Viber has been updated with end-to-end encryption
play.google.com/store/apps/details?id=com.vib...
play.google.comPosted Apr 19, 2016, 8:03 AM UTC
49560
play.google.comI would like to know what encryption did they use. Someone?
17
Kinda important. A closed encryption is no encryption.
6
This is indeed important. Ah, please? Someone?
4
I wouldn't say its no encryption, but there's no point in advertising end to end if they don't have it. Quite honestly 99% of the public doesn't care which is why they continue using Gmail, Facebook, etc.
I do agree though it would be nice to know the encryption protocol they used. I think it's more accurate to say that if your goal is to avoid 3 letter agencies, then you should avoid closed source apps. That's not the case for your average user though.
2
There's no point in encryption if it's not secure and can be hacked by any kid with a smart phone.
0†
Closed source doesn't mean it can be hacked by any kid with a smart phone. Closed source has its disadvantages, but I can bet you you're using tons of closed source software right now; it's hard to avoid.
I agree encryption needs to be strong, but I question if r/android really cares about encryption or they just want a few buzzwords. Case in point: Pushbullet. People here clamored for E2E encryption. However when they implemented it, none of the thousands of comments on the thread asked about or was concerned the scope being only notifications and SMS. Your pushes themselves aren't end to end encryption. I brought it up multiple times, but it seems like no one cares. Keep in mind this was before they went to a paid service also.
4
Check Frederic Jacobs' twitter, he was doing a decompile and saw some not-so-promising references to MD5 (at least when I saw the tweets)
2
TOTAL BUMMER!
2
Biggest news here is Viber still exists.
10
[deleted]
5
I personally have it installed because ONE friend doesn't use FB or Whatsapp. if he went to whatsapp I'd uninstall it.
It was good for when Whatsapp didn't have calling but now, no need
1
No one does.
-7
It's popular in Asia/UAE/Russia. I used to use it to keep in touch with family until WhatsApp introduced voice calling. I never liked it though.
7
Have some of you tested the updated version? I just did it with a friend of mine and neither of us can see a damn lock on our conversation.
6
Yep, same with me, no lock. However, when I started my desktop version, it recognized that I had updated my mobile version, and asked me to scan a QR code to verify my desktop device.
6
I did the same and no lock appeared.
2
We’re rolling this out globally over the next two weeks, and you’ll see a grey padlock to confirm you are secured.
1
Alright, thanks for the update on the update!
1
If WhatsApp can do it why not us?
6
[deleted]
1
Encryption without authentication is kind of meaningless. That's why Signal and WhatsApp let you compare key fingerprints with the other party. Doesn't seem like that facility exists in Viber so you would have no way of knowing if a man-in-the-middle was reading your messages.
5
Agreed but iMessage doesn't have this ability either. I'm not saying that's OK, but these are apps for your average Joe, not for your security minded individual. It would be nice to have a key matching system where you can compare keys, but I can see why they didn't include it.
6
According to their FAQ they do have it (per conversation)
3
That twit podcast though :D
0
I love that I can use Viber on the PC, multiple phones and tablets. I wish Whatsapp had this ability.
5
not quite the same, but https://web.whatsapp.com is pretty good
2
yeah but viber itself sucks
1†
Not a big fan of Viber but I agree with you on this.
1
I am too, but the main reason I use Viber is that it's the platform of choice for the majority of my friends, unless you count Facebook messenger.
1
Is it just me or does viber sound like some kind of Bluetooth sex toy?
4
[removed]
2
[removed]
1
Next up they should fix end to end connection because it never works for me
1
[deleted]
0
I thought this app was dead
-2†
They haven't released any details on their encryption methods. Here are some useful links to read anyway:
https://support.viber.com/customer/en/portal/articles/2290706-viber-security-update?b_id=3838
https://support.viber.com/customer/portal/articles/2017401-viber-security-faq
XOR encryption can still be "end to end" after all. :)
But really. Just saying "it's encrypted" isn't good enough. Most developers are reasonably smart people, and anyone can understand the mechanics of cryptography, but actually doing it right (even if you're using someone else's code) requires a lot of diligence. That's why, frankly, it's considered bad form even by experts to "roll your own" encryption without a lot of peer review.
WhatsApp's implementation, though not open source and available for audit, is at least blessed by the likes of Moxie Marlinspike of Open Whisper Systems. No one is infallable, but Open Whisper is definitely what I would call an expert firm. WhatsApp could be vulnerable to exploit, sure, but Viber's is a total crapshoot at this point.
For best results, of course, you can go with Signal, which can be audited by anyone.
The WhatsApp e2e implementation is OSS. They use the well audited open source Signal Protocol implementations available here: https://github.com/whispersystems/libsignal-protocol-java
We weren't involved in the Viber e2e deployment, and I haven't seen any technical documentation on what they've built. We'd love to work with them to help deploy something that has been well tested and well studied.
Hi Moxie,
Completely off topic - but I would like to thank you for the countless hours of work that you and your team have put into Signal and the protocol behind it. It has already proven its worth to me and many of my peers.
I hope you guys get to enjoy the success that you deserve.
Thanks!
To be fair, as WhatsApp is closed source, is there any way to verify that they haven't implemented it in a flawed way?
Even if it was fully open source we can't never be sure there ISN'T any flaws. It's hard to prove a negative. Just look at heartbleed for example.
WhatsApps encryption is possibly the best we've got. Not perferct. But encryption can never really be 100% perfect.
You can decompile the apk and take a look if you want to.
Hi moxie! Could you clarify a bit about Signal app's data handling? I tried asking Open Whisper Systems, but didn't get an answer...
How long are messages (1:1/group/multiple devices per person) stored on servers?
Are calls peer to peer (direct) or are servers involved? If so, on what rules? Are calls' data retained? If so, what for and for how long?
When I delete Signal from my phone (and computer linked to it) or disable the "Signal messages and calls" option in Advanced settings (and delete from the computer), does any data remain on the Signal server about me (like telephone number, connections with other users, messages, call records, contacts, metadata, anything)? What data is it and what is it needed for?
I know that Google GCM push notifications in Signal are only wake up events and don't contain message texts (even encrypted) or metadata, is it exactly the same with Apple APN push notifications?
Perhaps it would be helpful to new users to include a detailed explanation on this in the FAQ/documentation. The Signal app and protocol documentation is in a miserable state at the moment. This should be done properly.
Thanks!
Until they're delivered.
TURN server, nothing retained.
We never store your connections, messages, call records, contacts, or any of that stuff to begin with.
Yes
https://whispersystems.org/signal/privacy/
The library that you linked is gpl. Shouldn't it be lgpl for closed source apps to link to it ? Also, I couldn't find this lib listed in their licenses page on the app (I could have missed it though since it's a giant wall of text on the phone with no way to search)
Since WhatsApp is closed source, you cannot be sure that the protocol was used as the source shows it, though.
apktool makes it easy to verify. You'd have to do that even if it were open source, since the binary being distributed is what matters.
I guess my question is this. Since I can't actually download WhatsApp's code, and compile it, how do I know that libsignal is being faithfully implemented inside the apk at any given point?
Steve Gibson also gives a thumbs up on WhatsApps's implementation