Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

221–230 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#221

Post by gruez »

Forgeties79 wrote: post #200
gruez wrote: post #169

Earlier quoted context omitted.

>an act that committed even just a few times can get my home Internet shut down with no recourse (best outcome). No, the best (and also most likely) outcome is you using a VPN and nothing happens, like 99.9% of pirates out there. >Literally nothing happened. Isn't there a lawsuit in the works?

If you have to do a thing that obscures your act it doesn’t change the fact that there are rules for me and not them. We know for a fact they did it. Did their ISP threaten them? Did they get their internet service shut off? Edit: they already won their first case in June against authors. I am very curious to see how that lawsuit goes. Obviously we don’t know the results yet but I would be incredibly surprised to see…

>If you have to do a thing that obscures your act it doesn’t change the fact that there are rules for me and not them. We know for a fact they did it. Did their ISP threaten them? Did they get their internet service shut off?

Is there any indication they didn't use a VPN? If they did use a VPN, how is it "there are rules for me and not them", given that anyone can also use VPN to pirate with impunity?

Re: US has investigated claims WhatsApp chats aren't private

#222

Post by giancarlostoro »

3rodents wrote: post #206
digdigdag wrote: post #202

Earlier quoted context omitted.

> We didn't review the entire source code Then it's not fully investigated. That should put any assessments to rest.

By that standard, it can never be verified because what is running and what is reviewed could be different. Reviewing relevant elements is as meaningful as reviewing all the source code.

Or they could even take out the backdoor code and then put it back in after review.

Re: US has investigated claims WhatsApp chats aren't private

#223

Post by hn_throwaway_99 »

Barrin92 wrote: post #209
digdigdag wrote: post #202

Earlier quoted context omitted.

> We didn't review the entire source code Then it's not fully investigated. That should put any assessments to rest.

as long as client side encryption has been audited, which to my understanding is the case, it doesn't matter. That is literally the point of encryption, communication across adversarial channels . Unless you think Facebook has broken the laws of mathematics it's impossible for them to decrypt the content of messages without the users private keys.

The issue is what the client app does with the information after it is decrypted. As Snowden remarked after he released his trove, encryption works, and it's not like the NSA or anyone else has some super secret decoder ring. The problem is endpoint security is borderline atrocious and an obvious achilles heel - the information has to be decoded in order to display it to the end user, so that's a much easier attack vector than trying to break the encryption itself.

So the point other commenters are making is that you can verify all you want that the encryption is robust and secure, but that doesn't mean the app can't just send a copy of the info to a server somewhere after it has been decoded.

Re: US has investigated claims WhatsApp chats aren't private

#224

Post by subw00f »

maqp wrote: post #213
Barrin92 wrote: post #209

Earlier quoted context omitted.

as long as client side encryption has been audited, which to my understanding is the case, it doesn't matter. That is literally the point of encryption, communication across adversarial channels . Unless you think Facebook has broken the laws of mathematics it's impossible for them to decrypt the content of messages without the users private keys.

Well the thing is, the key exfiltration code would probably reside outside the TCB. Not particularly hard to have some function grab the signing keys, and send them to the server. Then you can impersonate as the user in MITM. That exfiltration is one-time and it's quite hard to recover from. I'd much rather not have blind faith on WhatsApp doing the right thing, and instead just use Signal so I can verify myself it's…

Not that I trust Facebook or anything but wouldn’t a motivated investigator be able to find this key exfiltration “function” or code by now? Unless there is some remote code execution flow going on.

Re: US has investigated claims WhatsApp chats aren't private

#225

Post by taneq »

giancarlostoro wrote: post #222
3rodents wrote: post #206

Earlier quoted context omitted.

By that standard, it can never be verified because what is running and what is reviewed could be different. Reviewing relevant elements is as meaningful as reviewing all the source code.

Or they could even take out the backdoor code and then put it back in after review.

Ah yes, the Volkswagen solution.

Re: US has investigated claims WhatsApp chats aren't private

#226

Post by ghurtado »

digdigdag wrote: post #202
martinralbrecht wrote: post #126

WhatsApp's end-to-end encryption has been independently investigated: https://kclpure.kcl.ac.uk/ws/files/324396471/whatsapp.pdf Full version here: https://eprint.iacr.org/2025/794.pdf We didn't review the entire source code, only the cryptographic core. That said, the main issue we found was that the WhatsApp servers ultimately decide who is and isn't in a particular chat. Dan Goodin wrote about it here: https://arst…

> We didn't review the entire source code Then it's not fully investigated. That should put any assessments to rest.

I have to assume you have never worked on security cataloging of third party dependencies on a large code base.

Because if you had, you would realize how ridiculous it is to state that app security can't be assessed until you have read 100% of the code

That's like saying "well, we don't know how many other houses in the city might be on fire, so we should let this one burn until we know for sure"

Re: US has investigated claims WhatsApp chats aren't private

#227

Post by coppsilgold »

No closed-source E2EE client can be truly secure because the ends of e2e are opaque.

Detecting backdoors is only truly feasible with open source software and even then it can difficult.

A backdoor can be a subtle remote code execution "vulnerability" that can only be exploited by the server. If used carefully and it exfiltrates data in expected client-server communications it can be all but impossible to detect. This approach also makes it more likely that almost no insider will even be aware of it, it could be a small patch applied during the build process or to the binary itself (for example, a bound check branch). This is also another reason why reproducible builds are a good idea for open source software.

Re: US has investigated claims WhatsApp chats aren't private

#228

Post by vbezhenar »

vimda wrote: post #189
vbezhenar wrote: post #87

Whatsapp is considered insecure and banned from use for military in Russia. Telegram, on the other hand, is widely used. Of course that's not something definitive, but just a food for thought.

Telegram which famously didn't have _any_ end to end encryption for ages, and even now only has very limited opt-in "secret chats"?

I'm not going to promote Telegram, just wanted to highlight that Whatsapp is not considered trustworthy by a geopolitical enemy of US. I don't think that Telegram is bad, and when your life depends on it, you can click "Secret Chat" button, it's not a big deal.

Re: US has investigated claims WhatsApp chats aren't private

#229

Post by ghurtado »

conscion wrote: post #158
gruez wrote: post #84

Earlier quoted context omitted.

>being end to end encrypted and separately uploaded to Facebook That's a cute loophole you thought up, but whatsapp's marketing is pretty unequivocal that they can't read your messages. >With end-to-end encryption on WhatsApp, your personal messages and calls are secured with a lock. Only you and the person you're talking to can read or listen to them, and no one else, not even WhatsApp https://www.whatsapp.com/ That…

My guess is that they are end-to-end encrypted. And because of Facebook's scale that they're able to probabilisticly guess at what's in the encrypted messages (e.g.a message with X hash has Y probability of containing the word "shoes")

> they're able to probabilisticly guess at

That's not how encryption works at all. At least not any encryption used in the last 100 years.

You'd probably have to go all the way back to the encryption methods of the Roman empire for that statement to make sense

Post reply on HN