WhatsApp straps on full end-to-end crypto for 1bn peeps

Facebook-owned WhatsApp is switching on full end-to-end encryption for texts and voice calls used by a billion people. Updates to the chat apps are said to be rolling out from today. The software uses Open Whisper Systems' Signal Protocol. Technical details of the encryption can be found through here. "Over the past year, we' …

[Anonymous Coward]

Your move, FBI

Good to see Apple won't have to be fighting the FBI alone if they start pushing against the use of "too much encryption" that hurts their ability to snoop.

[NoneSuch]

Re: Your move, FBI

Which encryption?

Which algorithm?

What key length?

Who holds the keys?

Not a lot of detail here to hang my hat on.

[Mark 110]

Re: Your move, FBI

The Reg is getting increasingly light on detail. Annoying.

[Mark 85]

Re: Your move, FBI

That seems to be the idea... these things are just clickbait. Sort of like a cookie or biscuit: little substance.

[Anonymous Coward]

Re: Your move, FBI

Perhaps WhatsApp is not that forthcoming with details, not wanting to be picked apart in case people find there's a weakness. "WhatsApp adds encryption" makes a good story for the public and the sort of publicity WhatsApp wants. "WhatsApp adds flawed encryption", in case they published the equivalent of the iOS security guide and someone figured out it was vulnerable to a MITM attack for example, would not provide the kind of publicity they're looking for!

[Charlie Clark]

Re: Your move, FBI

Which encryption?

It's linked to in the article: open source and peer-reviewed.

[Anonymous Coward]

Re: Your move, FBI

So openssl then? Good thing that has no security holes!

[energystar]

Is it ethical, on the long term?

Allowing snake oil commerce?

[energystar]

End to End

Would deprive Monetizing from AI distilling. Maybe kids, who are the gross of their market, could believe this, in the short term. End to End should be a lay.

[energystar]

Maybe FaceBook is Teaming.

Who collects is then just minutia.

[energystar]

Maybe is an invitation...

To dance. Timing is perfect. Mood also. December is far...

[Anonymous Coward]

Didn't see that coming. Problem is that Facebook paid 19bn for it and they are a company who survive by reaping user data. So they *must* have a way of monetising it somehow. I'm not going to even start believing that it's properly encrypted until I know what the catch is...

[Qassam ElShawarma]

the catch

is metadata.

nobody ever gave a crap about the content of the call or communication, but the patterns of communication? that's an advertising goldmine.

[Mark 110]

They are monetising by starting to charge. I think I paid a couple of quid for 2 years continued access recently. Do the numbers. Not a hard cost. If you get a billion users to pay it you make a huge profit.

[Anonymous Coward]

WhatsApp recently said the app would be now free forever.

[Anonymous Coward]

Facebook

in altruistic move to protect users data communication..

Fuck right off!!!!

[Alistair]

Re: Facebook

@ cornz 1

Fuck right off, bitch!!!!

FTFY.

[energystar]

ElReg should be right,

Just a strap-on.

[Anonymous Coward]

Wait a minute and I'm sure someone can explain this to me but,

If it's end to end encryption then both ends must know how to decrypt each other.

How does each initiate the very first encrypted connection? i.e. key exchange.

Would this not mean that an unscrupulous government with access to the internet be able to sit in the middle and go, thanks for that I can now decrypt your data? Could it not also enable facebook to record these keys? Even though it said it wouldn't (yes I have a lack of trust for facebook for some strange reason) or even better as it knows how the initial exchanges are set up it could technically duplicate them.

[Anonymous Coward]

How does each initiate the very first encrypted connection? i.e. key exchange.

Would this not mean that an unscrupulous government with access to the internet be able to sit in the middle and go, thanks for that I can now decrypt your data?

Yes, that is one red flag - to assure there is no MITM you would have to communicate a key checksum out of band (voice, SMS), and even that can be interfered with if the other party is unknown to you.

There is also a second one: your network, i.e. the people you associate with. As long as the mechanism by which WhatsApp matches people in your address book is not disclosed I would suggest it's not ephemeral, and it will thus support the main goal of most modern surveillance: identifying who communicates with whom (which conveniently has the advantage that you don't need to decrypt much - this is a key reason why you don't see any use of PGP in government circles).

In any case, I don't actually care what they add. It's part of Zuckerberg's circus so I won't touch it on account of a shortage of long enough barge poles.

[Tessier-Ashpool]

Both ends know how to communicate securely with each other, but only after the pair of them have each gone through a crafty process of self-generating a private key and mangling it with the public key of the other. It's complicated. Google public key exchange.

[Richard Boyce]

Look up Diffie–Hellman Key Exchange. I don't know if Signal is using this protocol or something else that achieves the same thing. The point is, secure ephemeral key exchange between strangers is a solved problem.

[Charlie Clark]

Signal authenticates devices initially through two-factor authentication tied to the the phone number. This makes subsequent key exchange reliable because both parties have been authenticated.

[Daniel B.]

Key exchange can be verified by QR code or a numeric fingerprint, both are verifiable out of band.

My concern however is that unlike other solutions, you are only validating the key itself, instead of each end's public key (as used by Chat Secure).

[energystar]

Stop selling dreams!

And start the long work to a more satisfactory MultiStake Enviroment.

[Mark 110]

Re: Stop selling dreams!

Does that involve killing many vampires at once?

[energystar]

Involves snapping...

On the face of individuals. As a good start.

[Anonymous Coward]

Re: Stop selling dreams!

Does that involve killing many vampires at once?

Well, it's no silver bullet..

:)

[101]

Trust Facebook?...

Not.

"They trust me — dumb fucks" ~Zuckerberg.

I want to see an article by credible security researchers who have VERIFIED the end to end encryption aspect.

Another Z option would be to suck in a billion people, then one day simply cancel all encryption and furiously start vacuuming up the data. I think that would be a logical extension of the FB modus operandi.

[The_Idiot]

Re: Trust Facebook?...

Or possibly:

"Another Z option would be to suck in a billion people, then one day simply cancel all encryption and furiously start vacuuming up the data. I think that would be a logical extension of the FB(I) modus operandi."

[Daniel B.]

Occam's razor

It would be easier that FB was simply getting a copy of the shared secret key.

[Ed Mozley]

According to Anonymous...

Only Signal is the only secure messaging app. Also recommended by Snowden if my memory serves me correctly.

[Anonymous Coward]

Re: According to Anonymous...

Whatsapp encryption is Signal ...

[Someone_Somewhere]

According to /who?/

If I were TPTB, I'd invent Snowden, Zimmerman, Schneier et al, plant them deep into counterculture long in advance ... and laugh myself to sleep every night thereafter.

[Agony]

Well...

The protocol being used is (allegedly) open source, reviewable here...

https://github.com/whispersystems/libsignal-protocol-java/

But being that it's a Facebook implementation I still have a fair few reservations about exactly how it was implemented in this instance. Good to see they're trying though.

[njkmoore]

Contacts

As far as I know, WhatsApp still slurps your contact data, which is a major privacy breach. Using Signal encryption, if that is verified to be the case, is undoubtedly good news but it's not the only issue.