google hacking in title index of whatsapp databases

Extracting keychain secrets from a iOS device requires brute-forcing the lock screen password.īruteforcing the 4-pin digit is easy 'math-wise', but complicated in practice because you can't really access the data on the flash (not even dumping it, as it's fully encrypted with a hardware key), and the device will not pair to a new PC/Mac without first unlocking so you would also need physical access to a paired PC/Mac.įor the newest devices, fingerprints can't really be bruteforced (not because of complexity, but the because the hardware locks down burning its secret after a few attempts) and Apple advises using a complex password as a fallback for the fingerprint basically the password is the real secret for encryption, while the fingerprint hw just holds a temporary unlock secret which selfdestroys if bruteforced this is why the user is always required to enter the password after a reboot. This is about the most fundamental security measures, like if you connect to your server use TLS (and check the certificate) or if you encrypt something don't use the same key everywhere.ĭepends on the definition of 'fully safe', or maybe 'device'. We are not even talking about difficult usability decisions here where strong end-to-end encryption has to be visible in the user interface to allow fingerprint checking. Good luck getting your friends to use it. > If you want security, there are apps for that.

Especially after you have been criticized for your bad security for years. You would think that for a market value of 19x10^9 dollar you could afford to hire a single cryptographer or IT security specialist. Even their new protocol looks like it has been hacked up by someone who learned his/her cryptography by 5 hour wikipedia reading.

How hard would it have been to generate a random key and save the key on the internal storage?Īn other example is the transport, i.e. They seem to have tried to prevent such kind of attack by encrypting the data on the SD Card with a static key. They have consistently shown to be unable to implement any kind of effective cryptography.

Google hacking in title index of whatsapp databases