6 ms·

How can they know they capture 99% of such content given that WhatsApp is (if I understand correctly) encrypted fully end to end such that Facebook cannot acces

How can they know they capture 99% of such content given that WhatsApp is (if I understand correctly) encrypted fully end to end such that Facebook cannot access the messages passing through it?

dancemethis1 7y ago
Since WhatsApp is proprietary on both client and server side, it can't be proven that OpenWhisper wasn't tampered with. And chances are always against users when we speak of proprietary. It's disgraceful that Signal hailed WhatsApp's announcement to use it almost like a second coming of a religious figure.
- kd3 7y ago
  I can imagine moxie now regrets working with whatsapp to implement the protocol there.
drbojingle 7y ago
Testing?
hannasanarion 7y ago
A third party observer cannot read the messages as they pass through the whatsapp network, but Facebook can read the messages at both ends. Facebook has said that they don't do this outside of Australia, where it is required by law, but come on, are we really going to take Zuckerberg's word for it?
- vamega 7y ago
  Where have they said they're doing this at all?
- dheera 7y ago
  > Facebook can read the messages at both ends This is why I believe that end-to-end encryption is not truly useful unless the source code of the clients is public, or the protocol is open. Any closed source client can read messages at the ends, or be forced to do so by an evil government. At the very least, they could open up XMPP compatibility again so that people could write their own open source clients for it. Australia wouldn't be able to do anything about the propagation of such open source software. I was able to have end-to-end encryption running on top of MSN, AOL, ICQ, QQ, Facebook, Gtalk, Yahoo, and several others about 10 years ago with Pidgin and simple plugins that encrypted/decrypted messages on the fly. It's too bad they all moved selfishly to closed source walled-garden mobile apps -- it's a big step back in privacy.
  - lonelappde 7y ago
    The only chance at security is if you can tap your network connection at the dumb wire layer, and verify that it's encrypted with your own private key.
  - greyfade 7y ago
    I've been bouncing around the idea of a fully decentralized end-to-end encrypted chat protocol for exactly this reason, but I've been afraid to work on it for precisely the reason this thread is being discussed. I know that if my name were attached to the project, I'd be facing all kinds of unwelcome scrutiny from the government and news agencies. I'd lose the very privacy I want to maintain by designing privacy-protecting software.
    - dualboot 7y ago
      Signal is pretty solid. https://signal.org/ https://signal.org/
      - greyfade 7y ago
        Maybe it is, but it's not the decentralized replacement for Discord and Teams that I envision.
        cyphar 7y ago
        I would take a look at Matrix[1], which is basically what you're describing (it's a federated replacement from group chats that has Signal-like E2EE and has an open protocol) and it's already implemented. [1]: https://matrix.org/ https://matrix.org/
    - questionasked 7y ago
      What's the advantage of decentralisation? Is it really a problem to have centralised servers if they're just storing dumb encrypted blobs?
      - 7y ago
- lilott8 7y ago
  This is what I find so fascinating. Yes, it cannot be intercepted in transit. But nothing is stopping the keyboard on which I type or the text box in which I type from collecting all the things and sending those things where ever they want. In-transit interception, in this context, seems like a fruitless threat model when compared to the keyboard/text box vector.
  - xchaotic 7y ago
    Basically police are too lazy to do police work ie get warrants and wiretaps at individual homes. They want a fishing net so they can catch these people by the thousands.
  - hannasanarion 7y ago
    With respect to facebook in particular, they have had the means of reading the messages on either side for ages, even before it was required by law. iOS and Android both have "leaky sandboxing", where certain apps from the same publisher can read each other's data and memory, and Facebook added WhatsApp to its sandbox almost immediately after acquiring it, allowing the main Facebook and Messenger apps to read all the messages received by WhatsApp.
    - skeletonjelly 7y ago
      Any more reading on this?
      - lxjm 7y ago
        I found that article: https://medium.com/@gzanon/no-end-to-end-encryption-does-not-prevent-facebook-from-accessing-whatsapp-chats-d7c6508731b2 https://medium.com/@gzanon/no-end-to-end-encryption-does-not...
- deleted 7y ago
  [deleted]
SamBam 7y ago
Rephrase as "They are responsible for capturing 99% of the illegal content that is caught." i.e., of the illegal stuff that goes through their system, some of it is captured, and the majority of that is caught by Facebook's own system. Note, this article is recent and highly relevant: https://www.nytimes.com/interactive/2019/09/28/us/child-sex-abuse.html https://www.nytimes.com/interactive/2019/09/28/us/child-sex-... > And when tech companies cooperate fully, encryption and anonymization can create digital hiding places for perpetrators. Facebook announced in March plans to encrypt Messenger, which last year was responsible for nearly 12 million of the 18.4 million worldwide reports of child sexual abuse material > Data obtained through a public records request suggests Facebook’s plans to encrypt Messenger in the coming years will lead to vast numbers of images of child abuse going undetected. The data shows that WhatsApp, the company’s encrypted messaging app, submits only a small fraction of the reports Messenger does.
- leshow 7y ago
  > Note, this article is recent and highly relevant.. Talk about fear mongering, that article is horrible. It's the same old argument. "Child abuse is bad therefore you can't have any privacy", they position you as being against protecting children when your stance is actually pro security & privacy.
  - SamBam 7y ago
    I think that reasonable people can hold both f̶a̶c̶t̶s̶ things in their heads at the same time 1. Privacy is important and good 2. It has almost certainly contributed to an explosion in the production and sharing of child pornography and abuse The question is what is the moral way to reconcile the two, not to deny that either exists.
    - lonelappde 7y ago
      Neither of those two things are facts. One is an opinion, and the other is speculation.
      - 7y ago

How can they know they capture 99% of such content given that WhatsApp is (if I understand correctly) encrypted fully end to end such that Facebook cannot access the messages passing through it?

dancemethis1 7y ago

Since WhatsApp is proprietary on both client and server side, it can't be proven that OpenWhisper wasn't tampered with. And chances are always against users when we speak of proprietary. It's disgraceful that Signal hailed WhatsApp's announcement to use it almost like a second coming of a religious figure.

kd3 7y ago
I can imagine moxie now regrets working with whatsapp to implement the protocol there.

drbojingle 7y ago

Testing?

hannasanarion 7y ago

A third party observer cannot read the messages as they pass through the whatsapp network, but Facebook can read the messages at both ends. Facebook has said that they don't do this outside of Australia, where it is required by law, but come on, are we really going to take Zuckerberg's word for it?

vamega 7y ago
Where have they said they're doing this at all?
dheera 7y ago
> Facebook can read the messages at both ends This is why I believe that end-to-end encryption is not truly useful unless the source code of the clients is public, or the protocol is open. Any closed source client can read messages at the ends, or be forced to do so by an evil government. At the very least, they could open up XMPP compatibility again so that people could write their own open source clients for it. Australia wouldn't be able to do anything about the propagation of such open source software. I was able to have end-to-end encryption running on top of MSN, AOL, ICQ, QQ, Facebook, Gtalk, Yahoo, and several others about 10 years ago with Pidgin and simple plugins that encrypted/decrypted messages on the fly. It's too bad they all moved selfishly to closed source walled-garden mobile apps -- it's a big step back in privacy.
- lonelappde 7y ago
  The only chance at security is if you can tap your network connection at the dumb wire layer, and verify that it's encrypted with your own private key.
- greyfade 7y ago
  I've been bouncing around the idea of a fully decentralized end-to-end encrypted chat protocol for exactly this reason, but I've been afraid to work on it for precisely the reason this thread is being discussed. I know that if my name were attached to the project, I'd be facing all kinds of unwelcome scrutiny from the government and news agencies. I'd lose the very privacy I want to maintain by designing privacy-protecting software.
  - dualboot 7y ago
    Signal is pretty solid. https://signal.org/ https://signal.org/
    - greyfade 7y ago
      Maybe it is, but it's not the decentralized replacement for Discord and Teams that I envision.
      - cyphar 7y ago
        I would take a look at Matrix[1], which is basically what you're describing (it's a federated replacement from group chats that has Signal-like E2EE and has an open protocol) and it's already implemented. [1]: https://matrix.org/ https://matrix.org/
  - questionasked 7y ago
    What's the advantage of decentralisation? Is it really a problem to have centralised servers if they're just storing dumb encrypted blobs?
    - 7y ago
lilott8 7y ago
This is what I find so fascinating. Yes, it cannot be intercepted in transit. But nothing is stopping the keyboard on which I type or the text box in which I type from collecting all the things and sending those things where ever they want. In-transit interception, in this context, seems like a fruitless threat model when compared to the keyboard/text box vector.
- xchaotic 7y ago
  Basically police are too lazy to do police work ie get warrants and wiretaps at individual homes. They want a fishing net so they can catch these people by the thousands.
- hannasanarion 7y ago
  With respect to facebook in particular, they have had the means of reading the messages on either side for ages, even before it was required by law. iOS and Android both have "leaky sandboxing", where certain apps from the same publisher can read each other's data and memory, and Facebook added WhatsApp to its sandbox almost immediately after acquiring it, allowing the main Facebook and Messenger apps to read all the messages received by WhatsApp.
  - skeletonjelly 7y ago
    Any more reading on this?
    - lxjm 7y ago
      I found that article: https://medium.com/@gzanon/no-end-to-end-encryption-does-not-prevent-facebook-from-accessing-whatsapp-chats-d7c6508731b2 https://medium.com/@gzanon/no-end-to-end-encryption-does-not...
deleted 7y ago
[deleted]

SamBam 7y ago

Rephrase as "They are responsible for capturing 99% of the illegal content that is caught." i.e., of the illegal stuff that goes through their system, some of it is captured, and the majority of that is caught by Facebook's own system. Note, this article is recent and highly relevant: https://www.nytimes.com/interactive/2019/09/28/us/child-sex-abuse.html https://www.nytimes.com/interactive/2019/09/28/us/child-sex-... > And when tech companies cooperate fully, encryption and anonymization can create digital hiding places for perpetrators. Facebook announced in March plans to encrypt Messenger, which last year was responsible for nearly 12 million of the 18.4 million worldwide reports of child sexual abuse material > Data obtained through a public records request suggests Facebook’s plans to encrypt Messenger in the coming years will lead to vast numbers of images of child abuse going undetected. The data shows that WhatsApp, the company’s encrypted messaging app, submits only a small fraction of the reports Messenger does.

leshow 7y ago
> Note, this article is recent and highly relevant.. Talk about fear mongering, that article is horrible. It's the same old argument. "Child abuse is bad therefore you can't have any privacy", they position you as being against protecting children when your stance is actually pro security & privacy.
- SamBam 7y ago
  I think that reasonable people can hold both f̶a̶c̶t̶s̶ things in their heads at the same time 1. Privacy is important and good 2. It has almost certainly contributed to an explosion in the production and sharing of child pornography and abuse The question is what is the moral way to reconcile the two, not to deny that either exists.
  - lonelappde 7y ago
    Neither of those two things are facts. One is an opinion, and the other is speculation.
    - 7y ago