URL: https://linuxfr.org/users/apichat/journaux/whatsapp-sa-porte-discrete-du-fond-et-les-backdoors-de-signal Title: WhatsApp, sa porte discrète du fond et les backdoors de Signal Authors: Apichat Date: 2017年01月20日T16:27:38+01:00 License: CC By-SA Tags: xmpp, signal, whatsapp, refletsinfo et porte_dérobée Score: 6 Nous le savons tous WhatsApp n'a pas de backdoor, c'est d’ailleurs pour ça que son code source n'est pas public : [ya rien à voir](https://twitter.com/bortzmeyer/status/822376928996823041), tchatez. Une très bonne explication est [publiée sur le site de Reflet](https://reflets.info/whatsapp-backdoor-ou-petard-mouille/) :> _Il suffit à WhatsApp d’ajouter un nouvel appareil virtuel au compte de Bob, cet appareil recevra ainsi les messages qui lui sont destinés> De manière générale c’est le problèmes des systèmes où le lien entre personne physique et clef de chiffrement est établi et contrôlé par un acteur tiers, comme WhatsApp, ou en utilisant des mécanismes peu fiables, comme le contrôle du numéro de téléphone.> C’est également un problème par ex. chez Apple (iMessage) : Apple gère la liste des appareils liés à un compte et est donc en mesure d’ajouter un appareil « fantôme » au compte qui recevrai alors tous les messages qui lui sont destinés, et peut se faire passer pour ce compte._ Cependant, [selon certains avis avisés de la Free Software Foundation Europe](https://blogs.fsfe.org/larma/2017/signal-backdoors/), il y aurait un certain nombre de backdoors présentes lors de l'_utilisation_ du logiciel Signal (logiciel développé par Open Whisper Systems, entreprise qui a vendu à WhatsApp la mise en place de l'implémentation non-publique du protocole [TextSecure-Axolotl-Signal_Protocol](https://en.wikipedia.org/wiki/Signal_Protocol) et qui [nous assure qu'ils n'ont pas mis de backdoor dans le code-source non-publié de WhatsApp](https://whispersystems.org/blog/there-is-no-whatsapp-backdoor/) - logiciel qu'ils recommandent même si c'est leur concurrent). Revenons-en à nos Systèmes Chuchotants (presque) Ouverts et parfois fermés et à ses portes d'accès inattendues. Ce que je trouve notable dans l'article de la FSFE :> _Well beside the point about Signal being suggested by several widely known people: While Signal is indeed open-source, it is still not free software because it uses an external library that is not open. So every audit that works on the source code will fail to find security issues and backdoors in that externally included code – and this is where I want to start to look into Signal now._ [...]> _**Google Cloud Messaging and other METADATA**_> _Well, you need to consider that Google knows a lot about everyone. The usual Android user will grant Google access to his contact database, list of installed apps, when which app is started, your current location, which text you write using the devices virtual keyboard (when using the "Gboard") and even more._ [...]> _So, when using Gboard, Google already knows the content of the messages shared, but not the recipient. And this is where the GCM data can be used. It shouldn’t be too hard to correlate the fact that one user is sending a message via Signal to another user receiving it._ [...]> _With Gboard active, Google even knows the exact moment the message is sent (enter key is pressed). Of course there are millions of Signal users with different users likely sending messages in approximately the same time, but it’s no problem if you need multiple messages to be sure and there is another bunch of information further restricting the search space: both users likely have the phone number of the other one in their phone’s contact list and Google is usually well aware of the contents of your contact list._ [...]> _**Maps Integration**_> _Critical about this is that the MapView view as used by Signal is just a wrapper that loads the actual MapView, by including code from the Google Play Services binary_ [...]> _The code is then executed in the Signal process, which includes access to the Signal history database and the crypto keys._ [...]> The Google Play Services binary can easily be updated in background through Google Play Store, even targeted to single users, and the updated code would become active inside Signal the moment you use it next time. Can it get worse? Yes. An apk update would be detectable to the user, but Google Play Services uses a dynamic module loading system (called Chimera and/or Dynamite) that seems to be capable of replacing the Maps implementation from a file not installed to the system, as long as it’s signed by Google. [...]> _**But Signal is Forward secret, You can’t read old messages**_> _The forward secrecy feature is only on the transport level. At both ends (in groupchats, all ends) the messages are available in plain text in form of a history. If you or the other(s) don’t wipe your chat history regularly, your history is still attackable. But this is how users want it, because it’s more user-friendly._ [...] **Et vous, qu'en pensez-vous ?**

AltStyle によって変換されたページ (->オリジナル) /