Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

171–180 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#171

Post by cosmicgadget »

quesera wrote: post #157
cosmicgadget wrote: post #156

Earlier quoted context omitted.

I am familiar with disassembly and decompilation and what you just said is a huge handwave. > a secondary pathway for message transmission That's certainly the only way messages could be uploaded to Facebook!

I'm curious why you think it's handwavy. I've done this work on other mobile apps (not WhatsApp), and the work is not out of the ordinary. It's difficult to hide subtleties in decompiled code. And anything that looks hairbally gets special attention, if the calling sites or side effects are interesting. (edit for edit) > That's certainly the only way messages could be uploaded to Facebook! Well, there's a primary pat…

> if there's a secondary pathway, it's probably for telemetry etc.

Seems like a good channel upon which to piggyback user data. Now all you have to do is obfuscate the serialization.

> It's difficult to hide subtleties in decompiled code.

Stripped, obfuscated code? Really? Are we assuming debug ability here?

> All secrets are out in the open at that point. There are no black boxes in mobile app code.

What about a loader with an encrypted binary that does a device attestation check?

Re: US has investigated claims WhatsApp chats aren't private

#172

Post by OutOfHere »

The issue here is that WhatsApp doesn't work with third-party clients (outside of EU anyway). It does now in EU via BirdyChat and Haiket, but the features are too limiting: https://about.fb.com/news/2025/11/messaging-interoperability...

Ideally, WhatsApp would fully support third-party open-source clients that can ensure that the mathematics are used as intended.

Re: US has investigated claims WhatsApp chats aren't private

#173

Post by gruez »

modeless wrote: post #119
gruez wrote: post #105

Earlier quoted context omitted.

>If you read the link you would know that contrary to your expectation other apps advertising E2EE don't allow the app maker to read your messages. What does that even mean? Suppose icloud backups doesn't exist, but you could still take screenshots and save them to icloud drive. Is that also "Apple has always been able to read encrypted iMessage messages"? Same goes for "other people having icloud backups enabled". P…

It means, for example, Google Messages uses E2EE backups. Google cannot read your E2EE messages by default, period. Not from your own backup, not from other peoples' backups. No backup loophole. Most other E2EE messaging apps also do not have a backup loophole like iMessage. It's not hard to understand why Apple uploading every message to themselves to read by default is different from somebody intentionally taking a…

>Google cannot read your E2EE messages by default, period.

Is icloud backups opt in or opt out? If it's opt in then would your objection still hold?

Re: US has investigated claims WhatsApp chats aren't private

#174

Post by gruez »

p1anecrazy wrote: post #159
gruez wrote: post #90

Earlier quoted context omitted.

> but just a food for thought. ...that telegram is backdoored by the russians? The implication you're trying to make seems to be that russians must be choosing telegram because it's secure, but are ignoring the possibility that they're choosing telegram because they have access to it. After all, you think they want the possibility of their military scheming against them?

I guess their point was that Russian military doesn‘t care if Russian intelligence reads their messages

Maybe OP should clearly state their thesis rather than beating around the bush with "... just a food for thought", so we don't have to guess what he's trying to say.

Re: US has investigated claims WhatsApp chats aren't private

#175

Post by gruez »

znpy wrote: post #14

I always assumed this to be true, to be honest. Nowadays all of the messaging pipeline on my phone is closed source and proprietary, and thus unverifiable at all. The iPhone operating system is closed, the runtime is closed, the whatsapp client is closed, the protocol is closed… hard to believe any claim. And i know that somebody’s gonna bring up the alleged e2e encryption… a client in control of somebody else might…

>Closed systems that do not support third party clients that connect through open protocols should ALWAYS be assumed to be insecure.

So you're posting this from an open core CPU running on an open FPGA that you fabricated yourself, right? Or is this just a game of one-upmanship where people come with increasingly high standards for what counts as "secure" to signal how devoted to security they are?

Re: US has investigated claims WhatsApp chats aren't private

#176

Post by threatofrain »

paxys wrote: post #146
0x_rs wrote: post #110

It's a proprietary, closed-source application. It can do whatever it wants, and it doesn't even need to "backdoor" encryption when all it has to do is just forward everything matching some criteria to their servers (and by extension anyone they comply to). It's always one update away from dumping your entire chat history into a remote bucket, and it would still not be in contradiction with their promise of E2EE. Furt…

You are also using proprietary, closed-source hardware and operating system underneath the app that can do whatever they want. This line of reasoning ultimately leads to - unless you craft every atom and every bit yourself your data isn't secure. Which may be true, but is a pointless discussion.

No it means you calculate how much risk you're taking on, vendor by vendor. Do all companies have the same reputation before your eyes?

Re: US has investigated claims WhatsApp chats aren't private

#177

Post by prakashn27 »

Ex-WhatsApp engineer here. WhatsApp team makes so much effort to make this end to end encrypted messages possible. From the time I worked I know for sure it is not possible to read the encrypted messages.

From business standpoint they don’t have to read these messages, since WhatsApp business API provide the necessary funding for the org as a whole.

Re: US has investigated claims WhatsApp chats aren't private

#178

Post by quesera »

cosmicgadget wrote: post #171
quesera wrote: post #157

Earlier quoted context omitted.

I'm curious why you think it's handwavy. I've done this work on other mobile apps (not WhatsApp), and the work is not out of the ordinary. It's difficult to hide subtleties in decompiled code. And anything that looks hairbally gets special attention, if the calling sites or side effects are interesting. (edit for edit) > That's certainly the only way messages could be uploaded to Facebook! Well, there's a primary pat…

> if there's a secondary pathway, it's probably for telemetry etc. Seems like a good channel upon which to piggyback user data. Now all you have to do is obfuscate the serialization. > It's difficult to hide subtleties in decompiled code. Stripped, obfuscated code? Really? Are we assuming debug ability here? > All secrets are out in the open at that point. There are no black boxes in mobile app code. What about a loa…

I've lost track of our points of disagreement here. Sure, it's work, but it's all doable.

Obfuscated code is more difficult to unravel in its orginal form than the decompiled form. Decompiled code is a mess with no guideposts, but that's just a matter of time and patience to fix. It's genuinely tricky to write code that decompiles into deceptive appearances.

Original position is that it'd be difficult to hide side channel leakage of chat messages in the WhatsApp mobile app. I have not worked on the WhatsApp app, but if it's anything like the mobile apps I have analyzed, I think this is the correct position.

If the WhatsApp mobile apps are hairballs of obfuscation and misdirection, I would be a) very surprised, and b) highly suspicious. Since I don't do this work every day any more, I haven't thought much about it. But there are so many people who do this work every day, and WhatsApp is so popular, I'd be genuinely shocked if there were fewer than hundreds of people who have lightly scanned the apps for anything hairbally that would be worth further digging. Maybe I'm wrong and WhatsApp is special though. Happy to be informed if so.

Re: US has investigated claims WhatsApp chats aren't private

#180

Post by CalRobert »

Ms-J wrote: post #179

This was slid off the first page of HN so quickly. As someone wisely pointed out in this thread, the reason Facebook is doing this is: "it's for favor trading and leverage at the highest levels."

Just came here after seeing it in the Guardian and really disappointed it's not on the front page. Telling.
Post reply on HN