A security issue has been flagged in the hugely popular mobile messaging app WhatsApp that could allow for messages sent via the encrypted platform to be intercepted and read.
The Guardian report, which describes the vulnerability as a “backdoor”, notes that independent security researcher Tobias Boelter identified the issue in April 2016, when he says he reported it to Facebook, only to be told it was “expected behavior”, and that the company was not actively working on fixing it. The newspaper says it has verified the vulnerability still exists.
Despite being a mainstream messaging app, WhatsApp has gained praise from security experts for implementing the respected end-to-end encryption Signal Protocol across its platform — completing its roll out of end-to-end encryption in April last year. Yet the company’s code remains closed source, which means users have always been required to trust its claims with no ability for external audits of its code (although it’s also worth noting that WhatsApp did work with Open Whisper Systems (OWS), the organization behind the Signal Protocol, to implement the e2e crypto across the platform).
The security issue identified by Boelter , and reported on by the Guardian now following him giving a talk about it at the end of last month, concerns an aspect of WhatsApp’s Signal implementation that allows it to force the generation of new encryption keys for offline users. This is described as a “retransmission vulnerability” by Boelter, and claimed as a route for messages to be intercepted and read — and thus as a potential backdoor in WhatsApp’s end-to-end encryption.
However WhatsApp denies the backdoor characterization, saying it’s a design decision relating to message delivery, with new keys being generated for offline users in order to ensure messages don’t get lost in transit.
“The Guardian posted a story this morning claiming that an intentional design decision in WhatsApp that prevents people from losing millions of messages is a “backdoor” allowing governments to force WhatsApp to decrypt message streams. This claim is false,” said a company spokesperson in a statement sent to TechCrunch.
“WhatsApp does not give governments a “backdoor” into its systems and would fight any government request to create a backdoor. The design decision referenced in the Guardian story prevents millions of messages from being lost, and WhatsApp offers people security notifications to alert them to potential security risks. WhatsApp published a technical white paper on its encryption design, and has been transparent about the government requests it receives, publishing data about those requests in the Facebook Government Requests Report,” it added.
WhatsApp/Facebook details its responses to government requests for user data here .
Multiple security commentators have also pointed out that the vulnerability being flagged here is nothing new — but rather a rehashing of the long-standing issue of how key verification is implemented within an encrypted system.
In an earlier statement WhatsApp pointed out that its implementation of the Signal protocol includes an optional “Show Security Notifications” setting that will notify a user when a contact’s security code has changed — thereby allowing users to opt in to be notified when/if a key has been changed (and thus when/if there’s a risk of their messages being man-in-the-middle intercepted).
At the time of WhatsApp completing its implementation of the Signal Protocol, OWS’ Moxie Marlinspike also explained that the implementation offers users an “opt in to a preference which notifies them every time the security code for a contact changes”.
He also pointed to a white paper on the WhatsApp Signal Protocol implementation which further states: “WhatsApp servers do not have access to the private keys of WhatsApp users, and WhatsApp users have the option to verify keys in order to ensure the integrity of their communication.”
In the same blog post Marlinspike argued that WhatsApp users would now get “all the benefits” of “a modern, open source, forward secure, strong encryption protocol for asynchronous messaging systems, designed to make end-to-end encrypted messaging as seamless as possible”. The Facebook-owned messaging platform has more than a billion monthly active users at this point.
Contacted by TechCrunch about the Guardian article, Marlinspike was clearly unimpressed with their characterization of WhatsApp’s key verification system as a security issue — describing the story as “supremely inaccurate”.
But Katriel Cohn-Gordon, one of the group of international security researchers who audited the Signal Protocol , was less dismissive, describing the issue flagged by Boelter as “nontrivial” — although he did not go so far as to call it as a backdoor, and described the newspaper’s report as “relatively strongly worded”.
(For clarity, the researchers’ analysis of the Signal Protocol found the underlying protocol to be lacking in any logical errors — but did not study the security of the implementation of the protocol. And its WhatsApp’s implementation of Signal that people are quibbling about here.)
Whether WhatsApp’s key verification process/”nontrivial” bug is an intentional security backdoor or a design decision with a user opt-out depends on your perspective. But arguably the platform’s biggest security flaw remains not open sourcing its code to allow for external audits — not least given that its parent company, Facebook, has a business model based on monetizing the personal information of users via profiling their preferences and targeting them with ads.
Alan Duric, co-founder and CTO at another mobile messaging app, Wire , whose end-to-end crypto, proteus is open sourced — and is also based on Axolotl, the forerunner to the Signal Protocol — wastes no time in pointing out that outsiders can test its security claims, unlike WhatsApp’s, which users rather have to take on trust. Wire is in the process of having its proteus protocol audited by a security outsider, according to a spokesman.
“Wire does not regenerate encryption keys,” Duric tells TechCrunch. “Once the key fingerprints have been verified by users changes in keys will be detected on both ends and shown to the users. Wire is transparent in how it works and because all code is open sourced it doesn’t take 8 months to discover, disclose and fix security issues.”
“By embracing open source we are always a step ahead of situations like these as there are thousands of developers who’ve looked at our code in GitHub and many have analysed it in more depth,” he adds.
We asked Boelter for his views on whether the retransmission vulnerability was created intentionally by WhatsApp, i.e. to be a backdoor for access to data (whether for Facebook or government agencies), or is an accidental byproduct of design decisions vis-a-vis message delivery — and he argues both sides.
“If someone would demand WhatsApp to implement a backdoor, you might expect them to implement something more obvious. Like responding with the history of all conversations when triggered to so do with a certain secret message. Furthermore, this flaw can be explained as a programming bug. Just a missed “if” statement for one of the corner cases. It is a type of flaw that is not necessarily introduced by malice,” he says.
“However, Facebook showed no interest in fixing the flaw since I reported it to them in April 2016. So maybe it was a bug first, but when discovered it got started being used as a backdoor.”
“WhatsApp has stated recently that this is not a bug, it is a feature! Because now senders don’t have to press an extra ‘OK’ button in the rare case they sent a message, the receiver is offline and has a new phone when coming back online. That’s not a very good argument! And if “Privacy and Security is in [WhatsApp’s] DNA”, they should have fixed the flaw immediately after I reported it in April 2016,” he adds.
Boelter further noted that while the WhatsApp server can re-announce the “old, correct, private key of the recipient to the sender” — i.e. if the sender has opted in to receive the “Security Code has changed” notifications — the conversation can still continue “uninterruptedly”. Ergo, it relies on users both noticing and understanding the privacy risk implication of the notification, given that communication after a key has changed is not actively blocked by WhatsApp (as it is by the Signal messaging app , for example).
“WhatsApp can also opt to correctly deliver messages for a while without informing the sender that the messages have been delivered correctly. And only after a while trigger the key-switch,” he adds.
Which secure messaging app does Boelter recommend using? “I use Signal,” he says. “Signal is open source. Signal makes an effort to have reproducible builds. Signal claims to store much less metadata on their servers than WhatsApp allows itself in their privacy policy. And Signal is just as easy to use as WhatsApp.”
In his April analysis of WhatsApp’s Signal implementation, Boelter further wrote: “Proprietary closed-source crypto software is the wrong path. After all this — potentially malicious code — handles all our decrypted messages. Next time the FBI will not ask Apple but WhatsApp to ship a version of their code that will send all decrypted messages directly to the FBI.”
This report was updated with additional comment

© Source: http://feedproxy.google.com/~r/Techcrunch/~3/_LV0sm6fTss/
All rights are reserved and belongs to a source media.

Moments after Nintendo of America president Reggie Fils-Aimé finishes his presentation, another exec takes the stage to announce how things will go. The room is broken up into different sections, each following a staff member with Mario character on a placard. We’re each ushered off to a game – some semblance of organization before it all invariably erupts into chaos.
It’s inevitable, of course. A few minutes later, members of the press are screaming at screens and elbowing their way in to be among the first to play the new Zelda game on the upcoming console.
Last night’s unveiling was all news – pricing, availability, specs. Today’s event is about actually experiencing the thing. Being one of the first to try the strange new console in practice, in all of its strange, convertible forms.
There are games stationed around the space, laid out in two rooms of a Manhattan loft space, from proprietary titles like Mario Kart 8 Deluxe and the aforementioned Zelda title, Breath of the Wild (which had its gameplay debut for the Wii U back in June at E3) to perennial third-party favorites like Street Fighter II and Arms, a slightly more family friendly take on the classic fighting game.
Most stations just stand up TV and living room settings, but there are a few more creative takes, as well, like a fake airplane interior, complete with animated clouds, a cross section of a VW bus, and a small faux greasy spoon, called the “M Diner” run by some Italian plumber.
There are Nintendo reps waiting at each of the stations – standard practice for gaming demos, though in many cases requiring more than the standard explainer. Even games like Street Fighter, which the vast majority in the room can likely play blindfolded through multiple decades worth of muscle memory, require a sort of preface regarding precisely how the title is played.
After all, the Switch is Nintendo’s great new gamble – an everything and the kitchen sink console designed to learn from the stated mistakes of the Wii U, while bringing together positive lessons from both it and its predecessors. The result is a system that can be played countless different ways – as both a sit down living room console, a portable (if slightly unwieldy) system and everything in between.
It’s an impressive bit of diversity on display, but it also means that the majority of gamers of different sorts of skill levels will inevitably require a sort of hand holding, as it’s not immediately clear which game takes advantage of which technology. And from the sound of Nintendo’s blue sky plans for the system, there’s still a heck of a lot of potential yet to be unlocked with the titles.
The ten or so games on display at today’s event certainly showcase some of that versatility, but as Fils-Aimé noted in his brief (and largely reiterative of last night) address ahead of the event, there are some 50 developers currently working on the platform, with 80 titles in the pipe. The Switch may have something of a title problem when it launches in a month and a half, but if all goes according to plan, the issue should be addressed fairly soon – hopefully in the lead up to next holiday season.
Unsurprisingly, one of the best displays of the tech is one of the newest titles: Arms, a brightly colored, cartoonish take on the classic fighting game. The player slips the two Joy-Cons off the side of the console and holds each in a hand, a la the WiiMote. The game plays out on a split screen, each from the first-person point of view of the player.
As with the Wiimote, the player uses to Joy-Con to punch. It was fun and a bit of a work out – and maybe it means that the whole notion of getting a workout while playing a video game outside of the VR world isn’t dead after all. Street Fighter Ultra II, meanwhile, represents the other side of the spectrum, utilizing a standard gamepad (not the Joy-Con Grip) for pretty straight-forward control – it was one of the few titles on display that required no explainer whatsoever.
In demo gameplay, the whole thing works pretty seamlessly. The heart of the system is the 6.2-inch touchscreen tablet. Slip it into the dock and the TV recognizes the signal after a few seconds. Pull it out, and it immediately shows up on the device for gameplay.
The Joy-Controls, meanwhile, slip easily between the sides of the tablet and the Joy-Con Grip. Gameplay directly on the tablet is a bit unwieldy, as anticipated, but it’s definitely useable – assuming, of course, you’re not on, say, a crowded train – that’s more Super Mario Run territory.
Multiplayer gaming has long been Nintendo’s bread and butter, and that’s no expectation here. My Splatoon 2 demo involved a full eight people. The Mario Kart gameplay was a bit more intimate, with two players grabbing a small Joy-Con, transforming it into a sort of microcontroller.
The Switch ultimately has a herculean task ahead of it. It must simultaneously serve as the company’s living room and portable consoles, while making up ground lost to the Wii U – arguably its biggest home gaming misfire. Nintendo’s certainly got all the tools in place here for an incredibly versatile and fun offering.
For now, it’s a bit a slow start — with only two proprietary titles at launch and lots of questions surrounding its online offerings. A rep I spoke with compared it to the N64 — a console that had limited launch titles, but is now remembered fondly. Not exact the explosive first impression the company was likely hoping to make following the missteps of the Wii U.
As long as the aforementioned developers and Nintendo itself are able to fully utilize the technology present, Switch will be a veritable hit. The hardware is definitely there. The company will require a bit of education to really let the console’s full potential sink in. If all goes according to plan, it might be a small burn, but a meaningful one.

© Source: http://feedproxy.google.com/~r/Techcrunch/~3/WBH1UA-zYYk/
All rights are reserved and belongs to a source media.

The World Economic Forum — held in the mountain village of Davos, Switzerland every year — is increasingly attended by technology companies. And this year the theme of ‘responsible governance’ for the WEF conference is clearly going to be high on the agenda, especially in the era of ‘fake news’ and Brexit.
Software might be ‘eating the world’ but we’re now also living in a world where governments don’t set the political agenda anymore, bots do .
And the WEF has noticed. It’s now set up its own tech hub in San Francisco to monitor the tech revolution up close.
So, if you would like to meet me at Davos, then just fill out this form. I’ll also be hanging out at ‘The Embassy’ venue put together by Stromback.

© Source: http://feedproxy.google.com/~r/Techcrunch/~3/VQH00Axohpo/
All rights are reserved and belongs to a source media.

In what is clearly a (very cool) publicity stunt, Match is opening a pop-up coffee shop where it will 3D print the face of single users on the foam of your latte.
Specifically, you’ll be able to show up and pick your drink – each will feature one of eight single Match users – four male and four female. Your drink will then come with their face 3D-printed on your coffee, and the cup will have more information on the person, including a link to their Match dating profile.
You’ll also be able to get your own face printed on a cup of coffee, in case you want to hand it off to someone you’re interested in.
Match is calling the event “expresso yourself”, and it will go down next Thursday and Friday (January 19th & 20th) at Boxpark in London’s Shoreditch neighborhood.
The 3D-printing is being powered by Coffee Ripples , a startup that makes a machine dedicated to 3D printing images on foam lattes. To create the designs the machine dispenses a powder that consists of ground up coffee beans, which means it won’t change the flavor of your drink.
The startup, which launched last year, is currently shipping units mainly to smaller independent coffee shops. The device is about the size of your average 3D printer, and comes with a built-in touch screen to input your selection after you put a latte down on the print surface.

© Source: http://feedproxy.google.com/~r/Techcrunch/~3/qkJbOX4qfJw/
All rights are reserved and belongs to a source media.

According to a new year-end report from Sensor Tower detailing the top apps of 2016, streaming services dominated when it came to which apps, outside of games, pulled in the most revenue over the past year. At the top of the list is Spotify, which not only scored the number one spot on the iTunes App Store, but also was the number one revenue earner across both platforms, including both the App Store and Google Play.
Meanwhile, thanks to chat app LINE’s traction on Android, it ranked as the number two app by revenue overall, followed by Netflix, Tinder, Pandora, then HBO NOW.
Hulu also made an appearance on the list, as the No. 9 app by revenue overall, and No. 7 on the App Store.
The list indicates that the trend toward cord cutting – shifting attention away from linear television to streaming services – is still going strong, as is the growth of subscription-based streaming of music.
That being said, ranking high on the App Store’s revenue charts is one thing, but translating that into a profitable business is still a challenge.
Case in point: earlier this week, Pandora announced it was laying off around 7 percent of its U. S. workforce, despite having grown its business to include over 4.3 million paid subscribers. But the older music streaming service is today facing new competition from the likes of Apple Music and Spotify.
And in the video streaming market, the newer over-the-top service HBO NOW is also still working to become profitable. With just over one million subscribers as of year-end, HBO NOW may have earned its No. 6 spot as one of the biggest apps by revenue, but the $15/month price point is still keeping many customers, including millennials, away.
To make the service more appealing, HBO said in December it would increase its original programming by 50 percent to 600 hours annually, and it has cut the cost of the service to just $5 on the newest TV streaming service, DirecTV Now.
Elsewhere on the top revenue charts, is the standout hit LINE Manga, LINE’s comic reader and storefront which launched in 2015. The app made an appearance on all three charts – No. 5 on Google Play, No. 8 on the App Store, and No. 7 Overall.
The fourth quarter is historically a big revenue driver, thanks to holiday sales of new devices. This remained true in 2016, where worldwide net revenue from both apps and games across both platforms reached $8.7 billion. That’s up 67 percent from the $5.2 billion seen in Q4 2015.
The report also examined the top non-game apps by downloads, which led to fewer surprises.
As others reported previously, apps like Facebook, Messenger, WhatsApp, YouTube, Snapchat and Instagram made the list of 2016’s top applications , and they did so again on Sensor Tower’s list.
The most notable entry here is Uber, which came in at No. 9 overall and No. 7 on the App Store, following a year of expansions both in the U. S. and in more locations around the globe.
Throughout the year, said the report, there were more than 80 billion new app downloads in total.
The lists were compiled were compiled by app store intelligence firm Sensor Tower. Its findings may ultimately differ from rivals, like App Annie, because of the way these firms generate their data. However, it will be a useful point of comparison going forward, as more year-end lists continue to emerge in the weeks ahead.

© Source: http://feedproxy.google.com/~r/Techcrunch/~3/tsHJP0O0xh4/
All rights are reserved and belongs to a source media.