Cyber Saiyan�www.cybersaiyan.it
2200
600
1500
750
600
im irl
TL;DR instant messengers in real life
Cyber Saiyan
di cosa parliamo
app di messaggistica
💁♀️
🙋♂️
🙆
🎊
👨🎤
🦸♀️
💂♀️
🏢
di cosa parliamo
who? Gerardo Di Giacomo
security engineer @ stripe
sicurezza informatica dal 2002
membro Cyber Saiyan
@gedigi
⚠️ DISCLAIMER ⚠️�ex security engineer @ Signal messenger�ex security engineer @ WhatsApp
who? TheZero
security researcher @ Shielder SRL
ex-maintainer KeePassXC && ex-contributor F-Droid
ctf player in pensione (jbz, pequalsnp...)
who? Enrico Ferraris
avvocato
data Protection & Freedom of Information
“background tecnico”
@ebobferraris
Cambio Policy di WhatsApp
“WhatsApp invierà i dati a facebook!” (2021)
“WhatsApp diventerà a pagamento!”�(2017)
cosa è previsto in Europa...
“Today, Facebook does not use your WhatsApp account information to improve your Facebook product experiences or provide you more relevant Facebook ad experiences on Facebook. This is a result of discussions with the Irish Data Protection Commission and other Data Protection Authorities in Europe. We're always working on new ways to improve how you experience WhatsApp and the other Facebook Company Products you use. Should we choose to share such data with the Facebook Companies for this purpose in the future, we will only do so when we reach an understanding with the Irish Data Protection Commission on a future mechanism to enable such use. We'll keep you updated on new experiences we offer and our information practices.”
...e nel resto del mondo
“As part of the Facebook Companies, WhatsApp receives information from, and shares information with, the other Facebook Companies. We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings, including the Facebook Company Products. This includes:�- improving their services and your experiences using them, such as making suggestions for you (for example, of friends or group connections, or of interesting content), personalizing features and content, helping you complete purchases and transactions, and showing relevant offers and ads across the Facebook Company Products”
cosa era previsto prima?
“Facebook and the other companies in the Facebook family also may use information from us to improve your experiences within their services such as making product suggestions (for example, of friends or connections, or of interesting content) and showing relevant offers and ads.”
(Privacy Policy del 25/08/2016, opt-out fino al 24/09/2016)
valida anche in Europa fino al 25/05/2018
su cosa può basarsi un trattamento?
a) consent [...] for one or more specific purposes;
b) for the performance of a contract [...];
c) for compliance with a legal obligation [...];
d) in order to protect the vital interests of the data subject [...];
e1) for the performance of a task carried out in the public interest;
e2) in the exercise of official authority vested in the controller;
f) for the [...] legitimate interests pursued by the controller [...]
(GDPR art. 6)
consenso ToS ≠ consenso al trattamento
“We may amend or update these Terms. Unless otherwise required by law, we will provide you at least 30 days' notice of amendments to our Terms, which will give you the opportunity to
review the revised Terms before continuing to use our Services. [...] Your continued use of our Services following the notice period of planned changes confirms your acceptance of our Terms, as amended.
We hope you will continue using WhatsApp, but if you do not agree to our Terms, as amended, you must stop using our Services by deleting your account.”
quali trattamenti basati sul consenso?
“For collecting and using information you allow us to receive through the device-based settings you enable (such as access to your location, camera, or photos), so we can provide the services described when you enable the settings; for example, sharing your device’s precise location information if you are using our location features to share your location with your contacts or accessing your camera or photo gallery if you choose to share photographs or media with your contacts.”
→ gli altri trattamenti si fondano sull’esecuzione del contratto e sul legittimo interesse
quando Facebook tratta dati di Whatsapp
quando Facebook tratta dati di Whatsapp
flusso dati user-user vs user-business
“To understand how a business processes your information, including how it might share your information with third parties or Facebook, you should review that business’ privacy policy or contact the business directly.”
💁♀️
🙋♂️
🏢
💁♀️
controller
controller
processor
data subj.
data subj.
data subj.
processor
ℹ️ 📄
ℹ️ 📄
Questione Legale o anche Tecnica?
cosa ha richiesto il cambio di policy?
“WhatsApp Security Whitepaper” v3 - Ottobre 2020
https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf
cosa ha richiesto il cambio di policy?
definizione di end-to-end encryption
End-to-end encryption is a system of communication where
the only people who can read the messages are the people communicating. No eavesdropper can access the cryptographic keys needed to decrypt the conversation—not even a company that runs the messaging service.
Hacker Lexicon, Wired, 2014
💁♀️
📃🔑
🕵️♀️
🙋♂️
📃🔑
definizione di end-to-end encryption
End-to-end encryption is a system of communication where
the only people who can read the messages are the people communicating. No eavesdropper can access the cryptographic keys needed to decrypt the conversation—not even a company that runs the messaging service.
Hacker Lexicon, Wired, 2014
💁♀️
📃🔑
🕵️♀️
🙋♂️
📃🔑
🚫
user to user
user to business (WhatsApp Business API)
user to business (WhatsApp Business API)
user to business (via Facebook partner)
user to business (esempio Zendesk)
user to business (gestito da Facebook)
“In 2021, organizations who use the Business API will be able to designate WhatsApp’s parent company, Facebook, as the vendor that operates the Business API endpoint on their behalf. Since such messages are not delivered directly to an endpoint controlled by the organization, WhatsApp does not consider chats with organizations who choose to use Facebook to operate their API endpoint to be end-to-end encrypted.”
“encryption has no off switch”
“The WhatsApp server has no access to the client’s private keys, though if a business user delegates operation of their Business API client to a vendor, that vendor will have access to their private keys - including if that vendor is Facebook.”
“displaying end-to-end encryption status”
“Across all our services, WhatsApp makes the end-to-end encryption status of a chat clear. If the user’s phone sees that it’s communicating with an API endpoint that delegates operation of its API to a vendor, the phone will display this to the user. The user can also double check the encryption status within the chat or in the business info section of their app.
These changes will take effect in all WhatsApp versions after January 2021.”
“displaying end-to-end encryption status”
l’utente riceve delle “notifiche”/avvertimenti quando:
Threat Modeling
threat modeling
“analyzing representations of a system to highlight concerns about security and privacy characteristics”
architettura tipica app
mobile app
server storage
server
backup
mobile storage
backup storage
💁♀️
💁♀️
architettura tipica app
mobile app
server storage
server
backup
mobile storage
backup storage
💁♀️
💁♀️
mobile app
server storage
server
backup
mobile storage
backup storage
metadati
contenuti
💁♀️
💁♀️
mobile app
server storage
server
backup
mobile storage
backup storage
💁♀️
💁♀️
metadati
contenuti
❓
✅
✅
mobile app
server storage
server
backup
mobile storage
backup storage
💁♀️
💁♀️
metadati
contenuti
❌
✅
WhatsApp consumer
server
mobile app
💁♀️
mobile app
💁♂️
contenuti
✅
✅
WhatsApp business via facebook
server
mobile app
💁♀️
wa biz app
❌
contenuti
Telegram
mobile app
server storage
server
backup
mobile storage
backup storage
metadati
contenuti
💁♀️
💁♀️
Telegram
mobile app
server storage
server
backup
mobile storage
backup storage
metadati
💁♀️
💁♀️
contenuti
❌
❓
Telegram chat segrete
mobile app
server storage
server
backup
mobile storage
backup storage
💁♀️
💁♀️
metadati
contenuti
✅
✅
Telegram
mobile app
server storage
server
backup
mobile storage
backup storage
metadati
💁♀️
💁♀️
contenuti
❌
❓
Signal
mobile app
server storage
server
backup
mobile storage
backup storage
metadati
contenuti
💁♀️
💁♀️
Signal
mobile app
server storage
server
backup
mobile storage
backup storage
💁♀️
💁♀️
metadati
contenuti
✅
✅
Signal
mobile app
server storage
server
backup
mobile storage
backup storage
metadati
💁♀️
💁♀️
contenuti
✅
✅
protezione contenuti
messaggi e2ee | messaggi e2ee | messaggi e2ee |
chiamate a/v e2ee | chiamate a/v e2ee | chiamate a/v e2ee |
backup locale | no backup | backup cifrato |
solo chat segrete
media in chiaro su android
solo chat segrete
protezione metadati
localizzazione precisa e2ee | localizzazione precisa e2ee | localizzazione precisa e2ee |
private contact discovery | numero non visibile (username) | |
secure value recovery | | |
sealed sender | | |
solo chat segrete
Your choice
Question time
Questions?