103
Facebook owns what’s app and they can read any message on the service, they’ve also been known to give logs and messages to law enforcement agencies at request without warrants.
Why is it legal for them to advertise it as end-to-end encrypted then? I thought the main danger lies in WhatsApp insistence on backing up non-encrypted history to Google Drive/iCloud.
Of course, the existence of backdoors is usually not disclosed (duh), but can they actually read any message?
Why is it legal for them to advertise it as end-to-end encrypted then?
Because they are a multi-billion dollar company.
You can have end to end encryption over the wire and still have all of your shit harvested at the “endpoints”
It really sucks how a shit ton of money gives a company the ability to do anything they want and avoid legal consequences almost all of the time. It's a corrupt society we live in.
EU usually frowns upon that though. Sure, the fines are so small that it’s negligible for Meta, but there should be some fines. But all I find via quick googling are this year’s sanctions over personal data processing in Facebook/Instagram/WhatsApp. The nature of these data is not clear though.
I am not trying to say that WhatsApp is safe to use, mind you. I am pretty sure they will hand over all the info along with encryption keys at first government’s request (or any other highest bidder for that matter), but that’s only my perception of them as a company, with no hard proof at hand.
The EU has been trying to outlaw encryption for most of this year.
"The EU" isn't one singular person or party or state or whatever. There are some people who are trying to outlaw it but that doesn't mean that they're the majority or that it's even legal to do.
It’s not illegal because it is end to end encrypted when you send messages, but it’s not encrypted on your phone and they have access to that, not to mention, I imagine they have access to the keys used to encrypt the messages, so even if they backed it up encrypted they can still read the messages.
The point of implementing it is not to protect people from surveillance, but rather to make people think they’re protected so they’ll keep using the platform rather than moving to another service. Their actual claims about it amount to “If your on public Wi-Fi or something, people skimming that won’t be able to see your messages” which is absurd because they already couldn’t.
Admittedly, no law enforcement that they refuse to cooperate with will have access to the messages, but like, “law enforcement groups Facebook doesn’t cooperate with” is a very small list.
I believe this is down to what they define as being end to end encrypted.
It’s no secret that WhatsApp adopted Signal’s encryption protocol just before Meta acquired them, but since it’s all closed source we don’t know if they’ve changed anything since the announcement in 2016 that all forms of communications on WhatsApp are now encrypted and rolled out.
Within WhatsApp’s privacy policy, it’s important to note that they only mention end to end encryption when it comes to your messages. Everything else is apparently “fair game” for collection. Of note, the Usage and Log information point details all the metadata they collect on you automatically, including how you use the service; how long you use the service; your profile info; the groups you’re in; whether you’re online; and the last time you were online, to name a few things.
I guess what I’m trying to say is that technically they are end to end encrypted by definition, and whilst they’ve gone ahead and implemented things such as encrypted backups (that you must enable) to make it harder for them to read your message contents, they can still collect a lot of metadata on every user.
It’s no secret that WhatsApp adopted Signal’s encryption protocol just before Meta acquired them, but since it’s all closed source we don’t know if they’ve changed anything since the announcement in 2016 that all forms of communications on WhatsApp are now encrypted and rolled out.
There is an Open Source implementation of the WhatsApp protocol: yowsup
load more comments
(1 replies)
And the metadata is enough to get convictions. A person was convicted back in 2019 or so based on the metadata of her whatsapp conversation with a reporter. Natalie something, I think.
load more comments
(1 replies)
Probably not, but it's impossible to verify. There's a strong argument for open source when security really matters.
I think there is a strong argument for Foss for anything
You bet your ass they can. Since when has Facebook taken anybody's privacy seriously? And you remember all the Snowden leaks? Like how AT&T has been a government apparatus for spying for decades? Or how about the way that the USA taps under sea cables to monitor data, causing China to build totally parallel backbone infrastructure
The better question is whether Signal, despite being open source, is actually secure. It's very plausible that the govt has backdoors somewhere, for either encryption, the OS, the programming language, the app store, or some random dependency lib
The answer is yes, the US government spies on everything, and has a complete profile of everyone
Signal hasn't been compromised. It has been reviewed and is continuing to be reviewed by tons of researchers and security personnel.
Its also important to note that its used internally by goverment organizations in the US so it has to be at least reasonably secure.
Don't believe propaganda you read online.
load more comments
(3 replies)
They don't have to attack the encryption, there are far easier ways. Compromising your phone then reading the notification contents for example. If a smallish company can do this (pegasus) imagine what the resources of the US intelligence complex can do.
The easiest way by far is to intimidate you to give up your phone password and hand over the messages.
XKCD for refference: https://xkcd.com/538/
load more comments
(2 replies)
Another thing to consider is that the US (and probably most 5 eyes countries) have agencies with a "store now and decrypt later" policy. They theoretically could be capturing certain types of traffic and storing it in the massive NSA fusion centers. If you come under suspicion at some later date and the quantum technology has advanced, you could be hosed. Now what's the legality of storing "precrime material" without a warrant? I wouldn't think it is legal but that doesn't seem to stop the 3 letter agencies these days.
Everything I've ever heard about government cryptography from people close to me is that the government (FBI, military) is wildly far ahead of what's available publicly. I wouldn't count on anything you do on the Internet to be truly private.
That was at times of DES. Cryptography that is used today is proven to be complicated enough that it's unbreakable unless the government got quantum computing working at sufficient skale.
Like others wrote, attacks will happen when the messages are received and decrypted.
https://link.springer.com/chapter/10.1007/978-3-031-38551-3_11
Dated August 2023.
load more comments
(3 replies)
If you did not enable end-to-end encryption for your WhatsApp backups on Google Drive, the US government could possibly compel Google to hand over your encrypted (but not end-to-end encrypted) backup, and compel Meta to hand over the decryption keys for the backup.
Details about how WhatsApp backup works: The Workings of WhatsApp’s Backups (and Why You Should Enable End-to-End Encrypted Backups).
load more comments
(1 replies)
No. They cant decrypt your chats. They can however backdoor your device and see the pre or post delivery message. Its not hard for them to do. Technically or legally.
If they arent currently logging activity on your device then turning on self destruct messaging could mitigate their ability to spy on you. Unfortunately all your chat partners have to do it too.
People got arrested for WhatsApp messages in my country so there is a backdoor built in no question
That's mostly group chats and someone from the group showed the comments to the police.
load more comments
(1 replies)
this post has some good information.
tldr - you cant fully verify
The code is not open source, so it's hard to verify how good the encryption is or if it has backdoors.
I'm not an expert in cryptography, but from my limited knowledge, the cryptographic keys used are very important. If Meta or the government can somehow know the decryption key to your messages or predict it, then they can see your messages.
But they most likely don't need to decrypt it in transit. One of the vulnerabilities in this system is Google firebase, which delivers notifications to your phone when WhatsApp messages arrive. Ever noticed how those notifications include the message content and the sender? Google has access to this information, despite the encryption.
That's just an example. Google has access to a lot on your phone.
Another thing to consider is message metadata. The content of your message is encrypted, but what about information like the destination of your message, its recipients, time sent and received, and frequency? I'd even argue this is more important than content in many situations. Sometimes, linking person A to person B tells me a lot about person A.
Ever noticed how those notifications include the message content and the sender? Google has access to this information, despite the encryption.
Not necessarily. I work on a messaging app, and we only use firebase to "wake up" the app. Initially the notification doesn't display anything meaningful, but the app very quickly connects to the server (tells the app who it should connect with) and then the peer (to finally get the actual content). The notification is updated once we have the content. But it typically goes so fast that you only ever see the final version of the notification.
They can just ask Meta for the chats lol, don’t even have to probably already have access.
yowsup is an Open Source implementation of the WhatsApp protocol. So there is proper end-to-end encryption on the protocol level - that would only leave the possibility of having a backdoor in the "official" WhatsApp client, but none has been found so far. BTW, people do actually (try to) decompile the WhatsApp client (or the WhatsApp Web client which implements the same protocol and functionality) and look what it is doing.
For anyone really curious, it's not too difficult to hook into the WhatsApp Web client with your web browsers Javascript debugger and see what messages are sent.
load more comments
(7 replies)
The better question is, do you trust meta at all? I'm sure they have a way to read everyone's chats and would gladly hand over yours to the government if they want it.
It is impossible to say. If you are that concerned you should use something else
I personally wouldn't touch WhatsApp with a 10foot pole. As it is owned by Facebook, the company who earlier this year paid a company to compromise TAILS OS to find a pedo. Which its not the fact that they threw a pedo in jail. But the fact they compromised anonymity and in no way are a government body!!! So glowies be glowing hard at Facebook.
They also have done other spooky shit. Which is why the only reason I use Facebook is to sell my shit.
We could also talk about the OS and hardware your using to message people for security. If you want to know more read permanent record by Edward snowden. Its a great book and talks alot about PRISM and other spooky stuff
It does not matter how good the encryption is. The app on your device has to be able to decrypt the content to be able to show it to you. If it has access to the decrypted data, it could just send it somewhere. If it has access to your private key, it can leak it. Even if the app is open source, you do not know if the binary on your phone matches that source, unless it uses reproducible builds and you actually verify the binary on your particular device, after each update.
view more: next ›
this post was submitted on 09 Oct 2023
103 points (97.2% liked)
Privacy
31874 readers
423 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS