Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

121–130 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#121

Post by lukeschlather »

It seems obvious that they can. It's my understanding for FB Messenger that the private key is stored encrypted with a key that is derived from the user's password. So it's not straightforward, but Meta is obviously in a position to grab the user's password when they authenticate and obtain their private key. This would probably leave traces, but someone working with company authorization could probably do it.

For WhatsApp they claim it is like Signal, with the caveat that if you have backups enabled it works like Messenger. Although interestingly if you have backups enabled the key may be stored with Apple/Google rather than Meta, it might be the case that with backup enabled your phone vendor can read your WhatsApp messages but Facebook cannot.

Re: US has investigated claims WhatsApp chats aren't private

#122

Post by quesera »

cosmicgadget wrote: post #100
matthewdgreen wrote: post #88

Earlier quoted context omitted.

I really doubt this. Any such upload would be visible inside the WhatsApp application, which would make it the world's most exciting (and relatively straightforward) RE project. You can even start with a Java app, so it's extra easy.

If you claim REing a flagship FAANG application is "extra easy", either they need to be laughed out of the room or you do.

Reverse engineering is easy when the source code is available. :)

The difference between source code in a high-level language, and AArch64 machine language, is surmountable. The effort is made easier if you can focus on calls to the crypto and networking libraries.

Re: US has investigated claims WhatsApp chats aren't private

#123

Post by londons_explore »

Retr0id wrote: post #73
Retr0id wrote: post #67

Earlier quoted context omitted.

Video decryption+decoding is a well-defined enough problem that you can ship silicon that does it. You can't do the same thing for the UI of a social media app. You could put the entire app within TrustZone, but then you're not trusting the app vendor any less than you were before.

Although now I think about it more, you could have APIs for "decrypt this [text/image] with key $id, and render it as a secure overlay at coordinates ($x, $y)"

Exactly. Thats how DRM video works, and I don't see why you couldn't do the same for text.

Re: US has investigated claims WhatsApp chats aren't private

#124

Post by basch »

solenoid0937 wrote: post #98
barbazoo wrote: post #44

Earlier quoted context omitted.

They likely wouldn’t rate limit themselves, rate limiting only applies when you access through their cute little enter your pin UI.

The PIN is used when you're too lazy to set an alphanumeric pin or offload the backup to Apple/Google. Now sure, this is most people, but such are the foibles of E2EE - getting E2EE "right" (eg supporting account recovery) requires people to memorize a complex password. The PIN interface is also an HSM on the backend. The HSM performs the rate limiting. So they'd need a backdoor'd HSM.

That might be a different pin? Messenger requires a pin to be able to access encrypted chat.

Every time you sign in to the web interface or resign into the app you enter it. I don’t remember an option for an alphanumeric pin or to offload it to a third party.

Re: US has investigated claims WhatsApp chats aren't private

#125

Post by solenoid0937 »

varenc wrote: post #79
cosmicgadget wrote: post #32

> “We look forward to moving forward with those claims and note WhatsApp’s denials have all been carefully worded in a way that stops short of denying the central allegation in the complaint – that Meta has the ability to read WhatsApp messages, regardless of its claims about end-to-end encryption.” My money is on the chats being end to end encrypted and separately uploaded to Facebook.

If this was happening en-masse, wouldn't this be discovered by the many people reverse engineering WhatsApp? Reverse engineering is hard sophisticated work, but given how popular WhatsApp is plenty of independent security researchers are doing it. I'm quite skeptical Meta could hide some malicious code in WhatsApp that's breaking the E2EE without it being discovered.

It would be trivial to discover and would be pretty big news in the security community.

I'd wager most of these comments are from nontechnical people, or technical people that are very far removed from security.

Re: US has investigated claims WhatsApp chats aren't private

#126

Post by martinralbrecht »

WhatsApp's end-to-end encryption has been independently investigated: https://kclpure.kcl.ac.uk/ws/files/324396471/whatsapp.pdf

Full version here: https://eprint.iacr.org/2025/794.pdf

We didn't review the entire source code, only the cryptographic core. That said, the main issue we found was that the WhatsApp servers ultimately decide who is and isn't in a particular chat. Dan Goodin wrote about it here: https://arstechnica.com/security/2025/05/whatsapp-provides-n...

Re: US has investigated claims WhatsApp chats aren't private

#127

Post by solenoid0937 »

So many people that strongly believe WhatsApp isn't E2EE!

Quick, someone set up a Kalshi or Polymarket or whatever claiming that WhatsApp isn't E2EE.

I'll gladly bet against the total volume of people that believe it isn't E2EE -- it'll be an easy 2x for you or me.

Re: US has investigated claims WhatsApp chats aren't private

#128

Post by esseph »

netsharc wrote: post #103
gruez wrote: post #84

Earlier quoted context omitted.

>being end to end encrypted and separately uploaded to Facebook That's a cute loophole you thought up, but whatsapp's marketing is pretty unequivocal that they can't read your messages. >With end-to-end encryption on WhatsApp, your personal messages and calls are secured with a lock. Only you and the person you're talking to can read or listen to them, and no one else, not even WhatsApp https://www.whatsapp.com/ That…

I wonder if keyword/sentiment extraction on the user's device counts as reading "by WhatsApp"... There's the conspiracy theory about mentioning a product near the phone and then getting ads for it (which I don't believe), but I feel like I've mentioned products on WhatsApp chats with friends and then got an ad for them on Instagram sometime after. Also claiming "no one else can read it" is a bit brave, what if the us…

> There's the conspiracy theory about mentioning a product near a the phone and then getting ads for it (which I don't believe)

Well you sure as hell should. Both Google and Apple are making class action settlement payments right now for this very thing.

https://www.bbc.com/news/articles/c4g38jv8zzwo

https://www.nbcchicago.com/news/local/payments-begin-in-95m-...

https://www.404media.co/heres-the-pitch-deck-for-active-list...

Re: US has investigated claims WhatsApp chats aren't private

#129

Post by [deleted] »

0x_rs wrote: post #110

It's a proprietary, closed-source application. It can do whatever it wants, and it doesn't even need to "backdoor" encryption when all it has to do is just forward everything matching some criteria to their servers (and by extension anyone they comply to). It's always one update away from dumping your entire chat history into a remote bucket, and it would still not be in contradiction with their promise of E2EE. Furt…

[deleted]

Re: US has investigated claims WhatsApp chats aren't private

#130

Post by FabHK »

cosmicgadget wrote: post #32

> “We look forward to moving forward with those claims and note WhatsApp’s denials have all been carefully worded in a way that stops short of denying the central allegation in the complaint – that Meta has the ability to read WhatsApp messages, regardless of its claims about end-to-end encryption.” My money is on the chats being end to end encrypted and separately uploaded to Facebook.

It should be detectable if it sends twice the data.
Post reply on HN