US has investigated claims WhatsApp chats aren't private • Hacker News Board

Re: US has investigated claims WhatsApp chats aren't private

#381

Post by NoahZuniga » Tue, Feb 03, 2026, 11:36 AM UTC

morshu9001 wrote: post #379

NoahZuniga wrote: post #368

Earlier quoted context omitted.

> They can also tell your client it has the correct key. No they can't. Key transparency cryptographically makes sure everyone gets the same result.

Key transparency is a public list of keys, like what CAs do. That still trusts an authority. Of course a third party could archive/republish the key list and you could trust them instead of Whatsapp, but that's what I call an out of band key verification. These are all good measures though. It's much harder for Whatsapp to mass attack users this way.

Well, more than just that. For the published key transparency information to be trusted it has to not just be signed by WhatsApp, but also by an independent witness. In this case Cloudflare.

So for wa to do a man in the middle attack they would also need to convince Cloudflare to sign two inconsistent tree heads.

Re: US has investigated claims WhatsApp chats aren't private

#382

Post by uoaei » Tue, Feb 03, 2026, 3:55 PM UTC

maqp wrote: post #274

uoaei wrote: post #256

Earlier quoted context omitted.

Can they control private keys and do replay attacks?

Signal protocol prevents replay attacks as every message is encrypted with new key. Either it's next hash ratchet key, or next future secret key with new entropy mixed via next DH shared key. Private keys, probably not. WhatsApp is E2EE meaning your device generates the private key with OS's CSPRNG. (Like I also said above), exfiltration of signing keys might allow MITM but that's still possible to detect e.g. if you…

Whatsapp didn't implement Signal's protocol verbatim. They appropriated the core cryptographic security and then re-implemented the rest on their own servers. This removes all guarantees of secrecy as long as they can run arbitrary code on the servers they own.

Re: US has investigated claims WhatsApp chats aren't private

#383

Post by znpy » Tue, Feb 03, 2026, 11:35 PM UTC

gruez wrote: post #175

znpy wrote: post #14

I always assumed this to be true, to be honest. Nowadays all of the messaging pipeline on my phone is closed source and proprietary, and thus unverifiable at all. The iPhone operating system is closed, the runtime is closed, the whatsapp client is closed, the protocol is closed… hard to believe any claim. And i know that somebody’s gonna bring up the alleged e2e encryption… a client in control of somebody else might…

>Closed systems that do not support third party clients that connect through open protocols should ALWAYS be assumed to be insecure. So you're posting this from an open core CPU running on an open FPGA that you fabricated yourself, right? Or is this just a game of one-upmanship where people come with increasingly high standards for what counts as "secure" to signal how devoted to security they are?

Nah, i just accept stuff can be intercepted.

Life is about pragmatism.

Re: US has investigated claims WhatsApp chats aren't private

#384

Post by Revolution1120 » Mon, Feb 09, 2026, 11:40 PM UTC

xvector wrote: post #59

bogwog wrote: post #39

Earlier quoted context omitted.

> I don't really see how it's possible to mitigate client compromise Easy: pass laws requiring chat providers to implement interoperability standards so that users can bring their own trusted clients. You're still at risk if your recipient is using a compromised client, but that's a problem that you have the power to solve, and it's much easier to convince someone to switch a secure client if they don't have to worry…

You seem to think the government wants your messages to be private and would "pass laws" to this effect. Methinks you put far too much faith in the government, at least from my understanding of the history of cybersecurity :)

Information should certainly be kept confidential, but Chat Control is also necessary.Furthermore, the former is merely rigid laws and regulations, while the latter is used to prevent the Satanists, which is capable of committing all kinds of evil.

Re: US has investigated claims WhatsApp chats aren't private

#385

Post by Revolution1120 » Tue, Feb 10, 2026, 1:39 AM UTC

renegade-otter wrote: post #333

dang wrote: post #186

Earlier quoted context omitted.

Maybe so, but please don't post unsubstantive comments to Hacker News. We're trying for something different here.

Point taken, but I feel like going into details at this stage is redundant. There have been probably hundreds of discussions on this site regarding this topic. Books have been written about Facebook's and Zuckerberg's absent moral compass. To wit, from three days ago: https://www.msn.com/en-in/money/news/meta-ceo-mark-zuckerber... "While Zuckerberg reportedly wanted to prevent "explicit" conversations with younger te…

Over a decade ago, when Facebook held a monopoly, having one's first sexual experience at age 12 or even earlier was an incredibly prestigious and fashionable thing. If Zuckerberg truly held this view, it wouldn't be surprising at all; it would even be considered perfectly reasonable. And those who want to censor these things aren't leftists, but genuine conservatives. Despite the efforts of Musk and other Silicon Valley figures to distort the definition of conservative through their propaganda, and even with many people having short memories, their lies are easily exposed. Unless "having sex at age 12" is a long-standing American traditional value, it's no closer to conservatism than the so-called Muslim immigrants. Looking back now, the propaganda advocating for sex at age 12 may very well have been a carefully orchestrated global pedophile ideology infiltration by elite pedophiles of Epstein's class. It wasn't limited to the Americas or Europe; it was also widespread and accepted in China, Japan, South Korea, Taiwan, and Southeast Asia. After Epstein's death in 2019, has such propaganda decreased significantly? Is this a coincidence? It's very likely not a coincidence. This argument is worth exploring; following this line of thought might uncover even more valuable research on field of deep state. While Epstein was a billionaire, he wasn't exceptionally wealthy on paper and shouldn't have possessed such immense influence and control. Therefore, there's only one possibility is profound: Epstein was Satoshi Nakamoto!

Re: US has investigated claims WhatsApp chats aren't private

#386

Post by maqp » Wed, Feb 11, 2026, 11:03 AM UTC

cft wrote: post #375

maqp wrote: post #345

Earlier quoted context omitted.

Yeah it's really hard to block tally count of five IPs. https://telegramplayground.github.io/pyrogram/faq/what-are-t... No wonder the great Russian firewall is struggling to keep TG at bay. Wake up.

>Yeah it's really hard to block tally count of five IPs. They blocked 16m IPs, to the extent that it started affecting the entire Russian's internet stability, and Telegram was still available there: https://www.theguardian.com/world/2018/apr/17/russia-blocks-... >Wake up Is that a demand? A slogan? I wonder how much your own wokeness affects your ability to absorb facts.

The server IPs are hard-coded into the Telegram client's source:

https://github.com/DrKLO/Telegram/blob/d7deedfa33ddfa51c72a5...

You know you can just run

$ git clone https://github.com/DrKLO/Telegram.git && cd Telegram && FILE="TMessagesProj/jni/tgnet/ConnectionsManager.cpp" && git log --reverse --format='%ad %h %s' --date=short -S'149.154.175.50' -- "$FILE" | head -n 1 && git log --reverse --format='%ad %h %s' --date=short -S'2001:b28:f23d:f001:0000:0000:0000:000a' -- "$FILE" | head -n 1 && git log --reverse --format='%ad %h %s' --date=short -S'149.154.167.51' -- "$FILE" | head -n 1 && git log --reverse --format='%ad %h %s' --date=short -S'95.161.76.100' -- "$FILE" | head -n 1 && git log --reverse --format='%ad %h %s' --date=short -S'2001:67c:4e8:f002:0000:0000:0000:000a' -- "$FILE" | head -n 1 && git log --reverse --format='%ad %h %s' --date=short -S'149.154.175.100' -- "$FILE" | head -n 1 && git log --reverse --format='%ad %h %s' --date=short -S'2001:b28:f23d:f003:0000:0000:0000:000a' -- "$FILE" | head -n 1 && git log --reverse --format='%ad %h %s' --date=short -S'149.154.167.91' -- "$FILE" | head -n 1 && git log --reverse --format='%ad %h %s' --date=short -S'2001:67c:4e8:f004:0000:0000:0000:000a' -- "$FILE" | head -n 1 && git log --reverse --format='%ad %h %s' --date=short -S'149.154.171.5' -- "$FILE" | head -n 1 && git log --reverse --format='%ad %h %s' --date=short -S'2001:b28:f23f:f005:0000:0000:0000:000a' -- "$FILE" | head -n 1

To get when the IPs first appeared, right? :D

2015-09-24 6bb7547f5 Update to 3.2.2

2020-06-04 dceccae0b Update to 6.2.0 (1984)

2015-09-24 6bb7547f5 Update to 3.2.2

They've been the same IP addresses for ELEVEN years, and they precede the article you linked by THREE YEARS.

They're not playing the catch-up with Russian government. Either Russian government is completely incompetent in that they're blocking 3,000,000 IP addresses and failing, or they are LYING about attempting to block it, which would indicate Telegram is a Russian op.

Re: US has investigated claims WhatsApp chats aren't private

#387

Post by maqp » Wed, Feb 11, 2026, 1:41 PM UTC

hiprob wrote: post #371

maqp wrote: post #347

Earlier quoted context omitted.

The real story is, MAX is there to scare people into Telegram. Durov isn't your friend, neither is Putin who doesn't bother blocking connections to the server. >So I wouldn't count on its E2EE either. This is the worst way to assses E2EE deployment. 5D-chess. >Signal still requires a phone number and proprietary Google blobs on mobile. Telegram also requires a phone number. If you didn't have double standards, I bet…

>This is the worst way to assses E2EE deployment. 5D-chess. How would you explain the fact that WhatsApp remains unblocked in Russia, when all other major messengers except Telegram and Meta's own products all got banned there? >Telegram also requires a phone number. If you didn't have double standards, I bet you'd have no standards. Not my point. I'm pointing out a flaw that both messengers share. >TG has no idea ho…

>Loading your messages on Signal can take quite a while.

Yeah if you have to go through hundreds of ratchet steps, yeah it will take time. That's expected. The only way to make it faster than that is to deploy it without privacy. That's cheating.

>Why are you ignoring the fact Signal actively prohibits third-party clients?

Because it's not a problem for security.

>Yes, Telegram is far from perfect, and inferior to Signal when it comes to E2EE.

Telegram's lack of ubiquitous E2EE is a blocking issue. Signal's wait times is a problem that goes away with 5G, 6G etc., and with them nanometers going down.

>But what makes you reject the proprieatry blob claim when it's true?

What blobs? Firebase? I have bad news for you wrt Telegram https://github.com/DrKLO/Telegram?tab=readme-ov-file#compila...

>Because your favorite messenger is being attacked?

Not my favorite messenger. Nor is it my messenger. Signal is the best messenger for day-to-day use though.