WhatsApp Becomes The Latest Victim

Is there a truly secure messaging app? One could spend hours examining all the encrypted communications tools available, from popular services such as WhatsApp and Facebook’s Messenger to newcomers such as Signal and Wire.

But while experts agree that some of these options are more secure than others, there always seems to be another flaw waiting to be discovered. This makes the search for a perfect app resemble the hunt for the goose that laid the golden egg.

That point was driven home recently with the revelation that attackers could exploit a security vulnerability in WhatsApp to snoop on its users.

The vulnerability was found in the service’s implementation of end-to-end encryption, which is supposed to make it all but impossible for messages to be read by anyone except their intended recipient, and in WhatsApp’s management of the unique security keys used to scramble and unscramble those messages on users’ devices.

The problem stemmed from WhatsApp’s ability to create new encryption keys for offline users. This is common for secure communication tools, but WhatsApp is set apart by its decision to re-encrypt messages with the new keys without informing their sender or recipient.

This could allow someone to intercept communications with no indication to anyone involved with the conversation. WhatsApp has therefore effectively undermined the basic principle of end-to-end encryption.

It would be easy to overreact to this issue. WhatsApp did not create a backdoor into its service, a claim with which Brian Acton, the company’s co-founder, publicly took issue, saying WhatsApp would “fight any government request” to create one.

Nor did it introduce a vulnerability so critical that people should remove the app from their devices. Concerned users can verify someone’s identity by comparing the “fingerprints” associated with their key, and they can enable a setting that notifies them when a message has been re-encrypted with a new key.

Yet even the nature of those notifications is up to question. There are two options, blocking or non-blocking, which refer to requiring users to manually verify that a new key is legitimate or simply notifying them when a key has been changed.

WhatsApp notifications are non-blocking. Signal, the encrypted messaging tool from Open Whisper Systems (OWS) whose end-to-end encryption protocol is used in WhatsApp, Messenger and other apps, uses blocking notifications.

Some messaging apps follow WhatsApp in not informing users of key changes by default. Others, like Wire, don’t send messages to people with new keys without user consent. These companies will face criticism no matter what they choose, WhatsApp users might worry that their messages are insecure; Wire users might grow tired of security notifications, and might change their approach based on user feedback as OWS is doing with the Signal app.

There is no right or wrong answer. The same can be said for other decisions, such as Google’s Allo and Facebook Messenger’s “secret conversations” not using end-to-end encryption by default, which the companies say allows them to offer features that wouldn’t be possible otherwise.

Apps that do use encryption by default, such as Signal and Wire, among others, require people to convince everyone with whom they wish to communicate to switch to unfamiliar messaging tools.

There will never be a one-size-fits-all in the secure communications market. Just as these services have to decide on what problems they wish to solve, consumers must choose the app that best suits their needs.

More apps support end-to-end encryption than ever, and even if none of them are perfect, this means private communications are more secure than before.

These are nuanced problems that must be considered with care instead of being oversimplified.

Guardian:

WhatsApp Implements Encryption:             Delete/Never-Use Google Allo: Says Snowden:

 

 

« How To Automate Cyber Defense
Technology, Multilateralism, War and Peace »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Protegrity

Protegrity

Protegrity is an enterprise and cloud data security software for data-centric encryption and tokenization to protect sensitive data while maintaining usability.

Cyber Security Centre - University of Hertfordshire

Cyber Security Centre - University of Hertfordshire

The Cyber Security Centre provides training, teaching and research in the fast paced topics of cyber security and digital forensics.

Information and Communication Technology Authority (ICT Authority) - Kenya

Information and Communication Technology Authority (ICT Authority) - Kenya

The ICT Authority is responsible for enforcing ICT standards in Government and ensuring information security.

Data Protection People

Data Protection People

Data Protection People are specialists in Data Privacy, Governance, and Information Security.

EU Joint Research Centre

EU Joint Research Centre

JRC is the European Commission's science and knowledge service which employs scientists to carry out research in order to provide independent scientific advice and support to EU policy.

Digitpol

Digitpol

Digitpol’s Cyber Crime Investigation experts investigate hacking incidents, ransomware, extortion and conduct security audits and IT upgrades.

National Institute for Research & Development in Informatics (ICI Bucharest) - Romania

National Institute for Research & Development in Informatics (ICI Bucharest) - Romania

ICI Bucharest is the most important institute in the field of research, development and innovation in information and communication technology (ICT) in Romania.

Team Secure

Team Secure

Team Secure provide Enterprise-grade Cyber Security consultancy, managed security services and cyber security staffing services.

Digistor

Digistor

Digistor is a leading manufacturer of industrial-grade flash storage products, secure storage products, and Removable Secure Data Storage.

Cloud4C

Cloud4C

Cloud4C is a leading automation-driven, application focused cloud Managed Services Provider.

Valeo Networks

Valeo Networks

Valeo Networks is a full-service Managed Security Service Provider (MSSP). We partner with organizations to remove the burden of technology so that they can focus on growing their business.

Qevlar AI

Qevlar AI

Qevlar AI empowers SOC teams, to eliminate redundant tasks and refocus on what truly matters - making the most of every employee within the SecOps team.

Cybercentry

Cybercentry

Cybercentry is a specialist information security, data protection and cyber security consultancy.

Irys Technologies

Irys Technologies

Irys Technologies specialize in pioneering digital transformation solutions designed to streamline communications and enhance maintenance and operational efficiency for a variety of sectors.

Aprio

Aprio

Aprio is a premier business advisory and accounting firm. We deliver advisory, tax, managed, and private client services to build value, drive growth, manage risk, and protect wealth.

Two Candlesticks

Two Candlesticks

Two Candlesticks is a global cybersecurity service provider delivering high level consultancy, strategy, and frameworks to governments, regulators and midsized companies.