Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reporting a user to WhatsApp forwards a copy of recent messages from that chat

wabetainfo.com

Post reply on HN
Print view View original

81–90 of 173 posts

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#81

Post by ffpip »

merlinscholz wrote: post #79
ffpip wrote: post #31

Earlier quoted context omitted.

I don't know if it is included in your Google takeout. 98% of users enable that option. The fact that whatsapp is e2ee is a complete lie. Use Signal for true e2ee, or if you don't like it, Telegram. Telegram stores everything in the cloud tho. (they haven't disclosed any private messages, and are much more trustworthy than Whatsapp). They just wanted to back up messages without giving it to Google/Apple

Isn't telegram by default not encrypted? I thought only "private" chats are being e2ee.

Yes. That is what 'stores everything in the cloud' means.

Even the e2ee thing is not audited properly.

They are just more trustworthy, have open source apps, better usability [ and unlimited storage :) ] .

Signal > Telegram > Whatsapp

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#82

Post by sneak »

gonehome wrote: post #73
sneak wrote: post #49

Earlier quoted context omitted.

> As much as I like E2EE, I don't see where the problem lies? It's a step along a continuum where the end-to-end encrypted messenger wasn't uploading plaintext before, and now it is. Apple's similar previously end-to-end encrypted iMessage went through a similar evolution: now iOS uploads the complete iMessage plaintext history to Apple (with Apple keys) via iCloud Backup. We now know that Facebook deems it okay to e…

Is the iCloud bit true? I've read HN comments about it, but when I've tried to understand it by searching around it looks like it is encrypted end-to-end and in iCloud backup (as long as you're not in China). https://support.apple.com/en-us/HT209110#:~:text=We%20design... . https://support.apple.com/en-us/HT202303 Is there some subtlety I'm missing? That said, on this particular issue I think FB is striking a pretty…

HT202303 has a list of things that are end-to-end encrypted. iCloud Backup is not in that list. Furthermore, it says:

> Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple.

Note that all of the following are entirely different services:

- iMessage (nominally e2e)

- Messages in iCloud (e2e, but with the key stored in iCloud Backup if enabled) - this is a way of synchronizing iMessages across all of your devices (independent of backups)

- iCloud Backup (not e2e)

iCloud Backup is backing up either iMessage plaintext (if Messages in iCloud is off) or iMessage decryption keys (if Messages in iCloud is on), to Apple keys. In private conversations with Apple employees, I understood that this was to be fixed, but then the fix was never released. Then I read this:

https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

You can test this state of affairs trivially:

1. Get an iPhone, turn on iCloud Backup and iMessage.

2. Send and receive some iMessages, and do a backup.

3. Throw the iPhone into the river.

4. Call Apple, and claim you forgot your Apple ID password, and need to reset it. They will verify your identity using other information, and reset your Apple ID password.

5. Get a new iPhone. Log in with your reset Apple ID password, and restore from backup.

6. See message plaintext, decrypted with no key from you, your password, or your now-riverbed-domiciled old phone.

Apple can decrypt full iCloud Backups without the user's password, or the user's device. These backups contain message history, message attachments, and iMessage decryption keys (which can be used to decrypt iMessage ciphertext which has already transited Apple's iMessage service).

Apple is very careful not to ever explicitly lie, but to also say things in such a way that leads people to believe things (that benefit Apple) that aren't strictly true. HT202303 is a very good example of that style. If you don't have a detailed understanding of the different services ("iMessage", "Messages in iCloud", "iCloud Backup", et c) then you will likely misunderstand the statements.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#83

Post by that_guy_iain »

WhyNotHugo wrote: post #22

I hate Facebook and WhatsApp as much as anyone else who cares about privacy. But there's nothing wrong in this particular change. It happens when you report someone as spam, and you get a clear notification about what's going on. There's a "cancel" button as big as the "report" button, so you can bail out if you disagree.

Also, I think this is kind of needed. For example, if you report a user for sending a dick pic it's kind of important if they were sexting or not.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#84

Post by multjoy »

_vmyf wrote: post #65
personjerry wrote: post #43

Earlier quoted context omitted.

It tells you clearly on the report screen, before you submit, as I recall.

~~Suppose law enforcement reports a user to build a case against them, then the user's message could be subpoenaed right?~~ ~~Even worse, 3 letter agencies~~ Forget I said anything

Yes. Same as any organisation who is sent a copy of the screenshots by the user.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#85

Post by dbrgn »

JohnBerea wrote: post #52
ffpip wrote: post #31

Earlier quoted context omitted.

I don't know if it is included in your Google takeout. 98% of users enable that option. The fact that whatsapp is e2ee is a complete lie. Use Signal for true e2ee, or if you don't like it, Telegram. Telegram stores everything in the cloud tho. (they haven't disclosed any private messages, and are much more trustworthy than Whatsapp). They just wanted to back up messages without giving it to Google/Apple

Shouldn't we prefer Matrix over Signal, since it's federated and doesn't require a phone number / phone to sign up.

Federation is no panacea either, it's also a privacy tradeoff, since the communication metadata is distributed across multiple servers operated by different people (unless you only communicate with people on the same homeserver that hosts your own account).

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#86

Post by arp242 »

keyme wrote: post #38
pw6hv wrote: post #28

Earlier quoted context omitted.

So it is not only Facebook that has complete access to the message history, but also Google. The funny thing is that I cannot find a way to access that backup myself, is anyone aware of a method to download that backup as a data dump and inspect it?

There is no "official" way for you to download it. IIRC it is stored in your Google Drive under an API key that is dedicated to whatsapp (in some kind of per-app storage). I don't really know much about Google Drive API. However, I am fairly sure that the key is in the binary on your phone, so it shouldn't be much of a challenge to get access. I think there was something like this on Github once, that no longer works…

I tried it, but I can't seem to get it to work. Possibly because I don't know the "device ID" of my Android phone since I lost it.

I got an iPhone SE and turns out I can't really import the Android backup on an iPhone, and there's no way to access it either.

Some backup.

Damnit why is everything related to mobile so needlessly fecking difficult. I just want to read some damn plain text files that are right there but it doesn't allow me to access for no reason in particular. I hate everything about mobile so much.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#87

Post by TimWillebrands »

Raphmedia wrote: post #71
aerovistae wrote: post #46

It's pretty hard to imagine a circumstance in which I would be reporting a WhatsApp user. This isn't like a public forum. These are one-on-one conversations or group chats with people who were specifically invited. If someone was a problem, I would just block them. Why would you ever report someone? I haven't ever heard of this happening.

Imagine someone trampling kittens and sending the result to random strangers. Sure, you can ignore them... but the kittens would still keep dying. So you report it and hope for the best. Now change "trampling kittens" for any kinds of unwanted messages.

Report them to the police you mean?

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#88

Post by stronglikedan »

ffpip wrote: post #68
selykg wrote: post #40

Earlier quoted context omitted.

Your wording choice for the title makes it seem otherwise. It makes it sound like it's some big warning or big deal. Perhaps choose your words more carefully?

Please suggest a better title. I'll try to improve. Many users have complained. There is a 80 character limit. Btw I meant it as a warning. Your messages may be uploaded when you report a user

The title is fine. You can't stop people from inferring things (they did), yet insisting you implied anything (you didn't).

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#89

Post by im3w1l »

rapnie wrote: post #54
eldridgea wrote: post #29

Earlier quoted context omitted.

While I share your general suspicion I don't think they need to see the messages to get a lot of privacy-violating use out of WhatsApp. When the NSA was talking about metadata collection, they said it was more useful than actual data. Likely because it's already computer consumable, and less dense. If FB gets your contact lists, and sees who you message, how much, and when, that's probably a hugely valuable commodity…

They might also get info on links you share, as the app makes a request to get the OpenGraph metadata. Who knows.

> the app makes a request to get the OpenGraph metadata

Just to be clear here, is this your speculation or a known thing?

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#90

Post by gonehome »

sneak wrote: post #82
gonehome wrote: post #73

Earlier quoted context omitted.

Is the iCloud bit true? I've read HN comments about it, but when I've tried to understand it by searching around it looks like it is encrypted end-to-end and in iCloud backup (as long as you're not in China). https://support.apple.com/en-us/HT209110#:~:text=We%20design... . https://support.apple.com/en-us/HT202303 Is there some subtlety I'm missing? That said, on this particular issue I think FB is striking a pretty…

HT202303 has a list of things that are end-to-end encrypted. iCloud Backup is not in that list. Furthermore, it says: > Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new…

Thanks - I appreciate the clarity of your comment breaking down the details.
Post reply on HN