Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

161–170 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#161

Post by gruez »

conscion wrote: post #158
gruez wrote: post #84

Earlier quoted context omitted.

>being end to end encrypted and separately uploaded to Facebook That's a cute loophole you thought up, but whatsapp's marketing is pretty unequivocal that they can't read your messages. >With end-to-end encryption on WhatsApp, your personal messages and calls are secured with a lock. Only you and the person you're talking to can read or listen to them, and no one else, not even WhatsApp https://www.whatsapp.com/ That…

My guess is that they are end-to-end encrypted. And because of Facebook's scale that they're able to probabilisticly guess at what's in the encrypted messages (e.g.a message with X hash has Y probability of containing the word "shoes")

That seems unlikely given that they use the signal protocol: https://signal.org/blog/whatsapp-complete/

Re: US has investigated claims WhatsApp chats aren't private

#163

Post by gruez »

3eb7988a1663 wrote: post #145
codyb wrote: post #132

Earlier quoted context omitted.

The thing is, if they were uploading your messages, then they'd want to do something with the data. And humans aren't great at keeping secrets. So, if the claim is that there's a bunch of data, but everyone who is using it to great gain is completely and totally mum about it, and no one else has ever thought to question where certain inferences were coming from, and no employee ever questioned any API calls or databa…

Where were the Facebook whistleblowers about the numerous IOS/Android gaps that let the company gain more information than they were to supposed to see? Malicious VPNs, scanning other installed mobile applications, whatever. As far as I know, the big indictments have been found from the outside.

>Malicious VPNs

AFAIK that was a separate app, and it was pretty clear that it was MITMing your connections. It's not any different than say, complaining about how there weren't any whistleblowers for fortinet (who sell enterprise firewalls).

>scanning other installed mobile applications

Source?

Re: US has investigated claims WhatsApp chats aren't private

#164

Post by gruez »

esseph wrote: post #128
netsharc wrote: post #103

Earlier quoted context omitted.

I wonder if keyword/sentiment extraction on the user's device counts as reading "by WhatsApp"... There's the conspiracy theory about mentioning a product near the phone and then getting ads for it (which I don't believe), but I feel like I've mentioned products on WhatsApp chats with friends and then got an ad for them on Instagram sometime after. Also claiming "no one else can read it" is a bit brave, what if the us…

> There's the conspiracy theory about mentioning a product near a the phone and then getting ads for it (which I don't believe) Well you sure as hell should. Both Google and Apple are making class action settlement payments right now for this very thing. https://www.bbc.com/news/articles/c4g38jv8zzwo https://www.nbcchicago.com/news/local/payments-begin-in-95m-... https://www.404media.co/heres-the-pitch-deck-for-activ…

>https://www.bbc.com/news/articles/c4g38jv8zzwo

>https://www.nbcchicago.com/news/local/payments-begin-in-95m-...

Both are for voice assistants that inadvertently got activated. Extending it to imply that they're intentionally deceiving their users is a stretch.

>https://www.404media.co/heres-the-pitch-deck-for-active-list...

It's a pitch deck. For how skeptical HN is about AI startups or whatever, it seems pretty strange to take this at face value.

Re: US has investigated claims WhatsApp chats aren't private

#165

Post by gruez »

cosmicgadget wrote: post #100
matthewdgreen wrote: post #88

Earlier quoted context omitted.

I really doubt this. Any such upload would be visible inside the WhatsApp application, which would make it the world's most exciting (and relatively straightforward) RE project. You can even start with a Java app, so it's extra easy.

If you claim REing a flagship FAANG application is "extra easy", either they need to be laughed out of the room or you do.

Does FAANG apps have antidebug or code obfuscation? At least for google their apps are pretty lightly protected. The maximum extent of obfuscation is the standard compilation/optimization process that most apps go through (eg. r8 or proguard).

Re: US has investigated claims WhatsApp chats aren't private

#166

Post by gruez »

gherkinnn wrote: post #111
xvector wrote: post #52

Earlier quoted context omitted.

Anyone blindly believing every random allegation is also a fool, especially when the app in question has been thoroughly reverse engineered and you can freely check for yourself that it's using the same protocol as Signal for encryption

Allegations against a company who circumvented Android's security to track users? I don't have any proof that Meta stores WhatsApp messages but I feel it in my bones that at the very least tried to do so. And if ever that comes to light, precisely nobody will be surprised. https://cybersecuritynews.com/track-android-users-covertly/

>And if ever that comes to light, precisely nobody will be surprised.

The amount of ambient cynicism on the internet basically makes this a meaningless statement. You could plausibly make the same claim for tons of other conspiracy theories, eg. JFK was assassinated by the CIA/FBI, Bush did 9/11, covid was intentionally engineered by the chinese/US government, etc.

Re: US has investigated claims WhatsApp chats aren't private

#168

Post by OutOfHere »

paxys wrote: post #146
0x_rs wrote: post #110

It's a proprietary, closed-source application. It can do whatever it wants, and it doesn't even need to "backdoor" encryption when all it has to do is just forward everything matching some criteria to their servers (and by extension anyone they comply to). It's always one update away from dumping your entire chat history into a remote bucket, and it would still not be in contradiction with their promise of E2EE. Furt…

You are also using proprietary, closed-source hardware and operating system underneath the app that can do whatever they want. This line of reasoning ultimately leads to - unless you craft every atom and every bit yourself your data isn't secure. Which may be true, but is a pointless discussion.

That's a bad take because the vendors there are different; they're not Meta. As such, it's not pointless.

Re: US has investigated claims WhatsApp chats aren't private

#169

Post by gruez »

Forgeties79 wrote: post #51
renegade-otter wrote: post #41

Anyone trusting Facebook to follow basic human decency and, yes, laws, is a fool.

They got caught torrenting unbelievable amounts of content, an act that committed even just a few times can get my home Internet shut down with no recourse (best outcome). Literally nothing happened. Combine the fact that nothing legally significant ever happens to them with zuckerburg’s colossal ego and complete lack of ethical foundation, and you have quite the recipe. And I’m not even getting into the obvious nega…

>an act that committed even just a few times can get my home Internet shut down with no recourse (best outcome).

No, the best (and also most likely) outcome is you using a VPN and nothing happens, like 99.9% of pirates out there.

>Literally nothing happened.

Isn't there a lawsuit in the works?

Re: US has investigated claims WhatsApp chats aren't private

#170

Post by gruez »

londons_explore wrote: post #57
Retr0id wrote: post #12

Earlier quoted context omitted.

Signal uses the DRM APIs to mitigate threats like Microsoft Recall, but it doesn't stop the app itself from reading its own data. I don't really see how it's possible to mitigate client compromise. You can decrypt stuff on a secure enclave but at some point the client has to pull it out and render it.

> don't really see how it's possible to mitigate client compromise. Think of the way DRM'ed video is played. If the media player application is compromised, the video data is still secure. Thats because the GPU does both the decryption and rendering, and will not let the application read it back.

That's not what signal's doing though. It's just asking the OS nicely to not capture screen contents. There are secure ways of doing media playback, but that's not what signal's using.
Post reply on HN