US has investigated claims WhatsApp chats aren't private • Hacker News Board

Re: US has investigated claims WhatsApp chats aren't private

#301

Post by dagmx » Sat, Jan 31, 2026, 11:24 PM UTC

blindriver wrote: post #188

prakashn27 wrote: post #177

Ex-WhatsApp engineer here. WhatsApp team makes so much effort to make this end to end encrypted messages possible. From the time I worked I know for sure it is not possible to read the encrypted messages. From business standpoint they don’t have to read these messages, since WhatsApp business API provide the necessary funding for the org as a whole.

It only takes one engineer in all the teams at Whatsapp that has different directives to make all your privacy work completely useless.

How would you hide that? Unless you’re assuming nobody ever has to try and fix bugs or audit code to find it, and there’s some kind of closed off area of code that nobody thinks is suspicious. Or you maintain a complete second set of the app core libs that a few clandestine folks can access, and then hope nobody notices that the binaries don’t line up and crash logs are happening in obscured places.

Re: US has investigated claims WhatsApp chats aren't private

#302

Post by NoahZuniga » Sat, Jan 31, 2026, 11:26 PM UTC

M95D wrote: post #238

prakashn27 wrote: post #177

Ex-WhatsApp engineer here. WhatsApp team makes so much effort to make this end to end encrypted messages possible. From the time I worked I know for sure it is not possible to read the encrypted messages. From business standpoint they don’t have to read these messages, since WhatsApp business API provide the necessary funding for the org as a whole.

From what you know about WA, is it possible for the servers to MitM the connection between two clients? Is there a way for a client to independently verify the identity of the other client, such as by comparing keys (is it even possible to view them?), or comparing the contents of data packets sent from one client with the ones received on the other side? Thanks.

No.

Whatsapp uses key transparency. Anyone can check what the current published keys for a user are, and be sure they get the same value as any other user. Specifically, your wa client checks that these keys are the right key.

Whatsapp has a blog post with more details available.

Re: US has investigated claims WhatsApp chats aren't private

#303

Post by kachapopopow » Sat, Jan 31, 2026, 11:27 PM UTC

kachapopopow wrote: post #50

yes, this is a very known fact that it is not E2EE but Client2Server Encrypted. Otherwise your message history wouldn't work.

I guess I owe a clarification: Otherwise your message history wouldn't be available the moment you log in with your credentials*.

Re: US has investigated claims WhatsApp chats aren't private

#304

Post by kachapopopow » Sat, Jan 31, 2026, 11:29 PM UTC

ryanscio wrote: post #66

codexetreme wrote: post #54

Earlier quoted context omitted.

Might be a rookie question. But exactly why would chat history not work?

It would, just not on new devices without moving keys via already-trusted device. This is what WhatsApp presumably does

That's the thing, it does not and it has been known that it does not do this. The keys are stored on the server and the server sends them to your device on login. They do have some kind of machine-id encoded in it, but that is just for show.

Re: US has investigated claims WhatsApp chats aren't private

#305

Post by gherkinnn » Sat, Jan 31, 2026, 11:33 PM UTC

gruez wrote: post #166

gherkinnn wrote: post #111

Earlier quoted context omitted.

Allegations against a company who circumvented Android's security to track users? I don't have any proof that Meta stores WhatsApp messages but I feel it in my bones that at the very least tried to do so. And if ever that comes to light, precisely nobody will be surprised. https://cybersecuritynews.com/track-android-users-covertly/

>And if ever that comes to light, precisely nobody will be surprised. The amount of ambient cynicism on the internet basically makes this a meaningless statement. You could plausibly make the same claim for tons of other conspiracy theories, eg. JFK was assassinated by the CIA/FBI, Bush did 9/11, covid was intentionally engineered by the chinese/US government, etc.

Meta storing WhatsApp messages requires one mental leap: they found a secret way to hoover up WhatsApp messages. Everything else is their MO, including breaking systems to their advantage and having absolutely no scruples.

On the other hand, Occam's razor can barely keep up with the mental gymnastics required to paint Bush (or even Cheney) as the mastermind behind 9/11.

Re: US has investigated claims WhatsApp chats aren't private

#306

Post by Jamesbeam » Sat, Jan 31, 2026, 11:33 PM UTC

martinralbrecht wrote: post #126

WhatsApp's end-to-end encryption has been independently investigated: https://kclpure.kcl.ac.uk/ws/files/324396471/whatsapp.pdf Full version here: https://eprint.iacr.org/2025/794.pdf We didn't review the entire source code, only the cryptographic core. That said, the main issue we found was that the WhatsApp servers ultimately decide who is and isn't in a particular chat. Dan Goodin wrote about it here: https://arst…

Hello Professor Albrecht,

thank you for your work.

I’ve been looking for this everywhere the past few days but I couldn’t find any official information relating the use of https://signal.org/docs/specifications/pqxdh/ in the signal protocol version that WhatsApp is currently using.

Do you have any information if the protocol version they currently use provides post-quantum forward secrecy and SPQR or are the current e2ee chats vulnerable to harvest now, decrypt later attacks?

Thanks for your time.

Re: US has investigated claims WhatsApp chats aren't private

#307

Post by meatmanek » Sat, Jan 31, 2026, 11:40 PM UTC

sirpilade wrote: post #299

Is anybody using any open source, self-hosted solution with an UI on par to whatsapp? Asking for my wife

Matrix exists and really isn't too bad to self-host if you just want a small number of people. (If you federate with other servers, then you have more things to worry about -- increased attack surface, more visibility leading to more potential attackers, and the risk of unintentionally storing illegal content (e.g. CSAM) sent by people from other servers.)

The UI of Element (the most popular Matrix client) is more or less in line with any other chat app, but I guess it depends what you mean by "on par to whatsapp". Biggest downside I've found is that you can't search your messages on the mobile clients.

Re: US has investigated claims WhatsApp chats aren't private

#308

Post by hiprob » Sat, Jan 31, 2026, 11:46 PM UTC

maqp wrote: post #288

hiprob wrote: post #114

I know the default assumption with Telegram is that they can read all your messages, but unlike WhatsApp they seem less cooperative and I never got the notion that they ever read private messages until the Macron incident, and even then they do if the other party reports them. How come they are able to be this exception despite not having end to end encryption by default?

>I know the default assumption with Telegram is that they can read all your messages The client is open source. It's trivial to verify this is 100% factually happening. They have access to every group message. Every desktop message. Every message by default. If you enable secret chats for 1:1 mobile chats, you are now disclosing to Telegram you're actively trying to hide something from them, and if there ever was met…

Currently, the Russian government is trying to squeeze people out of Telegram and move them over to MAX: https://caspianpost.com/regions/russia-tightens-telegram-res... WhatsApp also operates in Russia, despite Instagram and Facebook being banned. So I wouldn't count on its E2EE either. Signal still requires a phone number and proprietary Google blobs on mobile. Many third-party Telegram clients exist - Signal allows none.

Re: US has investigated claims WhatsApp chats aren't private

#309

Post by charcircuit » Sat, Jan 31, 2026, 11:54 PM UTC

jokersarewild wrote: post #298

ghurtado wrote: post #226

Earlier quoted context omitted.

I have to assume you have never worked on security cataloging of third party dependencies on a large code base. Because if you had, you would realize how ridiculous it is to state that app security can't be assessed until you have read 100% of the code That's like saying "well, we don't know how many other houses in the city might be on fire, so we should let this one burn until we know for sure"

It sounds like your salary has depended on believing things like a partial audit is worthwhile in the case that a client is the actual adversary.

Except Meta is not an adversary. They are aligned with people who want private messaging.

Re: US has investigated claims WhatsApp chats aren't private

#310

Post by TZubiri » Sun, Feb 01, 2026, 12:13 AM UTC

singpolyma3 wrote: post #249

TZubiri wrote: post #231

Earlier quoted context omitted.

With all due respect to Stallman, you can actually study binaries. The claim Stallman would make (after punishing you for using Open Source instead of Free Software for an hour) is that Closed Software (Proprietary Software) is unjust. but in the context of security, the claim would be limited to Free Software being capable of being secure too. You may be able to argue that Open Source reduces risk in threat models w…

I was with you until you somehow claimed obfuscation can improve security, against all historical evidence even pre-computers.

I think you are conflating:

Is an unbreakable security mechanism

with

Improves security

anything that complicates an attacker improves security, at least grossly. That said, then there might be counter effects that make it a net loss or net neutral.