Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

191–200 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#191

Post by philipallstar »

blindriver wrote: post #188
prakashn27 wrote: post #177

Ex-WhatsApp engineer here. WhatsApp team makes so much effort to make this end to end encrypted messages possible. From the time I worked I know for sure it is not possible to read the encrypted messages. From business standpoint they don’t have to read these messages, since WhatsApp business API provide the necessary funding for the org as a whole.

It only takes one engineer in all the teams at Whatsapp that has different directives to make all your privacy work completely useless.

Assuming there's no code review or audit, I suppose.

Re: US has investigated claims WhatsApp chats aren't private

#192

Post by rurban »

FabHK wrote: post #130
cosmicgadget wrote: post #32

> “We look forward to moving forward with those claims and note WhatsApp’s denials have all been carefully worded in a way that stops short of denying the central allegation in the complaint – that Meta has the ability to read WhatsApp messages, regardless of its claims about end-to-end encryption.” My money is on the chats being end to end encrypted and separately uploaded to Facebook.

It should be detectable if it sends twice the data.

It encrypts it to all the keys with the phone number registered for that user. Because users are switching phones, but keep their number. But each new WhatsApp app gets a new private key, the old key is not shared. This feature was added later, so the old WhatsApp devs wouldn't know.

So it would be trivial to encrypt to the NSA key also, as done on Windows.

Re: US has investigated claims WhatsApp chats aren't private

#193

Post by Ms-J »

dang wrote: post #182
Ms-J wrote: post #179

This was slid off the first page of HN so quickly. As someone wisely pointed out in this thread, the reason Facebook is doing this is: "it's for favor trading and leverage at the highest levels."

It set off the flamewar detector, which is the usual reason that happens. We'll either turn off that software penalty or merge the thread into a submission of the original Bloomberg source - these things take a bit of time to sort through! Edit: thread merged from https://news.ycombinator.com/item?id=46836487 now.

It does have an amplifying effect when issues such as this happen to where users who don't read in time won't see this due to the amount of other threads.

Thank you for the insight as to why it happened.

Re: US has investigated claims WhatsApp chats aren't private

#194

Post by modeless »

gruez wrote: post #173
modeless wrote: post #119

Earlier quoted context omitted.

It means, for example, Google Messages uses E2EE backups. Google cannot read your E2EE messages by default, period. Not from your own backup, not from other peoples' backups. No backup loophole. Most other E2EE messaging apps also do not have a backup loophole like iMessage. It's not hard to understand why Apple uploading every message to themselves to read by default is different from somebody intentionally taking a…

>Google cannot read your E2EE messages by default, period. Is icloud backups opt in or opt out? If it's opt in then would your objection still hold?

I'm less concerned with whether it is technically opt in or opt out and more concerned with whether it is commonly enabled in practice.

What would resolve my objection is if Apple either made messages backups E2EE always, as Google did and as Apple does themselves for other data categories like Keychain passwords, or if they excluded E2EE conversations (e.g. from ADP people) from non-E2EE backups, as Telegram does. Anything short of that does not qualify as E2EE regardless of the defaults, and marketing it as E2EE is false advertising.

Re: US has investigated claims WhatsApp chats aren't private

#195

Post by miduil »

vpShane wrote: post #187
martinralbrecht wrote: post #126

WhatsApp's end-to-end encryption has been independently investigated: https://kclpure.kcl.ac.uk/ws/files/324396471/whatsapp.pdf Full version here: https://eprint.iacr.org/2025/794.pdf We didn't review the entire source code, only the cryptographic core. That said, the main issue we found was that the WhatsApp servers ultimately decide who is and isn't in a particular chat. Dan Goodin wrote about it here: https://arst…

> We didn't review the entire source code And, you don't see the issue with that? Facebook was bypassing security measures for mobile by sending data to itself on localhost using websockets and webrtc. https://cybersecuritynews.com/track-android-users-covertly/ An audit of 'they can't read it cryptographically' but the app can read it, and the app sends data in all directions. Push notifications can be used to read m…

> Push notifications can be used to read messages.

Are you trying to imply that WhatsApp is bypassing e2e messaging through Push notifications?

Unless something has changed, this table highlights that both Signal and WhatsApp are using a "Push-to-Sync" technique to notify about new messages.

https://crysp.petsymposium.org/popets/2024/popets-2024-0151....

Re: US has investigated claims WhatsApp chats aren't private

#197

Post by RajT88 »

cosmicgadget wrote: post #32

> “We look forward to moving forward with those claims and note WhatsApp’s denials have all been carefully worded in a way that stops short of denying the central allegation in the complaint – that Meta has the ability to read WhatsApp messages, regardless of its claims about end-to-end encryption.” My money is on the chats being end to end encrypted and separately uploaded to Facebook.

Facebook messenger similarly claims to be end to end encrypted, and yet if it thinks you are sending a link to a pirate site, it "fails to send". I imagine there are a great many blacklisted sites which they shadow block, despite "not being able to read your messages".

My pet conspiracy theory is that the "backup code" which "restores" encrypted messages is there to annoy you into installing the app instead of chatting on the web.

Re: US has investigated claims WhatsApp chats aren't private

#198

Post by cactusfrog »

blindriver wrote: post #188
prakashn27 wrote: post #177

Ex-WhatsApp engineer here. WhatsApp team makes so much effort to make this end to end encrypted messages possible. From the time I worked I know for sure it is not possible to read the encrypted messages. From business standpoint they don’t have to read these messages, since WhatsApp business API provide the necessary funding for the org as a whole.

It only takes one engineer in all the teams at Whatsapp that has different directives to make all your privacy work completely useless.

I would be surprised if the code was hidden from other people engineers.

Re: US has investigated claims WhatsApp chats aren't private

#199

Post by loeg »

RajT88 wrote: post #197
cosmicgadget wrote: post #32

> “We look forward to moving forward with those claims and note WhatsApp’s denials have all been carefully worded in a way that stops short of denying the central allegation in the complaint – that Meta has the ability to read WhatsApp messages, regardless of its claims about end-to-end encryption.” My money is on the chats being end to end encrypted and separately uploaded to Facebook.

Facebook messenger similarly claims to be end to end encrypted, and yet if it thinks you are sending a link to a pirate site, it "fails to send". I imagine there are a great many blacklisted sites which they shadow block, despite "not being able to read your messages". My pet conspiracy theory is that the "backup code" which "restores" encrypted messages is there to annoy you into installing the app instead of chatti…

The client probably just downloads a blacklist of banned domains. That doesn't mean messages that are sent are not E2E encrypted.

Re: US has investigated claims WhatsApp chats aren't private

#200

Post by Forgeties79 »

gruez wrote: post #169
Forgeties79 wrote: post #51

Earlier quoted context omitted.

They got caught torrenting unbelievable amounts of content, an act that committed even just a few times can get my home Internet shut down with no recourse (best outcome). Literally nothing happened. Combine the fact that nothing legally significant ever happens to them with zuckerburg’s colossal ego and complete lack of ethical foundation, and you have quite the recipe. And I’m not even getting into the obvious nega…

>an act that committed even just a few times can get my home Internet shut down with no recourse (best outcome). No, the best (and also most likely) outcome is you using a VPN and nothing happens, like 99.9% of pirates out there. >Literally nothing happened. Isn't there a lawsuit in the works?

If you have to do a thing that obscures your act it doesn’t change the fact that there are rules for me and not them. We know for a fact they did it. Did their ISP threaten them? Did they get their internet service shut off?

Edit: they already won their first case in June against authors. I am very curious to see how that lawsuit goes. Obviously we don’t know the results yet but I would be incredibly surprised to see them lose and/or have to “undo” the training. That’s a difficult world to imagine, especially under the current US admin. Smart money is the damage is done and they’ll find some new way to be awful or otherwise break rules we can’t.

Post reply on HN