The Next Front in the New Crypto Wars: WhatsApp

https://www.eff.org/deeplinks/2016/03/next-front-new-crypto-wars-whatsapp

by panarky • 10 years ago

318 207 10 years ago

throwaway02092• 10 years ago

Here the local drug dealers encourage use of a app called Wickr. Does anyone know how the encryption compares to WhatsApp?

CiPHPerCoder4• 10 years ago

https://github.com/nylira/prism-break/issues/249#issuecommen...

https://www.reddit.com/r/australia/comments/32hexp/a_secret_...

Don't use Wickr.

Proprietary crypto + an interesting target for NSA because of its popularity among ISIS = probably snake oil and at the very least makes you a target

"Career criminals recommend it" isn't a good indicator of security. Two things to consider:

1. Confidential informants exist

2. Being a high-risk individual doesn't make you a domain expert

Ask your drug dealers to explain why RSA encryption with PKCS1v1.5 padding is bad. If they can't, disregard their opinion on cryptography and privacy technology.

kough2• 10 years ago

Yeah, I knew a dispensary owner who told me all about Telegram* and how it was "really secure" and how the feds couldn't get any of his messages. He was happy to switch to Signal once I told him a little more.

throwaway02092• 10 years ago

Thanks a lot for the detailed answer.

I will be sure the take the discussion on RSA encryption with PKCS1v1.5 padding the next time I see those guys. Probably without mentioning ISIS..

themartorana2• 10 years ago

The hi-tech application, known as Wickr, is the latest in the long list of tools the death cult is using to lure Australian jihadis to join their bloody campaign.

Sure doesn't help when this is how the media describes a text messaging app.

fweespee_ch2• 10 years ago

http://www.nytimes.com/2016/03/13/us/politics/whatsapp-encry...

The Justice Department and WhatsApp declined to comment. The government officials and others who discussed the dispute did so on condition of anonymity because the wiretap order and all the information associated with it were under seal. The nature of the case was not clear, except that officials said it was not a terrorism investigation. The location of the investigation was also unclear.

Just in case anyone was wondering if this was terrorism related, it is not. I suppose next is OpenWhisperSystems / Signal, etc.

I'm glad I've stuck with GnuPG for anything truly sensitive.

ycmbntrthrwaway4• 10 years ago

GnuPG is great, but it is not for real-time messaging. Real-time messaging protocol should have forward secrecy, which OpenPGP can't have because it is not an interactive protocol.

fweespee_ch2• 10 years ago

I'm aware but I don't need real time messaging for secure communication. It is really limited to things like security flaws, financial information, and things of that nature.

jessegreathouse• 10 years ago

If the government wins any of these court battles, it's only a matter of time until one-way encryption is outlawed. It follows logically that if criminals/terrorists can't use iPhones to securely communicate, then they'll just move on to the next convenient encryption app. The government will continue to order companies to break their one-way encryption until the government realizes they're playing musical chairs and then they'll issue an executive order to ban one-way encryption outright. The precedent allowing them to do so, will be all of these initial court battles vs Apple, whatsapp, and whoever else gets defeated. In the wake of these events regular people, like you and me, will be harmed by hackers and commercial companies exploiting this new world without one-way encryption.

schoen2• 10 years ago

I don't recognize your use of "one-way encryption". Did you mean something like end-to-end encryption?

thavalai• 10 years ago

Looks like it means that the encryption cannot be reverse-engineered: http://help.penzu.com/pro/what-is-one-way-encryption/

AckSyn• 10 years ago

One time pad perhaps

yazaddaruvala• 10 years ago

Anyone have any insights into why the commonly used guns argument is not good enough for encryption? If we ban guns(encryption), only the criminals will have it.

The only thing I can think of is that the majority of people who advocate for encryption are anti-gun, and don't want to give strength to that argument?

newjersey• 10 years ago

Well, my perception of the gun lobby is that a big part of the effort is centralized. At least that's my impression after reading the nytimes article.

I don't have any insight into the gun lobby so I can't tell whether it is any accurate.

http://nytimes.com/2014/01/05/business/media/banished-for-qu...

I fear the gun argument is further weakened by the fact that civilians can't have big anti-aircraft guns in their backyard pointed towards the sky. I bet I can't operate a decent early warning radar in my backyard without running afoul of some zoning ordinance or another.

dfc• 10 years ago

This argument is "not good enough" for encryption because it is also not good enough for guns. Cliches are not persuasive arguments in a court of law.

If you think gun related jurisprudence is the way to rescue encryption try ITAR. Munitions = Arms = 2nd Ammendment

danieltillett21• 10 years ago

I have never understood why the USA anti-gun lobby doesn't go after ammunition rather than guns. Just ban ammunition and a gun just becomes a not so dangerous club.

jrnichols• 10 years ago

Insights? None, because I don't think what you said is accurate at all. That's exactly what we're thinking - only outlaws will have it.

I don't know a single gun owner that wouldn't also be an advocate for encryption.

beachstartup• 10 years ago

the argument isn't only criminals -- it's criminals, and the government.

basically, the private law-abiding citizen is the only one left out of the power loop. everyone else is armed to the teeth.

for those of you who are pro-crypto but anti-gun, the government considers crypto a weapon, plain and simple. they don't share your divided sensibilities. it's real easy -- they want to take both away from the populace, a little bit at a time. and of course the oldest trick in the book is divide and conquer. they know you don't want to apply the same arguments to both fights because of your feelings on firearms, and they are taking advantage of it.

that uneasy feeling you get when you consider a world without private access to crypto is the same uneasy feeling gun owners get when you talk about taking away their access to firearms.

Estragon• 10 years ago

The whole world is flooded with fiction about using guns to stop bad people with guns. The narrative around crypto is tiny by comparison.

LastZactionHero• 10 years ago

The recent issues over encryption has actually changed my thinking on guns. I'm not 'pro gun', don't own guns, and want nothing to do with them personally.

But as I think about my stance on the legality of encryption it sounds pretty similar to the argument for guns. Still don't want one, but it's harder for me to be dismissive of a point when I turn around and use the same point for another issue.

statictype3• 10 years ago

This is a very good point.

As someone who has been anti-gun and pro-encryption, I'm now wondering how I reconcile these two stances that are at conflict with each other.

siscia4• 10 years ago

Gun and encryption are two completely different beast.

With guns you can execute a crime, with encryption you cannot.

It is true that you can plan a crime with the use of encryption, but we don't punish on intentions but only on facts.

It is not illegal to plan how to kill someone, while it is illegal to actually kill somebody or to try to do it.

lostlogin• 10 years ago

No great insight here, and however insane I find many US state gun laws, the encryption debate is more worrying by far. As a non-US citizen there isn't many ways US gun laws can affect me. However the encryption debate has far broader consequences and will change things for the rest of the world - but we don't get a say.

dllthomas• 10 years ago

Anyone have any insights into why the commonly used guns argument is not good enough for encryption? If we ban guns(encryption), only the criminals will have it.

Guns are defense against guns in a way that encryption is not defense against encryption, so the notion that we are depriving non-criminals of an important defense against encryption-toting criminals carries less weight.

chongli2• 10 years ago

FBI Director James Comey already went before Congress and was rejected. I'd say the possibility of him succeeding in the future is even lower, given the way this case has played out. He effectively tried to make an end-run around the legislature by going through the courts with an extremely old law. The powers in Congress did not appreciate this at all and had a lot of very pointed questions for him at his last hearing before the House Judiciary Committee[0].

[0] http://qz.com/628745/i-have-no-idea-the-fbi-director-at-the-...

ickwabe• 10 years ago

What are we to make of these sorts of comments from Obama and Feinstein? It seems like there is strong backing by certain political interests to make it impossible for the average phone user to encrypt their own devices in such a way that the providers cannot access certain data. This dove-tails nicely with what some consider a war on general computing...

http://www.reuters.com/article/us-apple-encryption-obama-idU...

http://thehill.com/policy/cybersecurity/262658-feinstein-vow...

beedogs2• 10 years ago

FBI Director James Comey already went before Congress and was rejected. I'd say the possibility of him succeeding in the future is even lower, given the way this case has played out.

All it will take is a large-scale "terrorist attack". That event will be exploited to the hilt the same way 9/11 was.

shmerl3• 10 years ago

It won't be outlawed as long as public will be against it. It will be a political suicide for opponents of encryption. But only if public will be against it. Time will tell.

awqrre• 10 years ago

Obama might outlaw it on his way out...

songshu• 10 years ago

Would there be a first amendment (freedom of speech) argument against such an outlawing? If you are not allowed to say things which the government doesn't understand, then your speech isn't free.

cderwin• 10 years ago

The actual text of the Constitution is "Congress shall make no law ... abridging the freedom of speech", so I guess a first amendment argument comes down to the interpretation of "abridge" -- I would certainly think outlawing speech of a certain nature, i.e. encrypted speech, or authenticated speech, would be abridging that freedom. But I really don't really know how far removed the courts have taken the law from the original text.

brudgers2• 10 years ago

No sophisticated actor will use an app. Sophisticated actors being those who are unwilling to let Eve choose the encryption algorithm.

bmelton6• 10 years ago

"they'll issue an executive order to ban one-way encryption outright"

I want to point out the reasons for which that's impossible -- that the executive can't issue an EO that applies to the citizenry at large, and that there aren't any agencies that specifically regulate software companies, but as I can't find a loophole that hasn't been leveraged to render my arguments moot, I can't even convince myself that it couldn't be done.

That said, on paper, executive orders are only applicable within the executive branch. E.g., the president can issue an order that commands his agency chiefs to interpret a law a certain way, or compel them to issue internal commands to change an action that they are otherwise charged with doing, but laws to which the citizenry must comply need be done via Congress.

coldcode• 10 years ago

Plus the impossibility of controlling apps, software and frameworks outside the US. All it takes is one person in one country building correct encryption and everyone uses that for illegal activities everywhere. It's not a matter of blocking holes in a dike; there is no dike.

anantzoid• 10 years ago

If the government succeeds in this case, it'll be George Orwell's 1984 everywhere. A constant monitoring will be done on everyone irrespective of who they are. The terrorists will move on to another stream of communication (I think ISIS already has their own app), and only the innocent citizens will be left to be monitored by the FBI.

XorNot2• 10 years ago

This is the slippery slope fallacy: the current Apple court battle is so limited in scope that it cannot possibly create precedent for such broadranging actions, and those it might speak to would be subject to court oversight (i.e. you would require a separate writ for another phone, which would be equally subject to court challenge - it would not be a rubber stamp process, it would not be able to demand substantially different actions yet cite precedent).

Unless there is a current lawsuit where an affirmative ruling would imply a general order to introduce backdoored encryption in an entire line of products, then it is not "a matter of time" - and thus is also the classic slippery slope fallacy - decision A does not decide decisions B, C and D without further consideration.

rmc5• 10 years ago

If cases like this go in the US Gov's favour, it'll further damage the US tech industry. It's already illegal for EU orgs to use US tech companies for personal data!

lordnacho• 10 years ago

What does "undue burden" mean? Wouldn't it be very simple for WhatsApp to remove the encryption in the app? (Anyone can write an unencrypted app.) Could they be forced to do that?

IMO that would be awful.

ycmbntrthrwaway4• 10 years ago

It is not that simple if you want to stay compatible with clients that are not updated yet and are not capable of receiving unencrypted messages. You also have a risk of breaking something, so you need to test compatibility of all versions etc. The company promised security for all other users, so it probably wants to remove security only for one specific user, otherwise it faces popularity loss. The cost of properly removing encryption from an established network protocol used almost constantly over time is really high.

nickik9• 10 years ago

The 'undue burden' is bot just the time to do it. Apple clearly argues this in their testemony before the justice commity and Im sure WhatsApp feels the same. The burde is the breaking of user expectation and trust in the security and trust of the companies products.

ycmbntrthrwaway4• 10 years ago

Please stop calling it crypto wars. Calling something a "war" justifies wartime measures, just as it happens with terrorism, drugs and things like that.

zeckalpha• 10 years ago

This isn't a new term: https://en.wikipedia.org/wiki/Crypto_Wars

axihack2• 10 years ago

Can anyone point me to where WhatsApp app is actually confirming they are implementing E2E encryption and how?

I couldn't find anything on the oficial web/blog, the single mention on security is this FAQ[1] which is about server/device encryption.

A friend also told me E2E is only available for US users but unfortunatelly I can't confirm this because of the lack of communication from WhatsApp.

[1] https://www.whatsapp.com/faq/en/general/21864047

Edit: fixed typos

ibejoeb5• 10 years ago

I've never seen any official confirmation, but Wired reported that it had been enabled between Android devices: http://www.wired.com/2014/11/whatsapp-encrypted-messaging/. The implementations is reportedly based on TextSecure/Signal. Moxie says WhatsApp "is implementing" which is certainly distinct from "has implemented."

axihack2• 10 years ago

Agree, "is implementing" could last forever or have a very limited scope by design. I think I am going to assume there is no E2E encryption until a proper confirmation from WhatsApp.

themartorana2• 10 years ago

If the FBI wasn't locked in a stand-off with WhatsApp because of the encryption, I would have reason to doubt it exists. However...

In any case, my family uses WhatsApp pretty heavily, and I love reading about their engineering, so I'm happy to hear that this encryption exists and is flustering a far-overreaching government. Now let's hope Apple et al prevail, because I like my non-backdoored encrypted messaging.

trulyWasteful• 10 years ago

No one can stop me and my peers from sending meaningless garbage data to each other.

So, if it simply looks encrypted, but acctually contains randomized meaningless shit, how can anyone prevent me from bahaving in this manner, and claim that I've done harm?

I've paid for the service, and I can spam it with trash as I see fit.

beeboop• 10 years ago

This is unfortunately not true in many places. In the UK you can be thrown in prison for failing to decrypt any data in your possession. This means someone can encrypt garbage on a USB drive and slip it in your pocket and make you rot in prison for years.

In the US, you will be held in contempt for failing to decrypt data when ordered if they can show that you "probably" have access to it and it's relevant to the charges against you. This also means prison for many years for failure to decrypt, even if you can't.

hifier• 10 years ago

Not until they change the 5th amendment.

john_reel• 10 years ago

Randomized data does not have padding.

1024core2• 10 years ago

If the USG can force Apple/Whatsapp to decrypt some communication, what prevents the PRC from doing the same? Will we see Tim Cook arrested the next time he goes to China?

XorNot2• 10 years ago

What stops them now?

I don't understand why people think this is an issue. While you could certainly imagine the PRC being emboldened, it's not like their history of human rights abuses has kept them in check. The only thing which does is how much they love trade with the west, but it would be entertaining the amount of blowback making a move against Foxconn would create (also worth considering: China, land of fake electronics components and seizing memory cards at the border, is where all your iPhones are being made...)

1024core2• 10 years ago

Don't you think that if they see Apple handing over iPhone contents to USG, they will now feel entitled to do the same in China?

alias240• 10 years ago

A part of me wonders if I should believe this, and the story about the Apple case. Or maybe it is all just a conspiracy to gain our trust.

brudgers2• 10 years ago

The important aspect of this and the Apple scenario is that the encryption requires a benevolent third party. Encryption that relies on Eve...well, she has three faces.

eyeareque• 10 years ago

The only reason the government "gave up" in the previous crypto war was because they decided to find ways to break or weaken crypto to their needs. I don't think this time will be any different, one way or another they will get access to our data.

nickik9• 10 years ago

They have done a shitty job at it. Snowden revealed much but non of the real horror stories have turned out to be true.

Modern standards like SHA3 are designed far better and in a way that make it way harder for anybody to build in a backdoor.

This is one of the few areas we dont have to worry to much about.

What we need to worry about is addoption of good defaults by the large majority.

rsync• 10 years ago

All computer code can be rephrased in common written (english, perhaps) language. I'm not talking about pseudocode, I mean an actual translation layer from, say, C to english phrasing that specifically describes the computer code to be written.

And at that point it's just speech. I don't mean "like speech", or "something sophisticated people should recognize as speech", or "code is speech" ... I mean, it's just plain old speech. Just very boring, long-winded (and extremely precise) descriptions of computer source code.

So perhaps there will be some pain and perhaps there will be some years before it finally gets to the supreme court, but in the end, it's just speech.

Will they change the 1A ? Would they ?

sesutton• 10 years ago

The source code for PGP 5 was made legally available outside the US in a similar method though without translating it.

https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i...

rmc5• 10 years ago

Not every country has the USA's "Free speech über alles" interpretation of "right to free speech"

sandra_saltlake• 10 years ago

Please stop calling it crypto wars..

JackuB• 10 years ago

But headlines love it!

venamresm__• 10 years ago

There are alternatives to one way encryptions. Think of steganography and communication between the parties being indirect.

krylon• 10 years ago

I find it disturbing how the intelligence and law enforcement community seem to think there is some kind of natural right for them to snoop on people.

In case of the good old phone system, the very way that worked maked wiretapping very easy. The same was true for physical mail (one major reason why most states created and held on to the monopoly on mail for so long).

With email and IM this is - again due to the way this works - a lot more difficult. Artificially restricting encryption just so they can keep on doing things the way they're used to is a bad idea, and kind of naive, too.

edraferi• 10 years ago

You're correct to point out that this debate is about a change in the staus quo: law enforcement used to be able to access the dominant communications system with a lawful order, proper crypto removes that capability.

It is inevitable that this change, lwft unchecked, will increase citizen privacy AND decrease law enforcement effectiveness. The HN community is very aware of these privacy benefits, but skeptical about the security costs. I wonder how far security must slip before those costs become apparent.

Until that happens, we basically have two camps of experts talking past eachother. The tech community sees the privacy cost, the law enforcement sees the security cost. Both back up their claims with "trust us, this is what we do for a living." This makes it very difficult to create a policy solution.

nickik9• 10 years ago

Actually the availabitly of data has massivly increased. They have access to far more thing then they ever had.

We have few ways to hide metadata and those are of major imprtance. Investigating crime is now far easier the it was at any time beore 1995 and the world did go to shit then.

The Next Front in the New Crypto Wars: WhatsApp

Related Stories