5 ms·

Encryption in transit doesn't imply encryption at rest. For instance, WhatsApp on Android will happily back up to Google Drive, if you allow it, and it does so

Encryption in transit doesn't imply encryption at rest. For instance, WhatsApp on Android will happily back up to Google Drive, if you allow it, and it does so in cleartext.

ebikelaw 8y ago
Nothing on Google Drive is stored "in clear text".
- meesles 8y ago
  ...are you a Google Drive dev? How can you possibly make this statement?
- xwvvvvwx 8y ago
  It's clear to Google.
- tgsovlerkhgsel 8y ago
  If I put a file with certain content into Google Drive, then Google Drive, or a subpoena for my Google Drive data, will return exactly those contents. Hence, it is reasonable to apply any distinction to the content as a user of Google Drive sees it, and not as it may be stored on the backend. Hence, if the data WhatsApp pushes to the Google Drive API is unencrypted (and we're talking about the data, not about the HTTPS-encapsulated form that passes over the network), it is reasonable to call it "in clear text", and it wouldn't be reasonable to call it encrypted.
- asdsa5325 8y ago
  I'm pretty sure anything public on Google Drive is...
- m-p-3 8y ago
  Unless you control the encryption keys in the communication, always assume it's accessible in plaintext.
- Sylos 8y ago
  It's maybe not stored in clear text, but it is at the very least stored in a form that Google can decrypt. They would not be able to recover your data upon requesting a password reset, if they used proper end-to-end-encryption.
snthd 8y ago
Media backups are not encrypted, but data is. Backup key security is compromised by usability concerns (the need to restore the backup to a new phone without the old one). https://blog.elcomsoft.com/2018/01/extract-and-decrypt-whatsapp-backups-from-google/ https://blog.elcomsoft.com/2018/01/extract-and-decrypt-whats...
- ben1040 8y ago
  Ah, I know WhatsApp warns you about setting up backups that it's not subject to encryption, but I guess I took that to be the entirety and not just media. Which is still a big gap, since in 2018 we share lots of media in chats. In any case you are right that if you can restore an "encrypted" backup onto a fresh phone without any info from the old one, then all the bits necessary to do are held by parties who can be legally compelled to give them up.
  - reitanqild 8y ago
    Last I checked it was really easy to get data out of a WhatsApp backup. No special skills needed except running locating the file, running a command and connecting using SQLite or something.

Encryption in transit doesn't imply encryption at rest. For instance, WhatsApp on Android will happily back up to Google Drive, if you allow it, and it does so in cleartext.

ebikelaw 8y ago

Nothing on Google Drive is stored "in clear text".

meesles 8y ago
...are you a Google Drive dev? How can you possibly make this statement?
xwvvvvwx 8y ago
It's clear to Google.
tgsovlerkhgsel 8y ago
If I put a file with certain content into Google Drive, then Google Drive, or a subpoena for my Google Drive data, will return exactly those contents. Hence, it is reasonable to apply any distinction to the content as a user of Google Drive sees it, and not as it may be stored on the backend. Hence, if the data WhatsApp pushes to the Google Drive API is unencrypted (and we're talking about the data, not about the HTTPS-encapsulated form that passes over the network), it is reasonable to call it "in clear text", and it wouldn't be reasonable to call it encrypted.
asdsa5325 8y ago
I'm pretty sure anything public on Google Drive is...
m-p-3 8y ago
Unless you control the encryption keys in the communication, always assume it's accessible in plaintext.
Sylos 8y ago
It's maybe not stored in clear text, but it is at the very least stored in a form that Google can decrypt. They would not be able to recover your data upon requesting a password reset, if they used proper end-to-end-encryption.

snthd 8y ago

Media backups are not encrypted, but data is. Backup key security is compromised by usability concerns (the need to restore the backup to a new phone without the old one). https://blog.elcomsoft.com/2018/01/extract-and-decrypt-whatsapp-backups-from-google/ https://blog.elcomsoft.com/2018/01/extract-and-decrypt-whats...

ben1040 8y ago
Ah, I know WhatsApp warns you about setting up backups that it's not subject to encryption, but I guess I took that to be the entirety and not just media. Which is still a big gap, since in 2018 we share lots of media in chats. In any case you are right that if you can restore an "encrypted" backup onto a fresh phone without any info from the old one, then all the bits necessary to do are held by parties who can be legally compelled to give them up.
- reitanqild 8y ago
  Last I checked it was really easy to get data out of a WhatsApp backup. No special skills needed except running locating the file, running a command and connecting using SQLite or something.