Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

311–320 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#311

Post by jokersarewild »

Hackbraten wrote: post #297
abcd_f wrote: post #266

I witnessed something recently that points unambiguously at Whatsapp chats being not private. Not two months ago I sent a single photo to a friend of some random MacGyver kitchen contraption I made. Never described it, just a photo with the lol. He replied lol. He never reshared nor discussed it with anyone else. We never spoke about this before or after. Two days later he starts seeing ads on Facebook for a proper v…

It takes more than two days to develop and roll out a new product. That goes for kitchen appliances, too.

I don't think the claim was that the commercial device never existed but that it was too obscure for the friend to randomly independently get targeted ads about it..

But I don't think WhatsApp takes many steps to protect media and in many cases the user really wants to backup media or share in other apps, etc, over security for media.

Re: US has investigated claims WhatsApp chats aren't private

#312

Post by fasbiner »

miduil wrote: post #195
vpShane wrote: post #187

Earlier quoted context omitted.

> We didn't review the entire source code And, you don't see the issue with that? Facebook was bypassing security measures for mobile by sending data to itself on localhost using websockets and webrtc. https://cybersecuritynews.com/track-android-users-covertly/ An audit of 'they can't read it cryptographically' but the app can read it, and the app sends data in all directions. Push notifications can be used to read m…

> Push notifications can be used to read messages. Are you trying to imply that WhatsApp is bypassing e2e messaging through Push notifications? Unless something has changed, this table highlights that both Signal and WhatsApp are using a "Push-to-Sync" technique to notify about new messages. https://crysp.petsymposium.org/popets/2024/popets-2024-0151....

Nothing changed, but many people struggle to understand their our own degree of relative ignorance and overvalue high-level details that are leaky abstractions which make the consequentially dissimilar look superficially similar.

Re: US has investigated claims WhatsApp chats aren't private

#313

Post by fasbiner »

ghurtado wrote: post #226
digdigdag wrote: post #202

Earlier quoted context omitted.

> We didn't review the entire source code Then it's not fully investigated. That should put any assessments to rest.

I have to assume you have never worked on security cataloging of third party dependencies on a large code base. Because if you had, you would realize how ridiculous it is to state that app security can't be assessed until you have read 100% of the code That's like saying "well, we don't know how many other houses in the city might be on fire, so we should let this one burn until we know for sure"

What you are saying is empirically false. Change in a single line of executed code (sometimes even a single character!) can be the difference between a secure and non-secure system.

This must mean that you have been paid not to understand these things. Or perhaps you would be punished at work if you internalized reality and spoke up. In either case, I don't think your personal emotional landscape should take precedence over things that have been proven and are trivial to demonstrate.

Re: US has investigated claims WhatsApp chats aren't private

#314

Post by hedora »

giancarlostoro wrote: post #222
3rodents wrote: post #206

Earlier quoted context omitted.

By that standard, it can never be verified because what is running and what is reviewed could be different. Reviewing relevant elements is as meaningful as reviewing all the source code.

Or they could even take out the backdoor code and then put it back in after review.

This is why signal supports reproducible builds.

Re: US has investigated claims WhatsApp chats aren't private

#315

Post by cft »

maqp wrote: post #291
cft wrote: post #167

I trust Telegram more: Putin never had any problems with Whatsapp, only with Telegram.

No end-to-end encryption by default. WhatsApp has. No end-to-end encryption for groups. WhatsApp has. No end-to-end encryption on desktop. WhatsApp has. No break-in key-recovery. WhatsApp has. Inferring Telegram's security from public statements of *checks notes* former KGB officer and FSB director -- agencies that wrote majority of the literature in maskirovka, isn't exactly reliable, wouldn't you agree?

Telegram has private chats. I don't pay attention to his words, indeed. Way before the Ukrainian war, Russia had a massive campaign trying to block Telegram and they failed on a technical level. This has never happened with WhatsApp.

Re: US has investigated claims WhatsApp chats aren't private

#316

Post by monocasa »

maqp wrote: post #271
impure-aqua wrote: post #253

Earlier quoted context omitted.

WhatsApp performs dynamic code loading from memory, GrapheneOS detects it when you open the app, and blocking this causes the app to crash during startup. So we know that static analysis of the APK is not giving us the whole picture of what actually executes. This DCL could be fetching some forward_to_NSA() function from a server and registering it to be called on every outgoing message. It would be trivial to hide i…

"Many forms of dynamic code loading, especially those that use remote sources, violate Google Play policies and may lead to a suspension of your app from Google Play." https://developer.android.com/privacy-and-security/risks/dyn... I wonder if that would deter Meta.

Some apps have always been more equal than others.

Re: US has investigated claims WhatsApp chats aren't private

#317

Post by fasbiner »

gruez wrote: post #174
p1anecrazy wrote: post #159

Earlier quoted context omitted.

I guess their point was that Russian military doesn‘t care if Russian intelligence reads their messages

Maybe OP should clearly state their thesis rather than beating around the bush with "... just a food for thought", so we don't have to guess what he's trying to say.

I think the point was pretty clear if you are able to consider more than one point of view. People who are highly motivated and for whom it could make a life-or-death difference have considerable technical skills in this area in Russia consider Whatsapp to be insecure and prohibit its use, just as in the US, their counterparts consider telegram to be insecure and prohibit its use.

Perhaps you're simply struggling with the concepts here: would it help you to understand things better to add that russia and the US ban the use of Signal by their militaries and intelligence services?

Did you detect an implication that can't be extrapolated from the text without metacontext and secondary unstated axioms, or is your mind totally blank and baffled at what these data points could indicate?

Re: US has investigated claims WhatsApp chats aren't private

#318

Post by chaps »

itsthecourier wrote: post #208
miduil wrote: post #195

Earlier quoted context omitted.

> Push notifications can be used to read messages. Are you trying to imply that WhatsApp is bypassing e2e messaging through Push notifications? Unless something has changed, this table highlights that both Signal and WhatsApp are using a "Push-to-Sync" technique to notify about new messages. https://crysp.petsymposium.org/popets/2024/popets-2024-0151....

Push-to-Sync. We observed 8 apps employ a push-to-sync strat- egy to prevent privacy leakage to Google via FCM. In this mitigation strategy, apps send an empty (or almost empty) push notification to FCM. Some apps, such as Signal, send a push notification with no data (aside from the fields that Google sets; see Figure 4). Other apps may send an identifier (including, in some cases, a phone num- ber). This push notif…

Is that not still incredibly vulnerable to timing attacks?

Re: US has investigated claims WhatsApp chats aren't private

#319

Post by digiown »

tptacek wrote: post #281
digiown wrote: post #262

Earlier quoted context omitted.

We probably can't make it free for all, but for something like a messaging app, we also need to recognize that it isn't optional to function in society. It should be regulated more like a utility: - Facebook can still control the identity, but there needs to be a legal recourse for getting banned, and their policies can't discriminate against viewpoints, for example - The client specs should be open so that an altern…

Telegram isn't E2EE by default in the first place (and isn't E2EE for group messages at all).

I meant the platform openness aspect, that you are allowed to use alternate clients, but the identity is centralized E2EE is largely independent of this choice.

Re: US has investigated claims WhatsApp chats aren't private

#320

Post by hedora »

None of the statements I’ve seen from Meta, people formerly involved in WhatsApp that chimed in here (thanks!), or the quotes from the investigation are incompatible with the whistleblowers’ allegations.

At this point, I won’t trust anything short of this on the front page of an SEC filing, signed by zuck and the relevant management chain:

“The following statement is material to earnings: Facebook has never (since E2EE was rolled out) and will never access messages sent through whatsapp via any means including the encryption protocol, application backdoor moderation access or backup mechanisms. Similarly, it does not provide third parties with access to the methods, and does not have the technical capability to do so under any circumstances.”

Post reply on HN