Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

351–360 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#351

Post by palata »

digiown wrote: post #321
palata wrote: post #285

Earlier quoted context omitted.

> but there needs to be a legal recourse for getting banned Agreed. > The client specs should be open so that an alternate client can be implemented An example that comes to mind is Signal, where they don't want that. They get a lot of criticism for it of course, but I think it the reasoning actually makes sense: in terms of security, allowing third-party clients is a security risk. If your threat model is "people wh…

I was intending that the alternate client should exist to function as an escape hatch. I fully expect most people will still use the default one, just like how people used the official reddit/telegram client when third party ones were available. The existence of an alternative constrains how much Facebook can enshittify the experience. E2EE is about secure transport between the endpoints. What happens to the message…

I don't think that it can work like that. If you make it fully open, you don't know what can happen. It cannot improve the security, it can only worsen it.

Suddenly you go from people using WhatsApp to people using random apps that you have no idea about, I think it's a step backward.

The "escape hatch", IMO, is an alternative messenger (like Signal). If Meta makes WhatsApp really bad, people can just switch to Signal. It's infinitely easier than moving away from AWS or the Microsoft Suite. The lock-in effect is really just that people can't be arsed to install it.

I think that the mere existence of Signal already forces Meta to keep WhatsApp relatively good. And to be fair, around me people like WhatsApp better because it has features they want and that Signal doesn't have.

Re: US has investigated claims WhatsApp chats aren't private

#352

Post by halapro »

abcd_f wrote: post #266

I witnessed something recently that points unambiguously at Whatsapp chats being not private. Not two months ago I sent a single photo to a friend of some random MacGyver kitchen contraption I made. Never described it, just a photo with the lol. He replied lol. He never reshared nor discussed it with anyone else. We never spoke about this before or after. Two days later he starts seeing ads on Facebook for a proper v…

Machines are really good at putting two and two together and humans are generally not. Are both of you completely sure that you didn't google anything related to the image before or after?

While Meta doesn't have access to the contents, they do know who you're texting and when.

Re: US has investigated claims WhatsApp chats aren't private

#353

Post by jqpabc123 »

Long story short, the world's largest privacy invaders have every incentive to subvert your privacy.

They do this at every opportunity. It's their bread and butter. It's how they make money.

The only reasonable assumption when dealing with them is that your privacy is being compromised. Proving it may not be possible but the incentive alone should be enough to convince a reasonable person that they do not deserve trust.

Re: US has investigated claims WhatsApp chats aren't private

#354

Post by trueno »

solenoid0937 wrote: post #116
youknownothing wrote: post #104

Just to throw in a couple of possibly outlandish theories: 1. as others have said, they could be collecting the encrypted messages and then tried to decrypt them using quantum computing, the Chinese have been reportedly trying to do this for many years now. 2. with metadata and all the information from other sources, they could infer what the conversation is about without the need to decrypt it: if I visit a page (Fa…

(1) made me chuckle. I've worked at nearly every FAANG including Meta. These companies aren't nearly as advanced or competent as you think. I no longer work at Meta, but in my mind a more likely scenario than (1) is: a senior engineer proposes a 'Decryption at Scale' framework solely to secure their E6 promo, and writes a 40-page Google Doc to farm 'direction' points for PSC. Five PMs repost this on Workplace to cele…

real

Re: US has investigated claims WhatsApp chats aren't private

#355

Post by cookiengineer »

afiori wrote: post #349
cookiengineer wrote: post #217

Earlier quoted context omitted.

Why did you not mention that the WhatsApp apk, even on non-google play installed devices, loads google tag manager's scripts? It is reproducibly loaded in each chat, and an MitM firewall can also confirm that. I don't know why the focus of audits like these are always on a specific part of the app or only about the cryptography parts, and not the overall behavior of what is leaked and transferred over the wire, and n…

Things like this combined with the countless ways to hide "feature flags" in a giant codebase makes me feel that anything less than "the entire app was verified + there is literally no way to dynamically load code from remote (so even no in app browser) + we checked 5 years of old versions and plan to do this for the next 5 years of update" is particularly meaningful. Still very important but my issue has never been…

Back in the days people called skype [1] spyware because it had lots of backdoors in it and lots of undocumented APIs that shouldn't have been in there.

The funny part was that skype was probably the most obfuscated binary that was ever available as "legitimate" software, so there were regular reversing events to see "how far" you could get from scratch to zeroday within 48h hackathons. Those were fun times :D

[1] Skype, pre Microsoft rebrand of Lync as Skype

Re: US has investigated claims WhatsApp chats aren't private

#357

Post by afiori »

some_furry wrote: post #134
martinralbrecht wrote: post #126

WhatsApp's end-to-end encryption has been independently investigated: https://kclpure.kcl.ac.uk/ws/files/324396471/whatsapp.pdf Full version here: https://eprint.iacr.org/2025/794.pdf We didn't review the entire source code, only the cryptographic core. That said, the main issue we found was that the WhatsApp servers ultimately decide who is and isn't in a particular chat. Dan Goodin wrote about it here: https://arst…

Thank you for actually evaluating the technology as implemented instead of speculating wildly about what Facebook can do based on vibes.

Vibes are a perfectly solid ground to refuse to engage with something.

Re: US has investigated claims WhatsApp chats aren't private

#358

Post by morshu9001 »

NoahZuniga wrote: post #350
morshu9001 wrote: post #326

Earlier quoted context omitted.

Even if your client is asking other clients to verify, what if everyone has the same wrong key for a particular user Whatsapp has chosen to spoof?

Well, surely your client knows what its own key is, and would notice that the listed key is wrong when it checks it.

They can also tell your client it has the correct key. Yours and the other clients are all talking to their mitm in this scenario. There's fundamentally no way to solve this without users verifying keys out-of-band.

Re: US has investigated claims WhatsApp chats aren't private

#359

Post by kachapopopow »

xvector wrote: post #56
kachapopopow wrote: post #50

yes, this is a very known fact that it is not E2EE but Client2Server Encrypted. Otherwise your message history wouldn't work.

This is a total misunderstanding of how E2EE works. I need to either enter my password or let the app access my iCloud Keychain to let it derive the backup encryption key. It's also well known that they worked with the Moxie's team to implement the same E2EE protocol as Signal. So messages are E2EE as well.

I can sign in from my apple device to my android device purely using my credentials so as far as I know it is just for show.

Re: US has investigated claims WhatsApp chats aren't private

#360

Post by chaps »

lazide wrote: post #338
chaps wrote: post #184

Earlier quoted context omitted.

Unfortunately a lot of investigations start out as speculation/vibes before they turn into an actual evaluation. And getting past speculation/vibes can take a lot of effort and political/social/professional capital before even starting.

Well yeah. If they had solid evidence at the start, why would they need an investigation?

It's not as obvious of an answer as it initially sounds. Coming at this from a stint in investigative journalism where even beginning an investigation requires getting grants and grants involve convincing other people that the money is going to good use. Also having been told that an investigation I ran was nothing by multiple editors that turned out to be something big... it really shifted how I perceive investigations and what it means to stick your neck out when everyone's telling you that something isn't happening even when it is.
Post reply on HN