WhatsApp Backdoor (/Bug?) file The Backdoor Alice Bob Alice and Bob meet in person and verify the fingerprint 2 1 3

https://tobi.rocks/

WhatsApp Backdoor (/Bug?)Anotherreasonfornottrustingclosed-sourcecrypto

https://tobi.rocks/

WhatsApp

• 1billionmonthlyactiveusers(February2016)• 1/7ofworldpopulation

• end-to-endencryption“completely”implementedApril2016• ImplementstheSignalprotocol

SignalPrivateMessenger

https://tobi.rocks/

The Backdoor

Alice Bob

https://tobi.rocks/

The Backdoor

Alice Bob

1

https://tobi.rocks/

The Backdoor

Alice Bob

12

https://tobi.rocks/

The Backdoor

Alice Bob

AliceandBobmeetinpersonandverifythefingerprint

12

3

https://tobi.rocks/

The Backdoor

Alice Bob

https://tobi.rocks/

The Backdoor

Alice Bob

4 “HiBob”

https://tobi.rocks/

The Backdoor

Alice Bob

4 “HiBob”

5

https://tobi.rocks/

The Backdoor

Alice Bob

4 “HiBob”

5

6 “HiBob”

https://tobi.rocks/

The Backdoor

Alice Bob

4 “HiBob”

5

6 “HiBob”

7

Bob’ssecuritycodehaschanged

https://tobi.rocks/

The Backdoor

Alice Bob

4 “HiBob”

5

6 “HiBob”

7

Bob’ssecuritycodehaschanged 8 “HiBob”

https://tobi.rocks/

Alice’sPhone Attacker Alice’sPhone

https://tobi.rocks/

Signal is doing it right

• Thewarningisdisplayed• Themessageisneverretransmitted

https://tobi.rocks/

Disclosure Timeline

https://tobi.rocks/

Disclosure Timeline

• WhitehatreportonApril10

https://tobi.rocks/

Disclosure Timeline

• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”

https://tobi.rocks/

Disclosure Timeline

• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”• Me:“Thisshouldnotbeexpectedbehavior.“

https://tobi.rocks/

Disclosure Timeline

• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”• Me:“Thisshouldnotbeexpectedbehavior.“• Facebook,May31:“Wewerepreviouslyawareoftheissue[…]fornowit'snotsomethingwe'reactivelyworkingonchanging”

https://tobi.rocks/

Disclosure Timeline

• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”• Me:“Thisshouldnotbeexpectedbehavior.“• Facebook,May31:“Wewerepreviouslyawareoftheissue[…]fornowit'snotsomethingwe'reactivelyworkingonchanging”• Status(December28):Notfixed

https://tobi.rocks/

More reasons to use Signal

• Signalisopensource• Signalhasmostlyreproduciblebuilds• WhatsAppmaystoreMetadata(accordingtoprivacypolicy)

• timestampinformation• successofmessagedelivery• phonenumbersofsenderandrecipient• contactlists• “otherinformation”

• Signalstoresless:• lastdayauserconnected• contactlistsarenotstoredonsignalservers