Hacker News Reader

Comment by exikyut | Hacker News Reader

> It was unclear how the authorities can monitor apps such as WhatsApp, which says its messages are supported by end-to-end encryption, meaning the company cannot read customers’ messages even if approached by law enforcement agencies.

I'm both fascinated and perplexed too.

Any ideas/theories?

Does anyone know if you're governmentally required to install an SSL cert on your device, for example?

View on HN

Possibly some mobile telecoms route outgoing VOIP calls (regardless of originating application) via their own network? I haven't looked deeply into this, but I've noticed when I call someone on FB messenger, the call shows up in Phone.app with a long "social profile" address beginning with IBTU. Not sure if this address is internal to iOS or global.

Also, is it even confirmed whatsapp encrypts voice calls in addition to texts?

While WhatsApp (texts, anyway) are reportedly secure in terms of content - how about meta-data? Could they maybe trace texts, and see eg pairs of named Saudi nationals and recipients at Amnesty International - and could that be difficult without cooperation from WhatsApp (access to plaintext meta-data/routing information)?

With suspicion, I suppose message content is only a handful of plied fingernails or threats against close family away?

Messages are e2e, was under the impression that calls aren't yet.

According to https://blog.whatsapp.com/10000618/end-to-end-encryption, they are. Not sure who is wrong or lying. Or perhaps the"latest version" of WhatsApp will be prohibited.

I stand corrected.

Someone is obviously in the wrong here, have doubts whatsapp would ruin their business for a single country.

Perhaps the government only cares about who is calling who and for how long?

Aren't the whatsapp messages sent over the net? I.e. wouldn't it be the case that the government could only see the outgoing IP address? I guess if they were very well organized and working with the telecoms, they could then maybe see the outgoing IP and assuming that IP were on a telecom network they also controlled they could turn that into a person. This is all assuming that they could even figure out which encrypted outgoing packets correspond to calls (maybe this isn't too bad considering call streams would maybe have a fairly standard packet rate, etc.?).

Either way seems pretty hard without direct help from whatsapp.

It's Facebook that has access to this metadata.

> While the metadata is encrypted during transit, phone numbers, timestamps, connection duration, connection frequency, as well as user location are being stored on the company’s servers [0]

[0] https://arxiv.org/pdf/1701.06817.pdf

Just because they say that they can in a press release doesn't mean they really can. But what an average Saudi take a chance and risk jail or beheading b using Whatsapp to plan overthrowing the Saudi regime?

They will probably just record who you’re talking to. It is also possible to do a man-in-the-middle attack on WhatsApp but it is difficult.

Unless they struck a deal with Whatsapp for people's private keys somehow, i think it's a huge bluff.

Reply on news.ycombinator.com