Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

211–220 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#211

Post by XorNot »

netsharc wrote: post #103
gruez wrote: post #84

Earlier quoted context omitted.

>being end to end encrypted and separately uploaded to Facebook That's a cute loophole you thought up, but whatsapp's marketing is pretty unequivocal that they can't read your messages. >With end-to-end encryption on WhatsApp, your personal messages and calls are secured with a lock. Only you and the person you're talking to can read or listen to them, and no one else, not even WhatsApp https://www.whatsapp.com/ That…

I wonder if keyword/sentiment extraction on the user's device counts as reading "by WhatsApp"... There's the conspiracy theory about mentioning a product near the phone and then getting ads for it (which I don't believe), but I feel like I've mentioned products on WhatsApp chats with friends and then got an ad for them on Instagram sometime after. Also claiming "no one else can read it" is a bit brave, what if the us…

The conspiracy theory exists due to quirks of human attention and the wider metadata economy though.

You mention something so you're thinking about it, you're thinking about it probably because you've seen it lately (or it's in the group of things local events are making you think about), and then later you notice an ad for that thing and because you were thinking about it actually notice the ad.

It works with anything in any media form. Like I've had it where I hear a new thing and suddenly it turns up in a book I'm reading as well. Of course people discount that because they don't suspect books of being intelligent agents.

Re: US has investigated claims WhatsApp chats aren't private

#212

Post by RajT88 »

loeg wrote: post #199
RajT88 wrote: post #197

Earlier quoted context omitted.

Facebook messenger similarly claims to be end to end encrypted, and yet if it thinks you are sending a link to a pirate site, it "fails to send". I imagine there are a great many blacklisted sites which they shadow block, despite "not being able to read your messages". My pet conspiracy theory is that the "backup code" which "restores" encrypted messages is there to annoy you into installing the app instead of chatti…

The client probably just downloads a blacklist of banned domains. That doesn't mean messages that are sent are not E2E encrypted.

Facebook has lost any benefit of doubt, imo.

Re: US has investigated claims WhatsApp chats aren't private

#213

Post by maqp »

Barrin92 wrote: post #209
digdigdag wrote: post #202

Earlier quoted context omitted.

> We didn't review the entire source code Then it's not fully investigated. That should put any assessments to rest.

as long as client side encryption has been audited, which to my understanding is the case, it doesn't matter. That is literally the point of encryption, communication across adversarial channels . Unless you think Facebook has broken the laws of mathematics it's impossible for them to decrypt the content of messages without the users private keys.

Well the thing is, the key exfiltration code would probably reside outside the TCB. Not particularly hard to have some function grab the signing keys, and send them to the server. Then you can impersonate as the user in MITM. That exfiltration is one-time and it's quite hard to recover from.

I'd much rather not have blind faith on WhatsApp doing the right thing, and instead just use Signal so I can verify myself it's key management is doing only what it should.

Speculating over the correctness of E2EE implementation isn't productive, considering the metadata leak we know Meta takes full advantage of, is enough reason to stick proper platforms like Signal.

Re: US has investigated claims WhatsApp chats aren't private

#214

Post by maqp »

prakashn27 wrote: post #177

Ex-WhatsApp engineer here. WhatsApp team makes so much effort to make this end to end encrypted messages possible. From the time I worked I know for sure it is not possible to read the encrypted messages. From business standpoint they don’t have to read these messages, since WhatsApp business API provide the necessary funding for the org as a whole.

Nice! Hey, question: I noticed Signal at one point had same address on Google Play Store as WA. Can you tell us if Signal devs shared office space with WA during integration of the Signal protocol? Related to that, did they hold WA devs' hand during the process, meaning at least at the time it was sort of greenlighted by Moxie or something. If this is stuff under NDA I fully understand but anything you can share I'd love to hear.

Re: US has investigated claims WhatsApp chats aren't private

#215

Post by londons_explore »

pennomi wrote: post #70
londons_explore wrote: post #57

Earlier quoted context omitted.

> don't really see how it's possible to mitigate client compromise. Think of the way DRM'ed video is played. If the media player application is compromised, the video data is still secure. Thats because the GPU does both the decryption and rendering, and will not let the application read it back.

There will always, ALWAYS be the analog hole in security models like this.

It's pretty hard for the government or service provider to snoop through the analog hole unless they have a camera on your forehead...

Re: US has investigated claims WhatsApp chats aren't private

#216

Post by maqp »

cactusfrog wrote: post #198
blindriver wrote: post #188

Earlier quoted context omitted.

It only takes one engineer in all the teams at Whatsapp that has different directives to make all your privacy work completely useless.

I would be surprised if the code was hidden from other people engineers.

How are you hiding it from IDA pro though?

Re: US has investigated claims WhatsApp chats aren't private

#217

Post by cookiengineer »

martinralbrecht wrote: post #126

WhatsApp's end-to-end encryption has been independently investigated: https://kclpure.kcl.ac.uk/ws/files/324396471/whatsapp.pdf Full version here: https://eprint.iacr.org/2025/794.pdf We didn't review the entire source code, only the cryptographic core. That said, the main issue we found was that the WhatsApp servers ultimately decide who is and isn't in a particular chat. Dan Goodin wrote about it here: https://arst…

Why did you not mention that the WhatsApp apk, even on non-google play installed devices, loads google tag manager's scripts?

It is reproducibly loaded in each chat, and an MitM firewall can also confirm that. I don't know why the focus of audits like these are always on a specific part of the app or only about the cryptography parts, and not the overall behavior of what is leaked and transferred over the wire, and not about potential side channel or bypass attacks.

Transport encryption is useless if the client copies the plaintext of the messages afterwards to another server, or say an online service for translation, you know.

Re: US has investigated claims WhatsApp chats aren't private

#218

Post by londons_explore »

rsync wrote: post #160
londons_explore wrote: post #8

I want whatsapp to decrypt the messages in a secure enclave and render the message content to the screen with a secure rendering pipeline, as is done with DRM'ed video. Compromise of the client side application or OS shouldn't break the security model. This should be possible with current API's, since each message could if needed simply be a single frame DRM'ed video if no better approach exists (or until a better ap…

“I want whatsapp to decrypt the messages in a secure enclave and render the message content to the screen with a secure rendering pipeline, as is done with DRM'ed video.“ If you are sophisticated enough to understand, and want, these things (and I believe that you are) … … then why would you want to use WhatsApp in the first place?

Because my goal isn't to have my communication secure - but to have everyone's communication secure.

And the network effect of whatsapp (3 billion users) seems currently the best route to that.

Re: US has investigated claims WhatsApp chats aren't private

#219

Post by tptacek »

cookiengineer wrote: post #217
martinralbrecht wrote: post #126

WhatsApp's end-to-end encryption has been independently investigated: https://kclpure.kcl.ac.uk/ws/files/324396471/whatsapp.pdf Full version here: https://eprint.iacr.org/2025/794.pdf We didn't review the entire source code, only the cryptographic core. That said, the main issue we found was that the WhatsApp servers ultimately decide who is and isn't in a particular chat. Dan Goodin wrote about it here: https://arst…

Why did you not mention that the WhatsApp apk, even on non-google play installed devices, loads google tag manager's scripts? It is reproducibly loaded in each chat, and an MitM firewall can also confirm that. I don't know why the focus of audits like these are always on a specific part of the app or only about the cryptography parts, and not the overall behavior of what is leaked and transferred over the wire, and n…

There's a whole section, early, in the analysis Albrecht posted that surfaces these concerns.

Re: US has investigated claims WhatsApp chats aren't private

#220

Post by morshu9001 »

martinralbrecht wrote: post #126

WhatsApp's end-to-end encryption has been independently investigated: https://kclpure.kcl.ac.uk/ws/files/324396471/whatsapp.pdf Full version here: https://eprint.iacr.org/2025/794.pdf We didn't review the entire source code, only the cryptographic core. That said, the main issue we found was that the WhatsApp servers ultimately decide who is and isn't in a particular chat. Dan Goodin wrote about it here: https://arst…

They also decide what public key is associated with a phone number, right? Unless you verify in person.
Post reply on HN