Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reporting a user to WhatsApp forwards a copy of recent messages from that chat

wabetainfo.com

Post reply on HN
Print view View original

71–80 of 173 posts

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#71

Post by Raphmedia »

aerovistae wrote: post #46

It's pretty hard to imagine a circumstance in which I would be reporting a WhatsApp user. This isn't like a public forum. These are one-on-one conversations or group chats with people who were specifically invited. If someone was a problem, I would just block them. Why would you ever report someone? I haven't ever heard of this happening.

Imagine someone trampling kittens and sending the result to random strangers. Sure, you can ignore them... but the kittens would still keep dying. So you report it and hope for the best.

Now change "trampling kittens" for any kinds of unwanted messages.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#72

Post by beagle3 »

_eqet wrote: post #32
eldridgea wrote: post #29

Earlier quoted context omitted.

While I share your general suspicion I don't think they need to see the messages to get a lot of privacy-violating use out of WhatsApp. When the NSA was talking about metadata collection, they said it was more useful than actual data. Likely because it's already computer consumable, and less dense. If FB gets your contact lists, and sees who you message, how much, and when, that's probably a hugely valuable commodity…

Maybe true, however computing power has increased substantially since then. It's quite easy for them to index all the messages and search for them later, or setup alerts on key words.

Metadata is more useful than data in the sense that data may be “encrypted” using a different unknown scheme between every two users (e.g. a hitman may discuss “a job”, a bribe might be described as “a gift”, a non public stock tip might be “weather is going to be good tomorrow”).

However, metadata is always what it is. If you have someone who is distance 2 from 20 people who died unnaturally, but not distance 1 - that person is likely related to their untimely death.

The reason metadata is useful is because, unlike the text, it is generally required to be unobfuscated to 3rd parties for the communication to be useful to the 1st and 2nd parties.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#73

Post by gonehome »

sneak wrote: post #49
est31 wrote: post #4

> WhatsApp can now read your recent messages when you report a user This feature is just an extension of manually making a screenshot and attaching it to the messages. As much as I like E2EE, I don't see where the problem lies? It's you who opts in into getting a third party involved. E2EE doesn't mean that no third party is ever going to see the content, it only means that nobody sees it by default .

> As much as I like E2EE, I don't see where the problem lies? It's a step along a continuum where the end-to-end encrypted messenger wasn't uploading plaintext before, and now it is. Apple's similar previously end-to-end encrypted iMessage went through a similar evolution: now iOS uploads the complete iMessage plaintext history to Apple (with Apple keys) via iCloud Backup. We now know that Facebook deems it okay to e…

Is the iCloud bit true?

I've read HN comments about it, but when I've tried to understand it by searching around it looks like it is encrypted end-to-end and in iCloud backup (as long as you're not in China).

https://support.apple.com/en-us/HT209110#:~:text=We%20design....

https://support.apple.com/en-us/HT202303

Is there some subtlety I'm missing?

That said, on this particular issue I think FB is striking a pretty good middle ground. Keeping things encrypted end-to-end for users, but allowing users to voluntarily report decrypted messages from their end is a good way to combat child abuse imagery and other illegal content without giving FB or governments back door key access.

I have a friend on the data science team at whatsapp and his team is responsible for combatting child abuse imagery groups on whatsapp - it's a huge problem.

A related comment I wrote when this came up previously: https://news.ycombinator.com/item?id=23553997

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#74

Post by est31 »

Asraelite wrote: post #62
sneak wrote: post #53

Earlier quoted context omitted.

I imagine that the API-based uploads of the recent decrypts from the user being reported can also be faked, so I'm not sure that this is a very important distinction.

There is some difference in the skill level required to convincingly craft a fake screenshot versus to spoof an API request, but yeah, it's not a huge difference.

The fact that it's an API request will make it easier to create checks. For example, they could check if the length of the messages match with the length of the encrypted ciphertext the server sent. In theory you can do with this a screenshot already, by redigitizing the content, but it's harder. Or they could check whether the received/sent/etc dates match with what the servers recorded, etc.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#75

Post by legulere »

keyme wrote: post #16

Just FYI, the Google Drive backup of your "E2E encrypted" whatsapp messages is stored in plain text... https://faq.whatsapp.com/android/chats/about-google-drive-ba...

Also on iOS on iCloud. Thanks for that hint. I turned off the backup functionality.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#76

Post by Alex3917 »

sneak wrote: post #53
rodorgas wrote: post #42

Earlier quoted context omitted.

The difference is that a screenshot may be fake. If the intermediary is revealing user private messages, it’s a stronger evidence than just making up a photoshopped screenshot.

I imagine that the API-based uploads of the recent decrypts from the user being reported can also be faked, so I'm not sure that this is a very important distinction.

> I imagine that the API-based uploads of the recent decrypts from the user being reported can also be faked, so I'm not sure that this is a very important distinction.

That assumes that the decrypted messages aren't signed (e.g. via HMAC), no?

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#77

Post by spoondan »

varispeed wrote: post #13
est31 wrote: post #4

> WhatsApp can now read your recent messages when you report a user This feature is just an extension of manually making a screenshot and attaching it to the messages. As much as I like E2EE, I don't see where the problem lies? It's you who opts in into getting a third party involved. E2EE doesn't mean that no third party is ever going to see the content, it only means that nobody sees it by default .

Does it mean messages can be read without agreement? Let's imagine "a glitch" where operator sees that user has opt in, but they didn't - can they see messages?

No. WhatsApp does not keep delivered messages, and, by default, messages are end-to-end encrypted and cannot be read by WhatsApp.[1] As shown in the screenshots of the reporting feature in the article, reporting causes your phone to send (forward) the relevant messages from your phone to WhatsApp as part of the report. For reporting a user or business, the relevant messages are "most recent messages" from the user/business. For reporting a group, the relevant messages are "most recent messages" in the group.

This feature does not change the privacy story for WhatsApp in any way. You already trust users you are chatting with to not copy or screenshot private messages and share them. You already trust the app to not forward or store your messages without your consent.

[1] See bullet point "Your Messages" under section "Information We Collect" on https://www.whatsapp.com/legal/privacy-policy.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#78

Post by beagle3 »

There have been several unofficial reports of Facebook unifying the backend messaging among Instagram, WhatsApp and FB Messenger. If and when that happens, E2EE on WhatsApp will finally be completely gone.

Anyone knows how far along (or canceled) that plan is?

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#79

Post by merlinscholz »

ffpip wrote: post #31
pw6hv wrote: post #28

Earlier quoted context omitted.

So it is not only Facebook that has complete access to the message history, but also Google. The funny thing is that I cannot find a way to access that backup myself, is anyone aware of a method to download that backup as a data dump and inspect it?

I don't know if it is included in your Google takeout. 98% of users enable that option. The fact that whatsapp is e2ee is a complete lie. Use Signal for true e2ee, or if you don't like it, Telegram. Telegram stores everything in the cloud tho. (they haven't disclosed any private messages, and are much more trustworthy than Whatsapp). They just wanted to back up messages without giving it to Google/Apple

Isn't telegram by default not encrypted? I thought only "private" chats are being e2ee.

Re: Reporting a user to WhatsApp forwards a copy of recent messages from that chat

#80

Post by ianmiers »

sneak wrote: post #53
rodorgas wrote: post #42

Earlier quoted context omitted.

The difference is that a screenshot may be fake. If the intermediary is revealing user private messages, it’s a stronger evidence than just making up a photoshopped screenshot.

I imagine that the API-based uploads of the recent decrypts from the user being reported can also be faked, so I'm not sure that this is a very important distinction.

Assuming whatsapp uses the same message franking mechanism Facebook's encrypted chats use, no. Ciphertexts are authenticated so that the contents of them can be verified using a key held on Facebooks servers (and crucially that key allows you to forge those transcripts, so someone can't use the stolen key to publicly confirm the contents of someone's messages as with DKIM). See https://eprint.iacr.org/2019/016
Post reply on HN