US has investigated claims WhatsApp chats aren't private

Post by palata » Sat, Jan 31, 2026, 5:06 PM UTC

varenc wrote: post #79

cosmicgadget wrote: post #32

> “We look forward to moving forward with those claims and note WhatsApp’s denials have all been carefully worded in a way that stops short of denying the central allegation in the complaint – that Meta has the ability to read WhatsApp messages, regardless of its claims about end-to-end encryption.” My money is on the chats being end to end encrypted and separately uploaded to Facebook.

If this was happening en-masse, wouldn't this be discovered by the many people reverse engineering WhatsApp? Reverse engineering is hard sophisticated work, but given how popular WhatsApp is plenty of independent security researchers are doing it. I'm quite skeptical Meta could hide some malicious code in WhatsApp that's breaking the E2EE without it being discovered.

Post by palata » Sat, Jan 31, 2026, 5:10 PM UTC

bogwog wrote: post #39

Retr0id wrote: post #12

Earlier quoted context omitted.

Signal uses the DRM APIs to mitigate threats like Microsoft Recall, but it doesn't stop the app itself from reading its own data. I don't really see how it's possible to mitigate client compromise. You can decrypt stuff on a secure enclave but at some point the client has to pull it out and render it.

> I don't really see how it's possible to mitigate client compromise Easy: pass laws requiring chat providers to implement interoperability standards so that users can bring their own trusted clients. You're still at risk if your recipient is using a compromised client, but that's a problem that you have the power to solve, and it's much easier to convince someone to switch a secure client if they don't have to worry…

Post by codethief » Sat, Jan 31, 2026, 5:15 PM UTC

Post by solenoid0937 » Sat, Jan 31, 2026, 5:17 PM UTC

basch wrote: post #124

solenoid0937 wrote: post #98

Earlier quoted context omitted.

The PIN is used when you're too lazy to set an alphanumeric pin or offload the backup to Apple/Google. Now sure, this is most people, but such are the foibles of E2EE - getting E2EE "right" (eg supporting account recovery) requires people to memorize a complex password. The PIN interface is also an HSM on the backend. The HSM performs the rate limiting. So they'd need a backdoor'd HSM.

That might be a different pin? Messenger requires a pin to be able to access encrypted chat. Every time you sign in to the web interface or resign into the app you enter it. I don’t remember an option for an alphanumeric pin or to offload it to a third party.

Post by barbazoo » Sat, Jan 31, 2026, 5:20 PM UTC

solenoid0937 wrote: post #98

barbazoo wrote: post #44

Earlier quoted context omitted.

They likely wouldn’t rate limit themselves, rate limiting only applies when you access through their cute little enter your pin UI.

The PIN is used when you're too lazy to set an alphanumeric pin or offload the backup to Apple/Google. Now sure, this is most people, but such are the foibles of E2EE - getting E2EE "right" (eg supporting account recovery) requires people to memorize a complex password. The PIN interface is also an HSM on the backend. The HSM performs the rate limiting. So they'd need a backdoor'd HSM.