Hot answers tagged

10

Correct: The Web-Client is establishing a secure connection to the phone. The messages you send through WhatsApp Web are encrypted by the WebClient, decrypted by the phone, then re-encrypted to fit the end-to-end scheme and then sent to the recipient. Same thing the other way around. I dont know details about the protocol, but this is what i suspect (or how ...


6

There is no reason to think a network operator can access the data. The document says it clearly: Encrypts metadata to hide it from unauthorized network observers. In other words, you are questioning that what's said in the document is false. The only people that could shed more light on this would be WhatsApp or Open Whisper Systems (the company ...


3

PCI DSS v3 section 6.5 calls out the need to protect sensitive data even if it is in memory, to help thwart memory scraping attacks. So if you expect to need PCI compliance, yes, you should protect sensitive data even if it's in memory. I don't know what technology you are using, but even non-persistent data can stick around for a while. For example, ...


2

Phone/SMS verification works, it just solves a different problem than loss of your phone. Phone verification prevents against an attacker impersonating a user by logging in as them from some random network device using their username and password. For example, if a user's password is exposed because they reuse the same email and password on multiple sites, ...


1

Most phones have the cellular network interface share some memory with the main processor (I wonder if it's cooperation between manufacturers and carriers/law enforcement to give them potential access to the phones?). As a result, a compromised/malicious cellular NIC could take over the entire machine. There are ways to mitigate this without completely ...


1

It has been a while since this question was posted, so perhaps times have changed. Many mobile phone password managers include a special keyboard that can look up passwords in the password manager and type them in for you in a single button press. Some of them on Android even take advantage of accessibility features to do that automatically with minimal ...


1

I can think of 2 ways the phone-based verification helps, even if your mobile device is how you access sensitive web sites. Both require that only you have physical access to your device. If you use your phone to enter your credentials on a phony web site (for example due to a phishing attack) then when the attacker tries to use them to log into the ...



Only top voted, non community-wiki answers of a minimum length are eligible