WhatsCrap? Most Everything.
Every man in the middle is an attacker.
This came across my feed yesterday and I marked it for the sake of editorializing.
WhatsApp messaging app banned on all US House of Representatives devices
I guess we need to talk about encryption and keys and such … which I dread explaining to non-technical people. But here goes …
Attention Conservation Notice:
Angry nerd takes a break from cleansing ssh keys all over the heckin’ planet to rant about a slightly less esoteric problem. TLDR: Just install Signal and be done with it.
Encryption, Basically:
OK, so here’s the thing - when we talk about encryption, generally what is meant is “public key exchange”. What this means is that the application you are using employs some hard to perform math that’s impossible to reverse without a quantum computer, creating a public key you can give to anyone, and a private key that you use to keep things, well … private.
Mostly you don’t see this happening, unless you’re using ssh or something where you manually use keys. I made an example for you. This is the public key I could place on any remote system.
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAtekPIcCkTJEe6iNdrCQ8upcAIJj0Dm44CkqoKI9/XV example@example.net
And this is the private key I keep to myself.
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmZAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACALXpDyHApEyRHuojXawkPLqXACCY9A5uOApKqCiPf11QAAAJh3w8BCd8PA
QgAAAAtzc2gtZWQyNTUxOQAAACALXpDyHApEyRHuojXawkPLqXACCY9A5uOApKqCiPf11Q
AAAECUpaPd5QyMnrbVVE42gZCQTBUK5bdFLuz1BYFb9FFmPQtekPIcCkTJEe6iNdrCQ8up
cAIJj0Dm44CkqoKI9/XVAAAAEmJyYWluQGJyYWlucy5sb2NhbAECAw==
-----END OPENSSH PRIVATE KEY-----
So I could add that public key to ~/.ssh/authorized_keys, then I can log into the remote system without using a password, and that’s fine, as long as I’m a paranoid weirdo (lol obviously) and my desktop is secure.
Man In The Middle:
So here’s the big issue - with Signal you have a key pair, the person you communicate with has a key pair, and Signal itself knows none of this. As long as you and the other party keep your devices secure, there’s nothing to be seen.
There are way too many services out there that offer encryption from user to their servers, using something like SSL. This protects against observation on your network or within your ISP, but the operator of the server can see everything. This is why you don’t use Telegram as anything other than a stage for putting on performances and it’s why WhatsApp is now banned for Congressional staff.
Meta is being treated like a hostile nation state, which is long overdue.
Deeper:
This is a deep “how hackers do it” encryption explainer. You probably don’t need to read this, unless you’re the designated nerd for your circles of associates.
How do you chat securely without being observed?
VPN first to protect your origin IP
Tor second, to anonymize
Use a Jabber server that speaks TLS (SSL)
Use OTR to encrypt individual conversations
You can reverse #1 and #2, launder TCP VPN usage through Tor, this is good for getting around the pervasive Tor bans out there. The Jabber server is at a known location, it doesn’t have the benefit of #1 and #2, unless it’s being run as a Tor hidden service - so TLS protects the communications with it. And then OTR within that.
The server operator knows which IPs are involved and when, but if both of you followed this procedure only the time is of any value.
For bonus points, get into a number of busy rooms on Jabber, and then private conversation blends in and further frustrates attribution.
Conclusion:
Have you done the things in Safety Dance?
I’m getting the feeling that Safety Dance needs an update … a single point of reference that contains a checklist of what to do/not do in terms of one’s digital shadow.
