this post was submitted on 09 Oct 2023
104 points (97.3% liked)

Privacy

31952 readers
588 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

For open source messengers, you can check whether they actually encrypt your messages and whether the server has access to your encryption keys but what about WhatsApp? Since it's not open source, you can't be sure that the encryption keys aren't sent to the server, right? Has there been a case where a government was able to access WhatsApp chats without reading them from the phone itself?

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 14 points 1 year ago (4 children)

Why is it legal for them to advertise it as end-to-end encrypted then? I thought the main danger lies in WhatsApp insistence on backing up non-encrypted history to Google Drive/iCloud.

Of course, the existence of backdoors is usually not disclosed (duh), but can they actually read any message?

[–] [email protected] 21 points 1 year ago (3 children)

Why is it legal for them to advertise it as end-to-end encrypted then?

Because they are a multi-billion dollar company.

[–] __init__ 18 points 1 year ago

You can have end to end encryption over the wire and still have all of your shit harvested at the “endpoints”

[–] [email protected] 8 points 1 year ago

It really sucks how a shit ton of money gives a company the ability to do anything they want and avoid legal consequences almost all of the time. It's a corrupt society we live in.

[–] [email protected] 5 points 1 year ago (1 children)

EU usually frowns upon that though. Sure, the fines are so small that it’s negligible for Meta, but there should be some fines. But all I find via quick googling are this year’s sanctions over personal data processing in Facebook/Instagram/WhatsApp. The nature of these data is not clear though.

I am not trying to say that WhatsApp is safe to use, mind you. I am pretty sure they will hand over all the info along with encryption keys at first government’s request (or any other highest bidder for that matter), but that’s only my perception of them as a company, with no hard proof at hand.

[–] [email protected] 12 points 1 year ago (1 children)

The EU has been trying to outlaw encryption for most of this year.

[–] [email protected] 3 points 1 year ago

"The EU" isn't one singular person or party or state or whatever. There are some people who are trying to outlaw it but that doesn't mean that they're the majority or that it's even legal to do.

[–] [email protected] 12 points 1 year ago

It’s not illegal because it is end to end encrypted when you send messages, but it’s not encrypted on your phone and they have access to that, not to mention, I imagine they have access to the keys used to encrypt the messages, so even if they backed it up encrypted they can still read the messages.

The point of implementing it is not to protect people from surveillance, but rather to make people think they’re protected so they’ll keep using the platform rather than moving to another service. Their actual claims about it amount to “If your on public Wi-Fi or something, people skimming that won’t be able to see your messages” which is absurd because they already couldn’t.

Admittedly, no law enforcement that they refuse to cooperate with will have access to the messages, but like, “law enforcement groups Facebook doesn’t cooperate with” is a very small list.

[–] [email protected] 10 points 1 year ago (2 children)

I believe this is down to what they define as being end to end encrypted.

It’s no secret that WhatsApp adopted Signal’s encryption protocol just before Meta acquired them, but since it’s all closed source we don’t know if they’ve changed anything since the announcement in 2016 that all forms of communications on WhatsApp are now encrypted and rolled out.

Within WhatsApp’s privacy policy, it’s important to note that they only mention end to end encryption when it comes to your messages. Everything else is apparently “fair game” for collection. Of note, the Usage and Log information point details all the metadata they collect on you automatically, including how you use the service; how long you use the service; your profile info; the groups you’re in; whether you’re online; and the last time you were online, to name a few things.

I guess what I’m trying to say is that technically they are end to end encrypted by definition, and whilst they’ve gone ahead and implemented things such as encrypted backups (that you must enable) to make it harder for them to read your message contents, they can still collect a lot of metadata on every user.

[–] cmeerw 6 points 1 year ago (1 children)

It’s no secret that WhatsApp adopted Signal’s encryption protocol just before Meta acquired them, but since it’s all closed source we don’t know if they’ve changed anything since the announcement in 2016 that all forms of communications on WhatsApp are now encrypted and rolled out.

There is an Open Source implementation of the WhatsApp protocol: yowsup

[–] [email protected] 2 points 1 year ago

I’ve not seen this before. This is really neat! Thanks for sharing ❤️

[–] [email protected] 3 points 1 year ago (1 children)

And the metadata is enough to get convictions. A person was convicted back in 2019 or so based on the metadata of her whatsapp conversation with a reporter. Natalie something, I think.

[–] [email protected] 2 points 1 year ago

It wouldn’t surprise me if WhatsApp’s model on this is what the UK government were thinking of with the Online Safety Bill when they tried to enforce a back door in encrypted messengers.

It’s incredible just how much more interesting metadata can be than the actual message contents.

Explaining this to people when they ask why I don’t use WhatsApp is pretty difficult though.

I wouldn’t feel comfortable if I found out that what I thought was just a casual walk down the street mindlessly chatting with a friend turned out to also involve a third party neither of us were aware of tracking all of our movements.

[–] [email protected] 2 points 1 year ago (1 children)

It's very obvious to me that GBoard sends data directly to Google circumventing all encryption.

[–] [email protected] 2 points 1 year ago

👆👆👆👆👆👆 Came looking for this one. Because somehow Joe Average ends up with keyboards having "added value" like Giphy (from Meta) integration and online spell checkers because local dictionaries are to oldskool.