« first day (23 days earlier)      last day (1357 days later) » 

 
2 hours later…
 
2 hours later…
Wes
Wes
08:36
Our espresso machine in the office has a touch screen. And someone just managed to #rickroll it. /c @internetofshit https://t.co/KQgnNG6Y4x
3
 
5 hours later…
13:29
posted on April 05, 2016

LinuxSecurity.com: The teenager who grabbed headlines earlier this week for hacking a fake game listing on to Valve's Steam store says there are "definitely" more vulnerabilities to be found in the popular game distribution service. But he won't be the one to find them, thanks to what he sees as Valve "giv[ing] so little of a shit about people's [security] findings."

 
2 hours later…
15:05
I gotta say. I particularly hate aggregator sites like linuxsecurity.com that do nothing but copy over someone else's content and make profit off of the ads.
MadaraUchiha how can you be sure they copy someone else content??
if so isn't that good providing all things at one platform??
@AnmolRaghuvanshiVersion1.0 Not when you profit from ads and do 0 effort for it.
There are tools (like RSS) that will do that without profiting off my back
yeah fair enough
they also don't compliment to original authors too..
 
2 hours later…
oh, right. I'd forgotten about this place
18:44
i am only the one who did not shutdown it's laptop for weeks and months or it's common among developer.. ;p
 
1 hour later…
19:58
@MadaraUchiha how are they generating keys and where are they stored and how are they verified?
@crypticツ Apparently, your device generates a public and a private key
The public is sent and stored on their servers
Along with an ID of some sort that may or may not personally identify you
If a user can't verify a key belongs to a specific user they may as well be speaking directly into a microphone to the NSA/FBI
(probably your phone number though)
When you want to speak with me, you'll ask the WhatsApp server for my public key, encrypt your message with my public key, and then send it over to me
Where I'd decrypt it with my private
I'm not familiar with the key verification or negoation process, this is a fairly new feature.
Yeah, but how do I know the public key I am getting for you is actually your key and not an imposter's key. You typically have to verify with the other person through other means to make sure the fingerprint matches, etc.
Yes, I don't know how (or even if) WhatsApp does that.
20:02
That's been one of the Achilles heel with end-to-end because of the learning curve of the trust model.
WhatsApp is probably lying and working with the feds =oD
I'm guessing, they expect the user to just trust their servers
For simplicity's sake
That's the compromise they made
@MadaraUchiha why aren't they using a key exchange, storing a private key on a volatile device where the user wont think of backing it up
@Leigh Why are you asking me that? :P
Because you have the "apparently"'s :)
20:06
@Leigh The "apparently"s are just what I read from the article I posted and the articles linked there.
> WhatsApp users additionally have the option to verify the keys of
the other users with whom they are communicating so that they
are able to confirm that an unauthorized third party (or WhatsApp)
has not initiated a man-in-the-middle attack. This can be done
by scanning a QR code, or by comparing a 60-digit number.
@crypticツ Where do you get the QR code from?
so this is a web of trust thing?
have no idea, it seems the app generates it as an option to validate the key. If so then how do we trust the QRcode?
@crypticツ That would be my followup question
20:09
is WhatsApp OSS?
no
it's facebook
then it can't be trusted
The QR code contains:
1. A version.
2. The user identifier for both parties.
3. The full 32-byte public Identity Key for both parties
they could sign the QR code with their public key...
All of those are things that the server knows
20:10
eff.org/secure-messaging-scorecard just use one of these.
sorry, sign with their private
@Leigh How do you sign a QR code with your private?
well, I have my private key, I can sign a QR code with it (differs depending on algorithm..), and you verify with my public, that has been signed by other people
You can make any text into a QRcode, I'm not sure of the length limit, but adding a signature to the text before generating the image would work, but it would need some sort of gpg: protocol handler for the phone to understand it and verify on scan.
it's like PGP
20:14
@Leigh The problem here being that I can't trust WhatsApp to do this for me
I need to use an external tool, that is not WhatsApp, because I don't trust WhatsApp, to verify that
So the QR code is pointless to begin with, because we could have done it in any other way.
This could make a good question for Information Security
@AnmolRaghuvanshiVersion2.0 How'd you find that by the way?
is worth reading??
I think the idea is, you're in physical proximity to someone showing you a QR code. Yes, you can't trust the software that generates it, but you either have to trust a service provider, or proceed knowing you don't trust them and accept that, or not use their service.
just simply copy pasting your question MadaraUchiha
@Leigh You can use any untrusted service provided you have proper verified end-to-end. I use to use Jitsi to encrypt end-to-end with Facebook messaging and Yahoo for example. The problem is the verification. I'd rather have an opensource 3rd party app like Jitsi handle my key negotiation and verification, than the actual service I'm using, because then it's behind closed doors and I have no idea it's doing what it's suppose to and not just accepting MITM keys without my knowledge.
Oh I don't disagree, doesn't change the fact with WhatsApp, you'll never get that
20:22
looks like some snake-oil PR stunt, or they are already in cahoots with the Feds.
0
Q: How would one verify that the public key I'm getting from WhatsApp's servers belongs to the person I expect it to?

Madara UchihaWhatsApp had recently announced end-to-end encryption on all communications. While that's an impressive move, I still have a big open question mark. The articles and this white paper suggest that the public key, upon generation, gets stored on the server. When I want to speak to another person, ...

2
Feel free to suggest edits
Although
Even if you do sign a message with your private, and prove to me that you own the private to which I have the public for
What good does that give me?
I already know that you have the private, because I encrypt all of my messages with your public, and only the guy with the private can decrypt them
there chrome extension for generating qr code chrome.google.com/webstore/detail/qr-code-generator-for-wha/…
may be this thing is releated to whatsapp web??
20:49
@AnmolRaghuvanshiVersion2.0 It's most likely based on a TOTP scheme, the refresh is to keep the key fresh while allowing the client/server to be a little out of sync with each other
in JavaScript, 2 mins ago, by copy
@MadaraUchiha I think the QR code or 60 digit number is what needs to be verified using a secure external channel. for example by scanning the other user's phone in person or checking the number on his wobsite
@AnmolRaghuvanshiVersion2.0 We aren't talking about that QR code.
Private key is stored on the device under the WhatsApp app. Public key is stored on the WhatsApp server. Both are in control of WhatsApp, so they could swap out both private/public keys for an individual and their friends without anyone knowing at anytime. Right?
They can bypass verification in other words.
Ah Sorry ..
well I think I want to dig into deeper
21:27
@crypticツ You need to verify correctness the first time you speak to someone
After that, you need to verify identity with the first public key you verified every time
I don't like closed source. We can't assume that the app itself won't be sending the private key to the server.
@crypticツ All of this is in good faith
You can also not trust them encrypting anything at all
I remember this technobuffalo.com/2013/07/11/… it use to be that Skype was encrypted end-to-end transparently afaik. Then it was revealed that they just went ahead and bypassed it all with a backdoor. We should all stick to OSS or join me in my underground bunker.
I think that open sourcing their client is a logical next step
They can still take payment for using the server and provide tech support
While the client and all encryption can get audited seriously.
Don't know if they're gonna do it though (probably not soon)

« first day (23 days earlier)      last day (1357 days later) »