4 ms·

Assuming they set up signal protocol correctly, which I'm sure they did since Open Whisper Systems partnered with WA to set it up right, they're likely just sha

Assuming they set up signal protocol correctly, which I'm sure they did since Open Whisper Systems partnered with WA to set it up right, they're likely just sharing details on users' contact lists. Considering Facebook owns WhatsApp this isn't surprising, they're definitely happy to share this information (ever seen someone in your FB "suggested friends" list after messaging them on WA?) If they had pushed a different version of the app to Russia or there was a way of breaking message encryption I'm sure someone would have noticed by now.

sschueller 9y ago
I just read that on iOS apps from the same developer can share sandbox data. That means the facebook app can read the whatsapp message history. [1] [1] https://www.heise.de/mac-and-i/meldung/Entwickler-Facebook-kann-WhatsApp-Chats-einsehen-trotz-Ende-zu-Ende-Verschluesselung-4023461.html https://www.heise.de/mac-and-i/meldung/Entwickler-Facebook-k...
saas_co_de 9y ago
I think you can pretty easily guess from the #deletefacebook statement of the whatsapp founder that they did not implement the protocol "correctly". Corporate statements about the security and privacy of their products usually leave open the possibility that they engage in lawful intercept. Even if they don't they can always just lie and use the fact that they have national security letters barring disclosure as legal cover if it ever comes out.
mtgx 9y ago
They could probably still use this "design feature" (that Signal doesn't have) to hack users who don't authenticate the people they're talking with (also authentication isn't enabled by default on WhatsApp, but it is on Signal): https://www.theguardian.com/technology/2017/jan/13/whatsapp-design-feature-encrypted-messages https://www.theguardian.com/technology/2017/jan/13/whatsapp-... If you're a user of WhatsApp, make sure you enable the two-factor authentication PIN, too, because otherwise it should be relatively trivial for your own government to gain access to your account by using your number with the local carrier's help (it's also possible to do it without the carrier's help, given how broken the security of carrier networks is). Many Telegram users were hacked this way by the government in Russia, too.
varjag 9y ago
Contact lists and related metadata. Some of it is crucial, like geolocation.
berns 9y ago
Whatsapp makes a local backup in internal storage everyday. There is no setting to disable this backup. There are many opportunities to access the chat history, specially for Facebook, that wouldn't require cheating with the signal protocol.

sschueller 9y ago

I just read that on iOS apps from the same developer can share sandbox data. That means the facebook app can read the whatsapp message history. [1] [1] https://www.heise.de/mac-and-i/meldung/Entwickler-Facebook-kann-WhatsApp-Chats-einsehen-trotz-Ende-zu-Ende-Verschluesselung-4023461.html https://www.heise.de/mac-and-i/meldung/Entwickler-Facebook-k...

saas_co_de 9y ago

I think you can pretty easily guess from the #deletefacebook statement of the whatsapp founder that they did not implement the protocol "correctly". Corporate statements about the security and privacy of their products usually leave open the possibility that they engage in lawful intercept. Even if they don't they can always just lie and use the fact that they have national security letters barring disclosure as legal cover if it ever comes out.

mtgx 9y ago

They could probably still use this "design feature" (that Signal doesn't have) to hack users who don't authenticate the people they're talking with (also authentication isn't enabled by default on WhatsApp, but it is on Signal): https://www.theguardian.com/technology/2017/jan/13/whatsapp-design-feature-encrypted-messages https://www.theguardian.com/technology/2017/jan/13/whatsapp-... If you're a user of WhatsApp, make sure you enable the two-factor authentication PIN, too, because otherwise it should be relatively trivial for your own government to gain access to your account by using your number with the local carrier's help (it's also possible to do it without the carrier's help, given how broken the security of carrier networks is). Many Telegram users were hacked this way by the government in Russia, too.

varjag 9y ago

Contact lists and related metadata. Some of it is crucial, like geolocation.

berns 9y ago

Whatsapp makes a local backup in internal storage everyday. There is no setting to disable this backup. There are many opportunities to access the chat history, specially for Facebook, that wouldn't require cheating with the signal protocol.