Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp whitepaper removed sentence about never having access to private keys

twitter.com

Post reply on HN
Print view View original

91–100 of 111 posts

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#91

Post by jjoonathan »

luto wrote: post #79
trollied wrote: post #7

A TD:DR; for people. The "WhatsApp Encryption Overview" technical whitepaper [1] had the following text removed between revisions: "At no time does the WhatsApp server have access to any of the client's private keys." [1] https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857...

Instead, they added the following on page 13: > The WhatsApp server has no access to the client’s private keys, (...)

We delete them right after we mirror them to the NSA through our ultra-security SolarWinds box, promise!

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#92

Post by LockAndLol »

AkshitGarg wrote: post #44
LockAndLol wrote: post #10

Earlier quoted context omitted.

It doesn't mean they don't either. It's the removal of the previous claim that's worrying. But honestly, it doesn't matter anyway since Whatsapp is somehow able to backup all your data on Google Drive and restore it on separate phones. How are they able to do that without backing up the private key? https://faq.whatsapp.com/android/chats/how-to-restore-your-c...

The backups are unencrypted as highlighted in the UI (if I recall correctly). They re-generate the keys when you switch phones / re-install / clear data. That's when you get to see the "XYZ's security code changed" service message

I guess it makes sense. Doesn't make a difference if you deliver the chest with the key to the lock or the chest without the lock.

> For example, if you use a data backup service integrated with our Services (like iCloud or Google Drive), they will receive information you share with them, such as your WhatsApp messages.

https://www.whatsapp.com/legal/updates/privacy-policy/?lang=...

Looks like you're right, it must be unencrypted.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#93

Post by jonshariat »

luto wrote: post #79
trollied wrote: post #7

A TD:DR; for people. The "WhatsApp Encryption Overview" technical whitepaper [1] had the following text removed between revisions: "At no time does the WhatsApp server have access to any of the client's private keys." [1] https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857...

Instead, they added the following on page 13: > The WhatsApp server has no access to the client’s private keys, (...)

Good point. Here is the full text

>All chats use the same Signal protocol outlined in this whitepaper, regardless of their end-to-end encryption status. The WhatsApp server has no access to the client’s private keys, though if a business user delegates operation of their Business API client to a vendor, that vendor will have access to their private keys - including if that vendor is Facebook.

Not sure if the facebook exception was there in the previous version.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#94

Post by dunefox »

saurik wrote: post #73
therealtbs wrote: post #69

Earlier quoted context omitted.

Yes, everyone is in complete hysterics exactly because Facebook is evil (by the definition "harmful or tending to harm" (OED) or "morally reprehensible" (Merriam-Webster)). Just remember the recent(-ish) Oculus controversy, where they forced everyone who bought their hardware to sign in with Facebook and in some cases (soft-)bricked users devices because their Facebook accounts did not have enough activity [1]. Espec…

And when Facebook is doing something evil, I actively blast them for it; in particular, I have been extremely vocal with everyone I know about many aspects of the Oculus account issue, which I consider to be extremely evil when combined with their closed store model and DRM setup with developer account revocation (etc. I am somewhat famous for being a broken record on some topics, so I will try to avoid going into to…

Facebook logs all metadata that is available from WhatsApp as well. I'd rather have my metadata on matrix servers than on FB servers - at least it's not connected to my phone number, which is tied to my real identity. Also, matrix doesn't upload my entire contact list to Facebook. If it's secure enough for the german military and the entire french government, it's certainly secure enough for me.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#95

Post by dunefox »

xrisk wrote: post #83
MajesticHobo2 wrote: post #81

Earlier quoted context omitted.

Services hosted outside the US offer less protection against US intelligence agencies, not more.

Somehow I don’t buy it. Care to explain? One would think that being hosted on US soil makes it more likely to get backdoored by NSA type agencies.

IMO no location offers any protection against NSA et al. The US spy on friend and foe alike.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#96

Post by vin047 »

saurik wrote: post #76
vin047 wrote: post #64

Earlier quoted context omitted.

Thanks for posting this. I was considering making the jump to a new messenger but decided to wait and see what others had to say about the changes to the privacy policy and what it actually means from a privacy perspective. The use case for businesses to be able to use it for hosted clients (probably hosted and with messages stored by facebook) makes sense, and doesn't seem as bad as its been made out to be – still g…

Matrix is pretty open about how it hasn't been able to do anything about metadata leakage (which they have even at some times claimed is somewhat inherent to its federated nature; I think that is an overstatement, but is something that even they seem to believe). https://matrix.org/blog/wp-content/uploads/2017/02/2017-02-0... > Matrix does not protect metadata currently; server admins can see who you talk to & when (…

Thanks for the info. I was under the impression that you were claiming that Matrix is less secure than WhatsApp. If they both leak metadata then they're roughly equal from a privacy perspective no? I guess with WhatsApp you can't know the extent of metadata leakage, but at least with Matrix, you have the advantage of knowing precisely what data is leaked.

Not trying to push Matrix or anything, i've been using Signal for some time already anyway, but thought i'd see what alternatives there are. The lack of chat backups is a real drawback, though since the Android version has a backup option, i'm hoping it's something they'll eventually implement?

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#97

Post by tpxl »

xrisk wrote: post #83
MajesticHobo2 wrote: post #81

Earlier quoted context omitted.

Services hosted outside the US offer less protection against US intelligence agencies, not more.

Somehow I don’t buy it. Care to explain? One would think that being hosted on US soil makes it more likely to get backdoored by NSA type agencies.

Technically they can't spy on US citizens without a warrant. Practically: Lol.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#98

Post by zadokshi »

jonshariat wrote: post #93
luto wrote: post #79

Earlier quoted context omitted.

Instead, they added the following on page 13: > The WhatsApp server has no access to the client’s private keys, (...)

Good point. Here is the full text >All chats use the same Signal protocol outlined in this whitepaper, regardless of their end-to-end encryption status. The WhatsApp server has no access to the client’s private keys, though if a business user delegates operation of their Business API client to a vendor, that vendor will have access to their private keys - including if that vendor is Facebook. Not sure if the facebook…

> “The _WhatsApp_ server has no access to the client’s private keys”

This is craftily ambiguous.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#99

Post by eloff »

parliament32 wrote: post #80
eloff wrote: post #30

Earlier quoted context omitted.

WhatsApp promises end to end encryption, with no access to the content of your messages, just like iMessage and signal. This tweet doesn't establish otherwise.

The app can still provide end-to-end encryption while simultaneously piping your private keys direct to FB. They're not really related.

Of course it's related. To do that undermines the entire point of end to end encryption. It's a strong allegation with no evidence to support it.

It would also completely invalidate their "we don't have the keys" defence to law enforcement requests.

Re: WhatsApp whitepaper removed sentence about never having access to private keys

#100

Post by pindab0ter »

zadokshi wrote: post #98
jonshariat wrote: post #93

Earlier quoted context omitted.

Good point. Here is the full text >All chats use the same Signal protocol outlined in this whitepaper, regardless of their end-to-end encryption status. The WhatsApp server has no access to the client’s private keys, though if a business user delegates operation of their Business API client to a vendor, that vendor will have access to their private keys - including if that vendor is Facebook. Not sure if the facebook…

> “The _WhatsApp_ server has no access to the client’s private keys” This is craftily ambiguous.

Craftily specific, more like.
Post reply on HN