WhatsApp Backdoor (/Bug?) file The Backdoor Alice Bob Alice and Bob meet in person and verify the...
21
https://tobi.rocks/ WhatsApp Backdoor (/Bug?) Another reason for not trusting closed-source crypto
Transcript of WhatsApp Backdoor (/Bug?) file The Backdoor Alice Bob Alice and Bob meet in person and verify the...
https://tobi.rocks/
WhatsApp Backdoor (/Bug?)Anotherreasonfornottrustingclosed-sourcecrypto
https://tobi.rocks/
• 1billionmonthlyactiveusers(February2016)• 1/7ofworldpopulation
• end-to-endencryption“completely”implementedApril2016• ImplementstheSignalprotocol
SignalPrivateMessenger
https://tobi.rocks/
The Backdoor
Alice Bob
https://tobi.rocks/
The Backdoor
Alice Bob
1
https://tobi.rocks/
The Backdoor
Alice Bob
12
https://tobi.rocks/
The Backdoor
Alice Bob
AliceandBobmeetinpersonandverifythefingerprint
12
3
https://tobi.rocks/
The Backdoor
Alice Bob
https://tobi.rocks/
The Backdoor
Alice Bob
4 “HiBob”
https://tobi.rocks/
The Backdoor
Alice Bob
4 “HiBob”
5
https://tobi.rocks/
The Backdoor
Alice Bob
4 “HiBob”
5
6 “HiBob”
https://tobi.rocks/
The Backdoor
Alice Bob
4 “HiBob”
5
6 “HiBob”
7
Bob’ssecuritycodehaschanged
https://tobi.rocks/
The Backdoor
Alice Bob
4 “HiBob”
5
6 “HiBob”
7
Bob’ssecuritycodehaschanged 8 “HiBob”
https://tobi.rocks/
Alice’sPhone Attacker Alice’sPhone
https://tobi.rocks/
Signal is doing it right
• Thewarningisdisplayed• Themessageisneverretransmitted
https://tobi.rocks/
Disclosure Timeline
https://tobi.rocks/
Disclosure Timeline
• WhitehatreportonApril10
https://tobi.rocks/
Disclosure Timeline
• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”
https://tobi.rocks/
Disclosure Timeline
• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”• Me:“Thisshouldnotbeexpectedbehavior.“
https://tobi.rocks/
Disclosure Timeline
• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”• Me:“Thisshouldnotbeexpectedbehavior.“• Facebook,May31:“Wewerepreviouslyawareoftheissue[…]fornowit'snotsomethingwe'reactivelyworkingonchanging”
https://tobi.rocks/
Disclosure Timeline
• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”• Me:“Thisshouldnotbeexpectedbehavior.“• Facebook,May31:“Wewerepreviouslyawareoftheissue[…]fornowit'snotsomethingwe'reactivelyworkingonchanging”• Status(December28):Notfixed
https://tobi.rocks/
More reasons to use Signal
• Signalisopensource• Signalhasmostlyreproduciblebuilds• WhatsAppmaystoreMetadata(accordingtoprivacypolicy)
• timestampinformation• successofmessagedelivery• phonenumbersofsenderandrecipient• contactlists• “otherinformation”
• Signalstoresless:• lastdayauserconnected• contactlistsarenotstoredonsignalservers
