Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ex-WhatsApp cybersecurity head says Meta endangered billions of users

theguardian.com

Post reply on HN
Print view View original

11–20 of 192 posts

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#11

Post by neilv »

mgh2 wrote: post #7

> A Meta spokesperson, Andy Stone, wrote on Threads, the company’s text-based social network: “Sadly this is a familiar playbook in which a former employee is dismissed for poor performance and then goes public with distorted claims that misrepresent the ongoing hard work of our team.” Skeletons keep piling up while PR try to dismiss them

That quote is brilliant.

Corporate communications has playbook damage control responses, and this quote seems to be suggesting that the quoted response is one of them (it's "familiar").

Whether "former employees" are sketchily operating from playbooks, who knows. Because PR playbook-sounding statements don't have a lot of credibility.

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#13

Post by another_twist »

princevegeta89 wrote: post #12

It will be so foolish of anyone to think that WhatsApp is a truly e2e encrypted messaging platform.

Why ? You think Meta removed the privacy layers or put backdoors in place ? I mean if that's the suspicion, maybe we should read the terms of service and see if they actually guarantee E2E encryption

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#14

Post by another_twist »

crypto_throwa wrote: post #9
lordofgibbons wrote: post #5

Given how WhatsApp is the de-facto way to communicate outside of the West and China, these security/data-handling "weaknesses" are most likely a feature, not a bug. An absolute bonanza for the certain intelligence services. Remember, kids: End to end encryption is useless if the "ends" are fully controlled by an (untrustworthy) third party.

Without open source, end to end encryption is useless. It's not hard to hide a piece of code that defeats the encryption in closed source code.

Curious, is there a poc somewhere demonstrating an attack like this ?

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#15

Post by __spooky__ »

crypto_throwa wrote: post #9
lordofgibbons wrote: post #5

Given how WhatsApp is the de-facto way to communicate outside of the West and China, these security/data-handling "weaknesses" are most likely a feature, not a bug. An absolute bonanza for the certain intelligence services. Remember, kids: End to end encryption is useless if the "ends" are fully controlled by an (untrustworthy) third party.

Without open source, end to end encryption is useless. It's not hard to hide a piece of code that defeats the encryption in closed source code.

iMessage is end to end encrypted. Although Apple says it secure and the courts and FBI seem to not be able to get it in, it is still closed source.

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#16

Post by princevegeta89 »

another_twist wrote: post #13
princevegeta89 wrote: post #12

It will be so foolish of anyone to think that WhatsApp is a truly e2e encrypted messaging platform.

Why ? You think Meta removed the privacy layers or put backdoors in place ? I mean if that's the suspicion, maybe we should read the terms of service and see if they actually guarantee E2E encryption

Every message we send via this service still most likely goes through it's bots that try to gather user context.

I'm guessing there will be some tricky legal wording in their T&C that wouldn't rule them out from being an intermediate entity that can see messages.

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#17

Post by joaomacp »

another_twist wrote: post #14
crypto_throwa wrote: post #9

Earlier quoted context omitted.

Without open source, end to end encryption is useless. It's not hard to hide a piece of code that defeats the encryption in closed source code.

Curious, is there a poc somewhere demonstrating an attack like this ?

Sure:

  plain_msg = decrypt(encrypted_msg)
  send_to_nsa(plain_msg)

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#18

Post by roelschroeven »

alaq wrote: post #6
wordofx wrote: post #4

So much for that e2e encryption that HN claimed was so good and that META couldn’t possibly use what’s app messages to do advertising from.

Messages are e2e and WA doesn't have access to them. We're talking about the metadata here. From the article: > including contact information, IP addresses and profile photos I can confirm this, I used to work at WhatsApp.

We don't really know that messages really are end-to-end encrypted though, do we? Is there a way to actually check that the messages in transit are encrypted in a way that only the other end can decrypt them? If not, we have to take Meta's word for it, which frankly doesn't carry much weight.

Re: Ex-WhatsApp cybersecurity head says Meta endangered billions of users

#19

Post by another_twist »

jonoc wrote: post #10
wordofx wrote: post #8

Earlier quoted context omitted.

Meta/WA. Same thing. Might have worked at WhatsApp but FB still advertises based on conversation content.

Not sure this is correct - alaq said the messages are e2e, so not visible at all by anyone other that the participants of the conversation. The meta->data<- however IS visible by them and can and is likely to be used for advertising.

Of course the meta data is visible. Its probably more useful than the actual content of the conversation too. I mean from an ML perspective how would you even make features out of conversation that help with CTR ? That too without creeping the users out. I'd imagine its the same reason why meta doesnt (likely) listen in on mobile mics. Why go through the whole shebang of running always on transcription when simple features like who talked to who and at what times are more useful at establishing user similarities.
Post reply on HN