For open source messengers, you can check whether they actually encrypt your messages and whether the server has access to your encryption keys but what about WhatsApp? Since it’s not open source, you can’t be sure that the encryption keys aren’t sent to the server, right? Has there been a case where a government was able to access WhatsApp chats without reading them from the phone itself?
Governments, if they want, can decrypt any chat, not just Whatscrap. But it makes a difference if a chat, especially this Zuckerbot shit, directly opens a Backdoor to governments, to give them access, or if they have to bother hacking the chats themselves, which due to its cost and time, is only done with a court order.
Governments, if they want, can decrypt any chat
Any source for that claim?
Relevant xkcd as always https://xkcd.com/538/
I mean, it’s possible given their resources… It just takes long enough to be unfeasible. Also, in special circumstances they can Pegasus your phone and obtain the info without decrypting… Not like you’re not screwed anyways when it comes to such drastic measures.
Governments, if they want, can decrypt any chat
This is not true. Encryption that is not breakable by anyone - including governments - and the tools to use it have been available to everyone for decades now.
It might be broken later (which is why the US stores encrypted messages) but not right now, and is unlikely to be in the foreseeable future.
They can, all goverments nowadays have at thei disposal Quantum computer, provided by large companies (Google, IBM, Facebook, M$…) Not being able to decrypt messages was valid, in part, a few years ago, but not longer. Microsoft itself is now moving away from using passwords, using logins with physical keys for this reason and others will follow soon. Chat messages are no longer secure, while they do not also use quantum technology. But don’t worry, as long as you don’t attract attention for being a pedophile or for belonging to a terrorist group, no one is going to bother decoding your messages. Also the Germans in the II WW thought that nobody can read their with Enigma encrypted messages, fail.
You comment is wrong and misinformed. Quantum computing isn’t able to break RSA 2048 yet. Also passwords aren’t related to quantum computing.
What you wrote is science fiction, not fact. So are practical quantum computers, thus far.
It also ignores the fact that quantum computing would do shit all against symmetric encryption (though admittedly that’s less relevant for whatsapp, but it’s perfectly relevant if you want to exchange secure messages with someone you met physically prior); as well as the fact quantum-resistant encryption algorithms such as NTRU already exist and are already considered for implementation in free software tools (the only reason they aren’t is they’re far less tested and nobody trusts them yet against conventional attacks).
deleted by creator
The better question is, do you trust meta at all? I’m sure they have a way to read everyone’s chats and would gladly hand over yours to the government if they want it.
They can just ask Meta for the chats lol, don’t even have to probably already have access.
deleted by creator
If you did not enable end-to-end encryption for your WhatsApp backups on Google Drive, the US government could possibly compel Google to hand over your encrypted (but not end-to-end encrypted) backup, and compel Meta to hand over the decryption keys for the backup.
Details about how WhatsApp backup works: The Workings of WhatsApp’s Backups (and Why You Should Enable End-to-End Encrypted Backups).
I know that WhatsApp backups aren’t safe and I never turned them on
Another thing to consider is that the US (and probably most 5 eyes countries) have agencies with a “store now and decrypt later” policy. They theoretically could be capturing certain types of traffic and storing it in the massive NSA fusion centers. If you come under suspicion at some later date and the quantum technology has advanced, you could be hosed. Now what’s the legality of storing “precrime material” without a warrant? I wouldn’t think it is legal but that doesn’t seem to stop the 3 letter agencies these days.
People got arrested for WhatsApp messages in my country so there is a backdoor built in no question
That’s mostly group chats and someone from the group showed the comments to the police.
Dunno
Everything I’ve ever heard about government cryptography from people close to me is that the government (FBI, military) is wildly far ahead of what’s available publicly. I wouldn’t count on anything you do on the Internet to be truly private.
That was at times of DES. Cryptography that is used today is proven to be complicated enough that it’s unbreakable unless the government got quantum computing working at sufficient skale.
Like others wrote, attacks will happen when the messages are received and decrypted.
They don’t have to attack the encryption, there are far easier ways. Compromising your phone then reading the notification contents for example. If a smallish company can do this (pegasus) imagine what the resources of the US intelligence complex can do.
The easiest way by far is to intimidate you to give up your phone password and hand over the messages.
XKCD for refference: https://xkcd.com/538/
Shouldn’t the phone disk be encrypted too?
Doesn’t matter if the phone is compromised while turned on.
It is impossible to say. If you are that concerned you should use something else
No. They cant decrypt your chats. They can however backdoor your device and see the pre or post delivery message. Its not hard for them to do. Technically or legally.
If they arent currently logging activity on your device then turning on self destruct messaging could mitigate their ability to spy on you. Unfortunately all your chat partners have to do it too.
No. One-to-one chats are E2EE. However, group chats, if forced by government, can be subpoenaed and monitored by WhatsApp admin team temporarily.
However, the best way to break encryption is usually a $5 wrench on someone’s head, which is how governments and authorities really do it.
Group chats are also end-to-end encrypted in WhatsApp (so any monitoring would need to be done in cooperation with one of the participants’ devices before encryption or after decryption)
In a subpoena case in India, that turned out to be not true. WhatsApp admins hold keys to being able to do that under law pressure. They only guarantee it for 1-1 messages and statuses, and against “generic” actors for group chats…
In a subpoena case in India, that turned out to be not true.
Source please.
WhatsApp admins hold keys to being able to do that under law pressure.
How do they get the keys?
They only guarantee it for 1-1 messages and statuses, and against “generic” actors for group chats…
Who is “they”?
I read about it long ago, it is a bit more complicated than that. https://haniahshafi.medium.com/are-whatsapp-group-chats-vulnerable-to-spying-despite-end-to-end-encryption-ab0e522fa8d9
In a subpoena case in India, that turned out to be not true. WhatsApp admins hold keys to being able to do that under law pressure. They only guarantee it for 1-1 messages and statuses, and against “generic” actors for group chats…
They only guarantee it for 1-1 messages and statuses, and against “generic” actors for group chats…
Who is “they”?
May I ask you what is with this passive aggressive attempt at labelling me antisemitic?
Yeah… I see no reference to this anywhere… some stuff in 2021 about WhatsApp protesting privacy law changes in India and some stuff about the liability of Group Admins for things posted in groups. Nothing about broken encryption measures.
I can only assume they are referring to WhatsApp Group Admins, who are inherently part of the group, as opposed to WhatsApp company admins.
Probably not, but it’s impossible to verify. There’s a strong argument for open source when security really matters.
I think there is a strong argument for Foss for anything
Facebook owns what’s app and they can read any message on the service, they’ve also been known to give logs and messages to law enforcement agencies at request without warrants.
This is just completely wrong. If you read past the misleading headline here:
https://nypost.com/2021/09/07/facebook-reads-and-shares-whatsapp-private-messages-report/
You’ll see that Facebook cannot, in fact, give logs to law enforcement. If you choose to report a message you’ve received and send it to Facebook, then obviously then they can read it.
Also, your claim in another comment that Facebook does not have private keys to decrypt your encrypted messages is just fantasy.
According to the declassified internal FBI document I just linked, they do have access to the content of messages from what’s app, without any formal legal request.
The NY post is a poor source and completely unreliable.
declassified internal FBI document I just linked
don’t see any such link
There’s no such link in their comment history either.
Why is it legal for them to advertise it as end-to-end encrypted then? I thought the main danger lies in WhatsApp insistence on backing up non-encrypted history to Google Drive/iCloud.
Of course, the existence of backdoors is usually not disclosed (duh), but can they actually read any message?
It’s not illegal because it is end to end encrypted when you send messages, but it’s not encrypted on your phone and they have access to that, not to mention, I imagine they have access to the keys used to encrypt the messages, so even if they backed it up encrypted they can still read the messages.
The point of implementing it is not to protect people from surveillance, but rather to make people think they’re protected so they’ll keep using the platform rather than moving to another service. Their actual claims about it amount to “If your on public Wi-Fi or something, people skimming that won’t be able to see your messages” which is absurd because they already couldn’t.
Admittedly, no law enforcement that they refuse to cooperate with will have access to the messages, but like, “law enforcement groups Facebook doesn’t cooperate with” is a very small list.
I believe this is down to what they define as being end to end encrypted.
It’s no secret that WhatsApp adopted Signal’s encryption protocol just before Meta acquired them, but since it’s all closed source we don’t know if they’ve changed anything since the announcement in 2016 that all forms of communications on WhatsApp are now encrypted and rolled out.
Within WhatsApp’s privacy policy, it’s important to note that they only mention end to end encryption when it comes to your messages. Everything else is apparently “fair game” for collection. Of note, the Usage and Log information point details all the metadata they collect on you automatically, including how you use the service; how long you use the service; your profile info; the groups you’re in; whether you’re online; and the last time you were online, to name a few things.
I guess what I’m trying to say is that technically they are end to end encrypted by definition, and whilst they’ve gone ahead and implemented things such as encrypted backups (that you must enable) to make it harder for them to read your message contents, they can still collect a lot of metadata on every user.
It’s no secret that WhatsApp adopted Signal’s encryption protocol just before Meta acquired them, but since it’s all closed source we don’t know if they’ve changed anything since the announcement in 2016 that all forms of communications on WhatsApp are now encrypted and rolled out.
There is an Open Source implementation of the WhatsApp protocol: yowsup
I’ve not seen this before. This is really neat! Thanks for sharing ❤️
And the metadata is enough to get convictions. A person was convicted back in 2019 or so based on the metadata of her whatsapp conversation with a reporter. Natalie something, I think.
It wouldn’t surprise me if WhatsApp’s model on this is what the UK government were thinking of with the Online Safety Bill when they tried to enforce a back door in encrypted messengers.
It’s incredible just how much more interesting metadata can be than the actual message contents.
Explaining this to people when they ask why I don’t use WhatsApp is pretty difficult though.
I wouldn’t feel comfortable if I found out that what I thought was just a casual walk down the street mindlessly chatting with a friend turned out to also involve a third party neither of us were aware of tracking all of our movements.
Why is it legal for them to advertise it as end-to-end encrypted then?
Because they are a multi-billion dollar company.
EU usually frowns upon that though. Sure, the fines are so small that it’s negligible for Meta, but there should be some fines. But all I find via quick googling are this year’s sanctions over personal data processing in Facebook/Instagram/WhatsApp. The nature of these data is not clear though.
I am not trying to say that WhatsApp is safe to use, mind you. I am pretty sure they will hand over all the info along with encryption keys at first government’s request (or any other highest bidder for that matter), but that’s only my perception of them as a company, with no hard proof at hand.
The EU has been trying to outlaw encryption for most of this year.
“The EU” isn’t one singular person or party or state or whatever. There are some people who are trying to outlaw it but that doesn’t mean that they’re the majority or that it’s even legal to do.
You can have end to end encryption over the wire and still have all of your shit harvested at the “endpoints”
It really sucks how a shit ton of money gives a company the ability to do anything they want and avoid legal consequences almost all of the time. It’s a corrupt society we live in.
It’s very obvious to me that GBoard sends data directly to Google circumventing all encryption.
👆👆👆👆👆👆 Came looking for this one. Because somehow Joe Average ends up with keyboards having “added value” like Giphy (from Meta) integration and online spell checkers because local dictionaries are to oldskool.
