very modern aesthetic that is very popular with users, and this makes Wire a very interesting offering. Users should be aware of these concerns before choosing to use Wire. While these problems are unaddressed, users should avoid using Wire audio/video calls for secure conversations, assume that Wire passwords could be silently compromised, treat the Wire application like a constantly updating web service rather than a semi-stable desktop application, and consider sandboxing Wire on sensitive systems.

[Ricnvolved1956 51]

I'm researching serveral messaging apps for my Android tablet (version 6.0.1). Thoughts/opinions on these? Conversations (Jabber/XMPP); Threema; Wickr; Pryvate.

Are there others I've overlooked? Surprisingly, Signal is NOT compatible with my tablet. Go figure....

Thanks very, very much for your input.

[OmniNegro 155]

Often times the application is not the problem. The servers themselves can be compromised even if the application is totally secure. With that in mind, I suggest only using XMPP via AirVPN.

 

AirVPN actually does care about your privacy and security. If you can login to these forums, then you already have an account setup to use the XMPP server(s) AirVPN is providing free of charge to the world.

 

On the PC, I strongly suggest Pidgin. https://airvpn.org/topic/12159-pidgin/

https://www.pidgin.im/

 

But since most of this thread seems oriented towards Android, I suggest Xabber. https://airvpn.org/topic/12158-xabber/

http://www.xabber.org/

 

I am sure others have different ideas, and some are good, but why reinvent the wheel when you have a good wheel that rolls just fine already?

[serenacat 83]

So what to make of this ?

"British interior minister Amber Rudd said on Sunday end-to-end encryption of messages offered by services like Whatsapp are "completely unacceptable"'

http://www.reuters.com/article/us-britain-security-rudd-idUSKBN16X0BE

 

It is hard to believe that an interior minister with responsibilities for anti-terror measures would be so poorly briefed and ignorant and incompetent. So what are the broader hidden agendas and disinformation ?

 

As well as any criminal or terrorist cell or network being able to quickly move between multiple secure messaging products in various jurisdictions, as a software developer / programmer / coder (we are hordes, in India, Africa, anywhere, ...) it is only a days work to build an application for android/windows/linux/apple/java/python that uses crypto libraries to link members of the Secret Society of Cat Worshippers for the terrorist War on Dogs using tcp sockets without any third party "service" that could be monitored.

And back in the last hundreds of years there are various methods of disguised messaging for anyone with serious stuff.