Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reporting a user to WhatsApp forwards a copy of recent messages from that chat

wabetainfo.com

Post reply on HN
Print view View original

151–160 of 173 posts

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#151

Post by beagle3 »

arp242 wrote: post #86
keyme wrote: post #38

Earlier quoted context omitted.

There is no "official" way for you to download it. IIRC it is stored in your Google Drive under an API key that is dedicated to whatsapp (in some kind of per-app storage). I don't really know much about Google Drive API. However, I am fairly sure that the key is in the binary on your phone, so it shouldn't be much of a challenge to get access. I think there was something like this on Github once, that no longer works…

I tried it, but I can't seem to get it to work. Possibly because I don't know the "device ID" of my Android phone since I lost it. I got an iPhone SE and turns out I can't really import the Android backup on an iPhone, and there's no way to access it either. Some backup. Damnit why is everything related to mobile so needlessly fecking difficult. I just want to read some damn plain text files that are right there but…

There are 3rd party products who convert WA data from iOS to Android and vice versa (and also, you might be able to get your data using a new android device or even android installed in a VM).

The main problem here is that like everything FB related, you are the product, not the customer At least, I haven't found any reasonable explanation about why Google and Apple get an unencrypted copy of your chat history but you can't. (And not for lack of trying - there are always ridiculous answers on Reddit and HN about "but if you could read your messages, so can the bad guys")

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#152

Post by ryukafalz »

vlovich123 wrote: post #146
ryukafalz wrote: post #92

Earlier quoted context omitted.

I mean, sure, we're not there yet. If the Guix folks are able to get a bootstrap path going all the way from something like stage0, though, we'll be in a pretty good place I think: http://bootstrappable.org/projects/mes.html Maybe the current state is closer to WhatsApp than where we'd really like to be, but that should be a challenge rather than a reason to give up.

Never said anyone should give up but my point is that to my knowledge there's no actual proof of how to solve this. We're just stumbling in the dark trying ideas. I'm curious if you've actually had a chance to read Ken Thompson's compiler virus hack. The Guix bootstrap path from stage0 still doesn't solve the problem as at the end of the day all compilers eventually self-host from a previous version. So whatever comp…

>The Guix bootstrap path from stage0 still doesn't solve the problem as at the end of the day all compilers eventually self-host from a previous version. So whatever compiler you're using for stage0 can have the virus, inject it into the produced binary, & you'll never find it since the virus is in the binary not in the source.

The point of stage0 is that it doesn't need to be compiled, only assembled, and that it's small enough to inspect the binary or assemble it by hand if you really wanted to. (Not that you necessarily want to, but if you have to...)

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#153

Post by whatyesaid »

rowanG077 wrote: post #66
whatyesaid wrote: post #61

Earlier quoted context omitted.

If I pulled up the conversation on my phone and showed you the display, it's a bit more than just a fake Photoshopped screenshot.

How so? Editing a video to do that is not any harder than photoshopping a screenshot.

It can all be faked with a lot of effort, but proving it's an effort beyond F12 is just a refresh. But if you're going to such extremes you wouldn't trust server data/logs at all either, you don't know if they've been manipulated or not. You wouldn't trust anything, so the whole thing itself doesn't matter unless you had them say it directly to you.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#154

Post by Gabrielfair »

pw6hv wrote: post #28
keyme wrote: post #16

Just FYI, the Google Drive backup of your "E2E encrypted" whatsapp messages is stored in plain text... https://faq.whatsapp.com/android/chats/about-google-drive-ba...

So it is not only Facebook that has complete access to the message history, but also Google. The funny thing is that I cannot find a way to access that backup myself, is anyone aware of a method to download that backup as a data dump and inspect it?

Thanks for pointing this out. I suspect this why Google agreed to store all the backup data of a competing company for free. Google would have had no interest in storing Facebook's end-to-end encrypted data for free unless it could read it and possibly resell it back to Facebook.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#155

Post by vlovich123 »

ryukafalz wrote: post #152
vlovich123 wrote: post #146

Earlier quoted context omitted.

Never said anyone should give up but my point is that to my knowledge there's no actual proof of how to solve this. We're just stumbling in the dark trying ideas. I'm curious if you've actually had a chance to read Ken Thompson's compiler virus hack. The Guix bootstrap path from stage0 still doesn't solve the problem as at the end of the day all compilers eventually self-host from a previous version. So whatever comp…

>The Guix bootstrap path from stage0 still doesn't solve the problem as at the end of the day all compilers eventually self-host from a previous version. So whatever compiler you're using for stage0 can have the virus, inject it into the produced binary, & you'll never find it since the virus is in the binary not in the source. The point of stage0 is that it doesn't need to be compiled, only assembled, and that it's…

Are you referring to https://github.com/oriansj/stage0? This stage0 gets you a basic C compiler. An impressive achievement for sure. I don’t see how it really solves anything though.

More generally each language would need it’s own path from this basic assembler to a compiler implementing that language in C which doesn’t necessarily exist. While initial versions of the Rust compiler were written in C, more recent versions are self hosted and rely on the previous version. This goes for projects like LLVM too since it requires a c++14 compiler to start with.

A better approach is to figure out how to cross compile stage0 and how to make sure the cross compilation step can be trusted. Going the approach of trying to build a “trusted” path from source is noble but IMO ultimately futile.

This is what I mean when I say this as an unsolved problem. It may be getting better but there are fundamental unsolved challenges to this exploration and very little guarantee the task can be accomplished in the first place (ie no mathematical theory that might present a path to follow rather than just trying to accomplish it through sheer effort). Some small part of the problem might get solved but that’s very different from saying that any package will be verifiable in this way.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#156

Post by varispeed »

est31 wrote: post #19
varispeed wrote: post #13

Earlier quoted context omitted.

Does it mean messages can be read without agreement? Let's imagine "a glitch" where operator sees that user has opt in, but they didn't - can they see messages?

I don't know the implementation on the client, but in theory it can be implemented locally on the client only, and I made the above statements under the assumption that it's how it's implemented. The user issues the report command in the UI and the client takes its local copy and uploads it to the server as part of the report. So it's mainly a convenience feature. The only case where the current E2EE security model i…

So is there a way to capture user's screen without user knowing and essentially bypassing the end to end encryption altogether? (the images would be sent to a different endpoint for example)

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#157

Post by steveklabnik »

vlovich123 wrote: post #155
ryukafalz wrote: post #152

Earlier quoted context omitted.

>The Guix bootstrap path from stage0 still doesn't solve the problem as at the end of the day all compilers eventually self-host from a previous version. So whatever compiler you're using for stage0 can have the virus, inject it into the produced binary, & you'll never find it since the virus is in the binary not in the source. The point of stage0 is that it doesn't need to be compiled, only assembled, and that it's…

Are you referring to https://github.com/oriansj/stage0 ? This stage0 gets you a basic C compiler. An impressive achievement for sure. I don’t see how it really solves anything though. More generally each language would need it’s own path from this basic assembler to a compiler implementing that language in C which doesn’t necessarily exist. While initial versions of the Rust compiler were written in C, more recent ve…

No version of the rust compiler was ever written in C. The initial version was in OCaml, then bootstrapped to Rust itself.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#158

Post by [deleted] »

hannasanarion wrote: post #137
dang wrote: post #133

Earlier quoted context omitted.

The problem is that you submitted the post with a misleading title. "WhatsApp can now read your recent messages when you report a user" implies that they've acquired some new power to read user data when in reality it's you who are forwarding them a copy, for the obvious reason that reporting a user would be meaningless without that.

They didn't get a copy of your messages with a report until today. This is a meaningful change.

[deleted]

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#159

Post by eitland »

Maybe this is the time that people understand that even perfect E2E-encryption doesn't mean anything if you cannot either somehow trust (for some level of trust) the entity who produces the endpoint - or perfectly control your endpoints at a network protocol level.

Yes, they cannot get the messages from the wire, but they are brazen enough to introduce (more[1]) ways to get hold of your messages anyway.

I used to be a "living billboard" for WhatsApp until Facebook bought them and I am sad to say I was correct: they didn't spend 17bn on WhatsApp and then remove the revenue stream from it just because of the goodness of their hearts :-/

[1]: They already upload your messages in an unencrypted file to either Google Cloud or iCloud anyway if you don't actively turn it off - and get all your contacts to do the same.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#160

Post by Fnoord »

gruez wrote: post #114
Fnoord wrote: post #95

Earlier quoted context omitted.

It is a bold claim, indeed. What about WhatsApp Web though? I wonder how that works. I guess it connects to the device via a 3rd party (Facebook's) to send the data over HTTPS? Does it use public-key authentication where the key is only known to the WhatsApp Web client? Either way, it is a compromise on E2EE.

>I wonder how that works. I guess [...] Either way, it is a compromise on E2EE. How about instead of guessing and concluding it must be compromised (argument from ignorance), you do a cursory search and get an actual response? https://security.stackexchange.com/questions/148321/how-does...

I suggest you read the guidelines for this website [1]

> Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community.

As for your link, I'm aware how they claim it works, and even if that is all true (we can't audit the source code), then it is still a compromise of E2EE. E2EE is between two devices, a receiver and a sender. The third device also able to receive, without the sender knowing or agreeing about it, is dangerous. Why? Because you can't know for sure the receiver has access to both machines. If you consider laptop and PCs are much less safe than mobile devices, then the danger is obvious.

[1] https://news.ycombinator.com/newsguidelines.html

Post reply on HN