819
A federal agent said WhatsApp's encryption is a lie. Then the investigation was shut down (www.techspot.com)
submitted 5 months ago by to c/technology@lemmy.world
108 comments fedilink hide all child comments
 

A 10-month Commerce Department probe concluded Meta could view all WhatsApp messages in unencrypted form

you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 5 months ago (5 children)

Creating the secure key pairs used for true E2EE requires a mathematical foundation of true randomness, which can only be achieved on a device by working with the OS, through an API call, to get a random seed that includes pseudorandom numbers from the device's sensors. There was a post a while back where a dev used ADB to read the API calls used during WhatsApp account setup that showed that no such calls were made, meaning the keys were either totally predictable, or were actually generated by Meta themselves.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 6 points 5 months ago (3 children)

    When I read the article about cloudflare using lava lamps (and other things at other locations) to create randomness I had no idea it had to be that crazy to be random.

    https://youtu.be/1cUUfMeOijg

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 6 points 5 months ago (2 children)

    It actually doesn't need to be so elaborate. Even a video camera with the lens cap on generates more than enough entropy. Your phone can mix together predictable but unique variations - time of day, free memory, CPU serial number, battery level - with less predictable physical sensory - light level, gyroscope, barometer, last touch points, nearby MAC addresses - to create far more on-board randomness than anyone realistically needs.

    That said, the whole Cloudflare lava lamp thing is very cool and also gets people talking.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •