This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at https://www.theguardian.com/technology/2017/jan/13/whatsapp-encryption-backdoor-snooping-signal

The article has changed 10 times. There is an RSS feed of changes available.

Version 3 Version 4
Should I be worried about the WhatsApp encryption vulnerability? Should I be worried about the WhatsApp encryption vulnerability?
(5 days later)
A vulnerability has been found within Facebook’s secure messaging service WhatsApp, which would allow the company and third-parties such as government agencies to intercept and read supposedly encrypted and private messages.A vulnerability has been found within Facebook’s secure messaging service WhatsApp, which would allow the company and third-parties such as government agencies to intercept and read supposedly encrypted and private messages.
What is WhatsApp?What is WhatsApp?
WhatsApp is a free messaging and calling service that uses the internet to deliver communications. It is used by over 1 billion people across the world including in countries with oppressive regimes. It was bought by Facebook in 2014 for $22bn (£18bn) and implemented end-to-end encryption in April 2016.WhatsApp is a free messaging and calling service that uses the internet to deliver communications. It is used by over 1 billion people across the world including in countries with oppressive regimes. It was bought by Facebook in 2014 for $22bn (£18bn) and implemented end-to-end encryption in April 2016.
What is end-to-end encryption?What is end-to-end encryption?
End-to-end encryption (E2EE) ensures that a conversation can only be read by the sender and recipient and not intercepted by a middleman. WhatsApp uses the acclaimed Signal encryption protocol that relies on the exchanging of unique security keys that are verified between users to guarantee communications cannot be intercepted by a middleman.End-to-end encryption (E2EE) ensures that a conversation can only be read by the sender and recipient and not intercepted by a middleman. WhatsApp uses the acclaimed Signal encryption protocol that relies on the exchanging of unique security keys that are verified between users to guarantee communications cannot be intercepted by a middleman.
Anything said between users with E2EE is guaranteed to be private during transit, unless there’s a backdoor to the encryption. Anything said between users with E2EE is guaranteed to be private during transit, unless there’s a vulnerability in the implementation of that encryption.
What is a backdoor?
A backdoor to a technology such as encryption is simply a way for a third-party to access something secure without the primary parties being aware. In this case, it is a vulnerability that could be used as a backdoor by a third-party such as WhatsApp to read encrypted messages that are supposedly secure against interception. Your security technology is only as strong as the weakest link. The introduction of a vulnerability able to be used as A backdoor is the weak link.
What has WhatsApp done?What has WhatsApp done?
The Signal encryption protocol has no known weaknesses if it is implemented correctly. Whatsapp’s implementation has a vulnerability that could be used as a backdoor into the Signal protocol, giving itself the ability to force the generation of new encryption keys for offline users and to make the sender re-encrypt messages with new keys and send them again for any messages that have not been marked as delivered. The Signal encryption protocol has no known weaknesses if it is implemented correctly. WhatsApp’s implementation has a vulnerability that could be used as a backdoor into the Signal protocol, giving itself the ability to force the generation of new encryption keys for offline users and to make the sender’s WhatsApp app re-encrypt messages with new keys and automatically send them again for any messages that have not been marked as delivered, without giving the sender a choice not to re-send the messages..
It means that it could generate keys known to Whatsapp or a third-party and therefore read and intercept apparently encrypted messages without the sender or recipients knowledge. It means that it could generate keys known to WhatsApp or a third-party and therefore read and intercept apparently encrypted messages without the sender or recipient’s knowledge.
Why is it like it is?Why is it like it is?
WhatsApp says that it used this implementation of the Signal protocol to aid usability. If it is not in place, messages sent to an offline user, who then changes their smartphone or has to re-install whatsapp and in doing so generates new security keys for themselves, would remain undelivered once the user comes back online. WhatsApp says it used this implementation of the Signal protocol to aid usability. If it is not in place, messages sent to an offline user, who then changes their smartphone or has to re-install WhatsApp and in doing so generates new security keys for themselves, would remain undelivered once the user comes back online.
A WhatsApp spokesperson told the Guardian: “In many parts of the world, people frequently change devices and Sim cards. In these situations, we want to make sure people’s messages are delivered, not lost in transit.”A WhatsApp spokesperson told the Guardian: “In many parts of the world, people frequently change devices and Sim cards. In these situations, we want to make sure people’s messages are delivered, not lost in transit.”
Should I be worried? How dangerous is this?
Unlike most of Facebook’s other messaging and social media services, this vulnerability is unlikely to ever be used for profiling for advertising purposes. The burden to execute the interception of messages is likely too high to be cost effective. Reassuringly, security experts say the vulnerability cannot be exploited for the mass surveillance of WhatsApp users – individuals need to be targeted – and because it can only be exploited to access messages that have yet to be marked as delivered it probably cannot be used to access messaging histories that have been confirmed as delivered.
But the same cannot be said for government agencies and actors. A way into a supposedly secure, end-to-end encrypted, private messaging service could be a “goldmine” for surveillance purposes and is “a huge betrayal of user trust”, according to privacy advocates. However, for people choosing a service which offers end-to-end encryption in order to ensure that their messages are secure, some security experts have warned that the vulnerability could pose a risk. Undelivered messages could be accessed, including in situations that do not require WhatsApp’s involvement: for example, if an activist is arrested, the app does not prevent messages sent to the activist, but not yet delivered, from being read by anyone who puts the Sim card into a different phone. Even if both the users had turned on WhatsApp’s strongest security settings, the sender would not be notified that the swap had occurred until after their messages were re-sent. The basic principles of this attack are easily demonstrated.
The amount of private information sent knowingly or unknowingly through WhatsApp could be vast and therefore is a very attractive target for surveillance.
Should I stop using WhatsApp?
If you use WhatsApp as a way to avoid government surveillance due to its end-to-end encryption service, you should stop using it immediately.
Facebook and WhatsApp could be compelled to give government agencies such as GCHQ and the US National Security Agency access to users’ messages.
What are the alternatives?What are the alternatives?
There are several alternatives to WhatsApp that use encryption to secure communications against interception. The most recommended is Signal, which was developed by Open Whisper Systems and is the namesake of the Signal E2EE protocol. There are several alternatives to WhatsApp that use encryption to secure communications against interception. The most recommended for its focus on security is Signal, which was developed by Open Whisper Systems, is the namesake of the Signal E2EE protocol, and is used by the NSA whistleblower Edward Snowden. However some security experts say it is less user friendly than WhatsApp and highlight that using it could mark a user out as a person of interest to authorities. Other messaging services such as Apple’s iMessage have end-to-end encryption but do not implement fingerprinting – so users have no way of verifying encryption keys themselves. Facebook’s Messenger and Google’s Allo don’t have end-to-end encryption by default, though forms of it can be enabled. Other older methods of messaging such as SMS don’t have any encryption at all.
It is used and recommended by NSA whistle blower Edward Snowden, and is considered the gold standard for private messaging. It does not have the same vulnerability in its implementation of E2EE as WhatsApp, and is available for Android and iOS. Should I stop using WhatsApp?
This article was amended on 17 and 20 January 2017 to clarify earlier references to a “backdoor”. There is no easy answer. All decisions around security involve trade offs, particularly between usability and confidentiality. For people worried about mass surveillance or the monitoring of messaging for advertising or commercial purposes, the vulnerability in WhatsApps implementation may not be too concerning. For individuals for whom an individual message could put them in danger, the vulnerability could be critical. The EFF, the Electronic Frontier Foundation, currently does not recommend using WhatsApp for secure communications.
Exclusive: WhatsApp vulnerability allows snooping on encrypted messages • This article was amended on 17 and 20 January 2017 to clarify earlier references to a “backdoor”. This story was further updated on 25 January 2017 to more fully explain the WhatsApp vulnerability and its implications.
WhatsApp vulnerability allows snooping on encrypted messages