12 ms·
Reporting a user to WhatsApp forwards a copy of recent messages from that chat
- throwaway1777 6y agoMisleading. Only sends them if one of the users sends them to WhatsApp. There’s nothing broken in the technology here.
- ffpip 6y agoWhat is misleading about it? I included ' can read when you report'.
- pvg 6y agoYou send them the messages, by opt-in, your version seems to suggest something else. Simplest thing is to just stick to the guidelines and use the original title, then add the thing you want to highlight in a comment. The other way ends up taking a non-clickbait title and making it clickbait.
- ffpip 6y agoThis is not opt-in. You can either report or not report. There is no way to report but not send the messages. The reporting is opt in. The sending of messages tied to the reporting is not
- pvg 6y agoYou're now quibbling over my characterization of your characterization of the clickbaity title, which is fun but not really the point. The point is 'don't editorialize/rewrite titles into clickbait, please'.
- st1x7 6y agoAs if they couldn't read everything anyway. Obviously, I have no evidence for making such a claim. What I know is 1. Facebook's reputation with regards to privacy. 2. The fact that they paid 20 billion dollars to buy a product without a monetization model. (Which is 20 times more than they paid for Instagram by the way.) 3. Whatsapp's founder left the company after the acquisition due to privacy concerns. It's enough to be more than suspicious.
- eldridgea 6y agoWhile I share your general suspicion I don't think they need to see the messages to get a lot of privacy-violating use out of WhatsApp. When the NSA was talking about metadata collection, they said it was more useful than actual data. Likely because it's already computer consumable, and less dense. If FB gets your contact lists, and sees who you message, how much, and when, that's probably a hugely valuable commodity to them.
- _eqet 6y agoMaybe true, however computing power has increased substantially since then. It's quite easy for them to index all the messages and search for them later, or setup alerts on key words.
- beagle3 6y agoMetadata is more useful than data in the sense that data may be “encrypted” using a different unknown scheme between every two users (e.g. a hitman may discuss “a job”, a bribe might be described as “a gift”, a non public stock tip might be “weather is going to be good tomorrow”). However, metadata is always what it is. If you have someone who is distance 2 from 20 people who died unnaturally, but not distance 1 - that person is likely related to their untimely death. The reason metadata is useful is because, unlike the text, it is generally required to be unobfuscated to 3rd parties for the communication to be useful to the 1st and 2nd parties.
- rapnie 6y agoThey might also get info on links you share, as the app makes a request to get the OpenGraph metadata. Who knows.
- im3w1l 6y ago> the app makes a request to get the OpenGraph metadata Just to be clear here, is this your speculation or a known thing?
- 6y ago
- quotemstr 6y agoE2E encryption in closed source automatically updated programs doesn't provide any real assurance: whoever makes the program can subvert your privacy at any time. Do you trust the author of the program? Then E2E doesn't add much. Do you not trust the author of the program? E2E doesn't help. Either way, what's the point? Sure, I guess E2E provides some kind of additional privacy at the margin or something, but you can't rely on it for anything.
- vlovich123 6y agoAre you verifying that all your OSS binaries you’re running match a reproducible build hash that’s been validated by multiple trusted sources? If not, you’re already engaging in a level of trust. The real question is how do you establish trust in the code you run and while OSS provides benefits at the margin or something, you can’t really rely on it for anything. For an example to illustrate the fallacious reasoning of OSS = trust, consider the malicious compiler that Ken Thompson presented[1]. [1] https://wiki.c2.com/?TheKenThompsonHack https://wiki.c2.com/?TheKenThompsonHack
- ryukafalz 6y agoNot GP, but: although I'm not currently doing this consistently (I don't have the resources to set up build servers and there aren't many build servers for my distro yet) the distro I use does make it pretty straightforward to do this: https://guix.gnu.org/manual/en/html_node/Invoking-guix-challenge.html https://guix.gnu.org/manual/en/html_node/Invoking-guix-chall... If I want to do this for any particular package as a one-off, it's two commands.
- vlovich123 6y agoReproducible builds are a step up but remember that it requires you to build with the exact same binary-identical toolchain. If that’s already compromised your guix challenge isn’t really doing anything of value. Again, I’m not saying these aren’t valuable things that make attacks more difficult/expensive but the uncomfortable truth is we haven’t figured out how to truly establish zero-knowledge trust. So on that spectrum, ultimately Guix + OSS is closer to WhatsApp than where we’d like to be.
- bzb6 6y agoInflammatory title.
- est31 6y ago> WhatsApp can now read your recent messages when you report a user This feature is just an extension of manually making a screenshot and attaching it to the messages. As much as I like E2EE, I don't see where the problem lies? It's you who opts in into getting a third party involved. E2EE doesn't mean that no third party is ever going to see the content, it only means that nobody sees it by default.
- varispeed 6y agoDoes it mean messages can be read without agreement? Let's imagine "a glitch" where operator sees that user has opt in, but they didn't - can they see messages?
- bzb6 6y agoIf you are asking whether a back door can allow them to read your messages, the answer is “obviously, that’s why it’s a back door”
- est31 6y agoI don't know the implementation on the client, but in theory it can be implemented locally on the client only, and I made the above statements under the assumption that it's how it's implemented. The user issues the report command in the UI and the client takes its local copy and uploads it to the server as part of the report. So it's mainly a convenience feature. The only case where the current E2EE security model is changed is when the protocol gains a feature to enable the client to attach a cryptographic proof about the message's content. That would violate the non-repudiation properties of the Signal protocol, but it would make reports more believable as you can't fake them any more with a modified client. As I've said I don't know the implementation, but it's entirely possible that they didn't include any cryptographic proof and keep it equivalent to screenshotting.
- upofadown 6y ago>That would violate the non-repudiation properties of the Signal protocol,... Signal achieves non-repudiation by allowing forgery of messages after they have been transferred and verified by the receiver. It is not possible to undo that. You would have to make a special exception at the time the message was transferred which wouldn't be practical in this case. This all assumes that you believe that establishing forgeability actually achieves non-repudiation in the first place. Facebook might want to pass along the signature information anyway.
- natch 6y agoSo it can also read the messages of the reported user? Without their permission, other than what is covered in fine print? I understand this can be used to fight abuse but it seems to open up some hard questions for WhatsApp privacy.
- cryptohead 6y agoI guess it can read the messages by the reported user that the reporting user has received, and chooses to transmit. Which makes sense.
- bzb6 6y agoIn the same way I can take a screenshot of a conversation with you and post it online without your permission.
- keyme 6y agoJust FYI, the Google Drive backup of your "E2E encrypted" whatsapp messages is stored in plain text... https://faq.whatsapp.com/android/chats/about-google-drive-backups/?lang=fb https://faq.whatsapp.com/android/chats/about-google-drive-ba...
- pw6hv 6y agoSo it is not only Facebook that has complete access to the message history, but also Google. The funny thing is that I cannot find a way to access that backup myself, is anyone aware of a method to download that backup as a data dump and inspect it?
- ffpip 6y agoI don't know if it is included in your Google takeout. 98% of users enable that option. The fact that whatsapp is e2ee is a complete lie. Use Signal for true e2ee, or if you don't like it, Telegram. Telegram stores everything in the cloud tho. (they haven't disclosed any private messages, and are much more trustworthy than Whatsapp). They just wanted to back up messages without giving it to Google/Apple
- jandrese 6y agoSeems like the messages were e2ee, and when they got to the last e they were decrypted and then immediately uploaded to a third party because yay cloud.
- JohnBerea 6y agoShouldn't we prefer Matrix over Signal, since it's federated and doesn't require a phone number / phone to sign up.
- screamingninja 6y agoWe should, but it is much harder to get my family and friends to use Matrix.
- 6y ago
- josh2600 6y agoPeople think end to end encryption is a magic cure for OpSec. It’s not. All end to end encryption does is protect you from eve spying on conversations between Alice and bob. Nothing prevents Bob from doxing/publishing all of Alice’s messages. Edit: it’s true that the signal protocol provides deniability for messages but if Bob publishes Alice’s messages and whatsapp can prove that bob sent and Alice received messages that match those time stamps... This is why signal deleting logs matters.
- devit 6y agoIt's impossible to prevent Bob from publishing all Alice's messages (barring tech that can forcibly erase them from Bob's brain). The best you can do is not make it possible for Bob to prove that the messages were not forged (however, this is not necessarily a good thing, and in fact the opposite can often be better).
- makeworld 6y agoE2EE is for communicating with a trusted person without third parties listening in through technological means. Anything else is out of scope. This includes what you mention here, where the person you're communicating with isn't actually trusted.
- beervirus 6y agoThis seems mostly fine. I'd prefer to see it as a box you have to affirmatively check (such that you can still report someone without opting in to sending the messages). But... I can't really get riled up about this.
- CGamesPlay 6y agoAlthough this feature probably isn't a big concern, I am curious because you can't report without sending "recent" messages to WhatsApp, and "recent" is vague enough to mean "previous 500" or so. Again, probably not an issue since you presumably don't have much message history with someone you are reporting, but a bit of a strange decision from a privacy perspective.
- WhyNotHugo 6y agoI hate Facebook and WhatsApp as much as anyone else who cares about privacy. But there's nothing wrong in this particular change. It happens when you report someone as spam, and you get a clear notification about what's going on. There's a "cancel" button as big as the "report" button, so you can bail out if you disagree.
- ffpip 6y agoThere is nothing wrong with it. I'm posting it because it's a new thing in Whatsapp, the worlds most popular messenger, and I wanted people to know of this change.
- selykg 6y agoYour wording choice for the title makes it seem otherwise. It makes it sound like it's some big warning or big deal. Perhaps choose your words more carefully?
- ffpip 6y agoPlease suggest a better title. I'll try to improve. Many users have complained. There is a 80 character limit. Btw I meant it as a warning. Your messages may be uploaded when you report a user
- stronglikedan 6y agoThe title is fine. You can't stop people from inferring things (they did), yet insisting you implied anything (you didn't).
- surround 6y ago(Edit, for context: the original submission title was “WhatsApp can now read your recent messages when you report a user”) By selecting a specific part of the article to highlight in the title, you introduce your own bias before people even begin reading. Stick to the Submissions Guidelines [1], and use the original title. “WhatsApp beta for Android 2.20.206.3” [1] https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html > Please use the original title, unless it is misleading or linkbait; don't editorialize
- JansjoFromIkea 6y agoRemember how whatsapp for years didn't let you delete sent messages even if the other person hadn't yet received it? I assume there was some major privacy reason why it worked that way for so long because it was obviously pretty horrible from a user experience standpoint. Would anyone be able to explain it to me? And what kind of extra data did facebook likely receive from adding that feature (which I think coincided with when the creators started to get very unsettled at Facebook).
- exWAemployee 6y agoNow? This has been happening for years to fight spam. It is not new in any way.
- misterhtmlcss 6y agoThis is bad news people. 1. What is 'recent' messages? That's a big grey area there. They should specify or it's ripe for abuse. 2. If someone suddenly gets 10 reports of abuse then that's a red flag. I would argue that this would require further investigation and by investigation I mean forcing a disclosure such as 1-1 messages.
- drummer 6y agoHave they fixed the flaw of sabotaging people's accounts by having their numbers reported by many people? https://m.facebook.com/OfficialRishie/posts/4606731886034882 https://m.facebook.com/OfficialRishie/posts/4606731886034882
- ffpip 6y agoHow else would they take down a bad person's account? They say they don't know anything he/she sends.
- aerovistae 6y agoIt's pretty hard to imagine a circumstance in which I would be reporting a WhatsApp user. This isn't like a public forum. These are one-on-one conversations or group chats with people who were specifically invited. If someone was a problem, I would just block them. Why would you ever report someone? I haven't ever heard of this happening.
- deleted 6y ago[deleted]
- marcosdumay 6y agoI have reported one company up to now. It was cycling through numbers sending uninvited spam. Of course, there's no "reason" field on the report interface, so WatsApp probably won't guess that.
- DangerousPie 6y agoSpam? Sure you can just block them, but if you report them WhatsApp might be able to stop them from spamming others.
- Raphmedia 6y agoImagine someone trampling kittens and sending the result to random strangers. Sure, you can ignore them... but the kittens would still keep dying. So you report it and hope for the best. Now change "trampling kittens" for any kinds of unwanted messages.
- TimWillebrands 6y agoReport them to the police you mean?
- ThePhysicist 6y agoThat's what most people don't seem to get with E2EE: The messages are still readable to the software, so with a simple software update they can be trivially extracted. E2EE doesn't provide so much benefit if you don't also control the client software.
- iso1210 6y agoWhenever I see anything about whatsapp, I can't help but think of it's rather unenthusiastic reception when it launched https://www.flyertalk.com/forum/travel-technology/952359-thoughts-about-my-free-iphone-app-whatsapp.html https://www.flyertalk.com/forum/travel-technology/952359-tho... And especially his post in 2014 how the takeover deal was interfering with his award ticket https://www.flyertalk.com/forum/travel-technology/952359-thoughts-about-my-free-iphone-app-whatsapp-5.html#post22387891 https://www.flyertalk.com/forum/travel-technology/952359-tho...
- beagle3 6y agoThere have been several unofficial reports of Facebook unifying the backend messaging among Instagram, WhatsApp and FB Messenger. If and when that happens, E2EE on WhatsApp will finally be completely gone. Anyone knows how far along (or canceled) that plan is?
- antpls 6y agoI had a notification on Instagram the other day explaining that, for now on, all messages can be read if reported. Instagram never claimed to have e2ee, but it shows they are aligning the policies across the 3 apps.
- ffpip 6y ago> Anyone knows how far along (or canceled) that plan is? Zuckerberg said instead of removing Whatsapp's e2ee, he would add e2ee to Instagram and Messenger and then 'unify the backend', We both know how likely that is, and how long that will take to be implemented (if implemented at all)
- beagle3 6y agoGiven that Jan Koum and Brian Acton both left a few hundred million USD on the table, and the reason was supposedly "changes to whatsapp that FB promised they wouldn't do", I would assume it is going to become perfectly wiretappable. As a other comments in this discussion pointed, e2ee means nothing because (a) the client is closed source, auto-updating, and (b) 98%[0] of the users use Google's cloud backup which is unencrypted (and I suspect was done that way to have a quickly-wiretappable change to the WhatsApp ecosystem without making it patently obvious) [0] Don't know where that comment took the number from, but it jives with my personal experience. I don't know if it is encrypted on iCloud for iPhone users.
- whiterace1488 6y agoRelevant: https://medium.com/@gzanon/no-end-to-end-encryption-does-not-prevent-facebook-from-accessing-whatsapp-chats-d7c6508731b2 https://medium.com/@gzanon/no-end-to-end-encryption-does-not...
- 6y ago
- Kreotiko 6y agoUnfortunately the linked website doesn’t allow for ads blocker.
- deleted 6y ago[deleted]
- blindm 6y agoWith (popular) messaging apps now subject to draconian measures to introduce a backdoor, I am now skeptical of these messenger apps, since all an intel agency has to do is push a backdoored binary down the wire to a device, and the user is (usually) unaware that their messages are tapped by the agency. Even with reverse engineering of the app, it could be difficult to determine if it's compromised or no longer 'privacy aware'.
- aminozuur 6y agoI trust the judgement and morality within the decisionmaking processes of Facebook and Whatsapp more than I would for most governments.
- abhinav22 6y agoI always thought that E2E didn’t mean much since they could translate the encrypted messages into useable content (eg common words). Is this true or are the messages randomly garbled each time so that there is no way for Facebook to figure out the main content It seems like i get ads based on my WhatsApp messages, but this could be conjecture
- groos 6y agoIt's also been clear to me for a while that Whatsapp is scanning message content & meta-data for use in FB ads. Talk about something in a Whatsapp chat and pretty soon an ad in FB about the thing shows up.
- eitland 6y agoMaybe this is the time that people understand that even perfect E2E-encryption doesn't mean anything if you cannot either somehow trust (for some level of trust) the entity who produces the endpoint - or perfectly control your endpoints at a network protocol level. Yes, they cannot get the messages from the wire, but they are brazen enough to introduce (more[1]) ways to get hold of your messages anyway. I used to be a "living billboard" for WhatsApp until Facebook bought them and I am sad to say I was correct: they didn't spend 17bn on WhatsApp and then remove the revenue stream from it just because of the goodness of their hearts :-/ [1]: They already upload your messages in an unencrypted file to either Google Cloud or iCloud anyway if you don't actively turn it off - and get all your contacts to do the same.