Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

141–150 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#141

Post by cosmicgadget »

solenoid0937 wrote: post #125
varenc wrote: post #79

Earlier quoted context omitted.

If this was happening en-masse, wouldn't this be discovered by the many people reverse engineering WhatsApp? Reverse engineering is hard sophisticated work, but given how popular WhatsApp is plenty of independent security researchers are doing it. I'm quite skeptical Meta could hide some malicious code in WhatsApp that's breaking the E2EE without it being discovered.

It would be trivial to discover and would be pretty big news in the security community. I'd wager most of these comments are from nontechnical people, or technical people that are very far removed from security.

I'm technical and work in security. Since it is trivial, please explain. Ideally not using a strawman like "well just run strings and look for uploadPlaintextChatsToServer()".

Re: US has investigated claims WhatsApp chats aren't private

#142

Post by digiown »

palata wrote: post #133
bogwog wrote: post #39

Earlier quoted context omitted.

> I don't really see how it's possible to mitigate client compromise Easy: pass laws requiring chat providers to implement interoperability standards so that users can bring their own trusted clients. You're still at risk if your recipient is using a compromised client, but that's a problem that you have the power to solve, and it's much easier to convince someone to switch a secure client if they don't have to worry…

> Easy: pass laws requiring chat providers to implement interoperability standards so that users can bring their own trusted clients. In Europe that's called the Digital Markets Act.

That's not permissionless afaik. "Users" can't really do it. It's frustrating that all these legislations appear to view it as a business problem rather than a private individual's right to communicate securely.

Re: US has investigated claims WhatsApp chats aren't private

#143

Post by solenoid0937 »

cosmicgadget wrote: post #141
solenoid0937 wrote: post #125

Earlier quoted context omitted.

It would be trivial to discover and would be pretty big news in the security community. I'd wager most of these comments are from nontechnical people, or technical people that are very far removed from security.

I'm technical and work in security. Since it is trivial, please explain. Ideally not using a strawman like "well just run strings and look for uploadPlaintextChatsToServer()".

I don't see why standard RE techniques (DBI/Frida + MITM) wouldn't work, do you?

WhatsApp is constantly RE'd because it'd be incredibly valuable to discover gaps in its security posture, the community would find any exfil here.

Re: US has investigated claims WhatsApp chats aren't private

#144

Post by j45 »

Aurornis wrote: post #62
j45 wrote: post #53

Earlier quoted context omitted.

It's not guaranteed or by default. This type of generalized defeatism does more harm than not.

> It's not guaranteed or by default. Nation state governments do have the ability to coerce companies within their territory by default. If you think this feature is unique to the USA, you are buying too much into a separate narrative. All countries can and will use the force of law to control companies within their borders when they see fit. The USA actually has more freedom and protections in this area than many co…

Understanding the cloud is someone else's computer is something I've repeated many, many, many times in my comments.

The OP assumption that it's just the way it is and everyone should accept their communication being compromised is the issue.

Re: US has investigated claims WhatsApp chats aren't private

#145

Post by 3eb7988a1663 »

codyb wrote: post #132
gruez wrote: post #84

Earlier quoted context omitted.

>being end to end encrypted and separately uploaded to Facebook That's a cute loophole you thought up, but whatsapp's marketing is pretty unequivocal that they can't read your messages. >With end-to-end encryption on WhatsApp, your personal messages and calls are secured with a lock. Only you and the person you're talking to can read or listen to them, and no one else, not even WhatsApp https://www.whatsapp.com/ That…

The thing is, if they were uploading your messages, then they'd want to do something with the data. And humans aren't great at keeping secrets. So, if the claim is that there's a bunch of data, but everyone who is using it to great gain is completely and totally mum about it, and no one else has ever thought to question where certain inferences were coming from, and no employee ever questioned any API calls or databa…

Where were the Facebook whistleblowers about the numerous IOS/Android gaps that let the company gain more information than they were to supposed to see? Malicious VPNs, scanning other installed mobile applications, whatever. As far as I know, the big indictments have been found from the outside.

Re: US has investigated claims WhatsApp chats aren't private

#146

Post by paxys »

0x_rs wrote: post #110

It's a proprietary, closed-source application. It can do whatever it wants, and it doesn't even need to "backdoor" encryption when all it has to do is just forward everything matching some criteria to their servers (and by extension anyone they comply to). It's always one update away from dumping your entire chat history into a remote bucket, and it would still not be in contradiction with their promise of E2EE. Furt…

You are also using proprietary, closed-source hardware and operating system underneath the app that can do whatever they want. This line of reasoning ultimately leads to - unless you craft every atom and every bit yourself your data isn't secure. Which may be true, but is a pointless discussion.

Re: US has investigated claims WhatsApp chats aren't private

#147

Post by martinralbrecht »

solenoid0937 wrote: post #143
cosmicgadget wrote: post #141

Earlier quoted context omitted.

I'm technical and work in security. Since it is trivial, please explain. Ideally not using a strawman like "well just run strings and look for uploadPlaintextChatsToServer()".

I don't see why standard RE techniques (DBI/Frida + MITM) wouldn't work, do you? WhatsApp is constantly RE'd because it'd be incredibly valuable to discover gaps in its security posture, the community would find any exfil here.

We did reverse engineer it and we're cryptographers not reverse engineering experts https://eprint.iacr.org/2025/794

Re: US has investigated claims WhatsApp chats aren't private

#148

Post by martinralbrecht »

cosmicgadget wrote: post #100
matthewdgreen wrote: post #88

Earlier quoted context omitted.

I really doubt this. Any such upload would be visible inside the WhatsApp application, which would make it the world's most exciting (and relatively straightforward) RE project. You can even start with a Java app, so it's extra easy.

If you claim REing a flagship FAANG application is "extra easy", either they need to be laughed out of the room or you do.

Note that WhatsApp as a web client, too: https://eprint.iacr.org/2025/794

Re: US has investigated claims WhatsApp chats aren't private

#149

Post by solenoid0937 »

barbazoo wrote: post #139
solenoid0937 wrote: post #98

Earlier quoted context omitted.

The PIN is used when you're too lazy to set an alphanumeric pin or offload the backup to Apple/Google. Now sure, this is most people, but such are the foibles of E2EE - getting E2EE "right" (eg supporting account recovery) requires people to memorize a complex password. The PIN interface is also an HSM on the backend. The HSM performs the rate limiting. So they'd need a backdoor'd HSM.

That added some context I didn’t have yet thanks. I’m not seeing yet how Meta if it was a bad actor wouldn’t be able to brute force the pin of a particular user. Of this was a black box user terminal site, Meta owns the stack here though, seems plausible that you could inject yourself easily somewhere.

If you choose an alphanumeric pin they can't brute force because of the sheer entropy (and because the key is derived from the alphanumeric PIN itself.)

However, most users can't be bothered to choose such a PIN. In this case they choose a 4 or 6 digit pin.

To mitigate the risk of brute force, the PIN is rate limited by an HSM. The HSM, if it works correctly, should delete the encryption key if too many attempts are used.

Now sure, Meta could insert itself between the client and HSM and MITM to extract the PIN.

But this isn't a Meta specific gap, it's the problem with any E2EE system that doesn't require users to memorize a master password.

I helped design E2EE systems for a big tech company and the unsatisfying answer is that there is no such thing as "user friendly" E2EE. The company can always modify the client, or insert themselves in the key discovery process, etc. There are solutions to this (decentralized app stores and open source protocols, public key servers) but none usable by the average person.

Re: US has investigated claims WhatsApp chats aren't private

#150

Post by [deleted] »

martinralbrecht wrote: post #147
solenoid0937 wrote: post #143

Earlier quoted context omitted.

I don't see why standard RE techniques (DBI/Frida + MITM) wouldn't work, do you? WhatsApp is constantly RE'd because it'd be incredibly valuable to discover gaps in its security posture, the community would find any exfil here.

We did reverse engineer it and we're cryptographers not reverse engineering experts https://eprint.iacr.org/2025/794

[deleted]
Post reply on HN