in WhatsApp

of 21 /21
https://tobi.rocks/ WhatsApp Backdoor (/Bug?) Another reason for not trusting closed-source crypto

Embed Size (px)

Transcript of in WhatsApp

  • https://tobi.rocks/

    WhatsApp Backdoor (/Bug?)Anotherreasonfornottrustingclosed-sourcecrypto

  • https://tobi.rocks/

    WhatsApp

    1billionmonthlyactiveusers(February2016) 1/7ofworldpopulation

    end-to-endencryptioncompletelyimplementedApril2016 ImplementstheSignalprotocol

    SignalPrivateMessenger

  • https://tobi.rocks/

    The Backdoor

    Alice Bob

  • https://tobi.rocks/

    The Backdoor

    Alice Bob

    1

  • https://tobi.rocks/

    The Backdoor

    Alice Bob

    12

  • https://tobi.rocks/

    The Backdoor

    Alice Bob

    AliceandBobmeetinpersonandverifythefingerprint

    12

    3

  • https://tobi.rocks/

    The Backdoor

    Alice Bob

  • https://tobi.rocks/

    The Backdoor

    Alice Bob

    4 HiBob

  • https://tobi.rocks/

    The Backdoor

    Alice Bob

    4 HiBob

    5

  • https://tobi.rocks/

    The Backdoor

    Alice Bob

    4 HiBob

    5

    6 HiBob

  • https://tobi.rocks/

    The Backdoor

    Alice Bob

    4 HiBob

    5

    6 HiBob

    7

    Bobssecuritycodehaschanged

  • https://tobi.rocks/

    The Backdoor

    Alice Bob

    4 HiBob

    5

    6 HiBob

    7

    Bobssecuritycodehaschanged 8 HiBob

  • https://tobi.rocks/

    AlicesPhone Attacker AlicesPhone

  • https://tobi.rocks/

    Signal is doing it right

    Thewarningisdisplayed Themessageisneverretransmitted

  • https://tobi.rocks/

    Disclosure Timeline

  • https://tobi.rocks/

    Disclosure Timeline

    WhitehatreportonApril10

  • https://tobi.rocks/

    Disclosure Timeline

    WhitehatreportonApril10 Facebook,May25:Thisisexpectedbehavior

  • https://tobi.rocks/

    Disclosure Timeline

    WhitehatreportonApril10 Facebook,May25:Thisisexpectedbehavior Me:Thisshouldnotbeexpectedbehavior.

  • https://tobi.rocks/

    Disclosure Timeline

    WhitehatreportonApril10 Facebook,May25:Thisisexpectedbehavior Me:Thisshouldnotbeexpectedbehavior. Facebook,May31:Wewerepreviouslyawareoftheissue[]fornowit'snotsomethingwe'reactivelyworkingonchanging

  • https://tobi.rocks/

    Disclosure Timeline

    WhitehatreportonApril10 Facebook,May25:Thisisexpectedbehavior Me:Thisshouldnotbeexpectedbehavior. Facebook,May31:Wewerepreviouslyawareoftheissue[]fornowit'snotsomethingwe'reactivelyworkingonchanging Status(December28):Notfixed

  • https://tobi.rocks/

    More reasons to use Signal

    Signalisopensource Signalhasmostlyreproduciblebuilds WhatsAppmaystoreMetadata(accordingtoprivacypolicy)

    timestampinformation successofmessagedelivery phonenumbersofsenderandrecipient contactlists otherinformation

    Signalstoresless: lastdayauserconnected contactlistsarenotstoredonsignalservers