5 ms·

Just FYI, the Google Drive backup of your "E2E encrypted" whatsapp messages is stored in plain text... https://faq.whatsapp.com/android/chats/about-google-driv

by keyme 6y ago

Just FYI, the Google Drive backup of your "E2E encrypted" whatsapp messages is stored in plain text... https://faq.whatsapp.com/android/chats/about-google-drive-backups/?lang=fb https://faq.whatsapp.com/android/chats/about-google-drive-ba...

pw6hv 6y ago
So it is not only Facebook that has complete access to the message history, but also Google. The funny thing is that I cannot find a way to access that backup myself, is anyone aware of a method to download that backup as a data dump and inspect it?
- ffpip 6y ago
  I don't know if it is included in your Google takeout. 98% of users enable that option. The fact that whatsapp is e2ee is a complete lie. Use Signal for true e2ee, or if you don't like it, Telegram. Telegram stores everything in the cloud tho. (they haven't disclosed any private messages, and are much more trustworthy than Whatsapp). They just wanted to back up messages without giving it to Google/Apple
  - jandrese 6y ago
    Seems like the messages were e2ee, and when they got to the last e they were decrypted and then immediately uploaded to a third party because yay cloud.
  - JohnBerea 6y ago
    Shouldn't we prefer Matrix over Signal, since it's federated and doesn't require a phone number / phone to sign up.
    - screamingninja 6y ago
      We should, but it is much harder to get my family and friends to use Matrix.
    - ffpip 6y ago
      It's just something about Matrix. I don't know what it is. I've never opened the app after logging in. It has a good UX which is rare for open source apps. It seems to be based around a decent community. But I don't know why I don't use it.
      - anoncake 6y ago
        Network effects?
    - dbrgn 6y ago
      Federation is no panacea either, it's also a privacy tradeoff, since the communication metadata is distributed across multiple servers operated by different people (unless you only communicate with people on the same homeserver that hosts your own account).
  - merlinscholz 6y ago
    Isn't telegram by default not encrypted? I thought only "private" chats are being e2ee.
    - ffpip 6y ago
      Yes. That is what 'stores everything in the cloud' means. Even the e2ee thing is not audited properly. They are just more trustworthy, have open source apps, better usability [ and unlimited storage :) ] . Signal > Telegram > Whatsapp
      - baby 6y ago
        I would use Whatsapp before Telegram personally
        scottlocklin 6y ago
        Yeah a FB employee would say that
- keyme 6y ago
  There is no "official" way for you to download it. IIRC it is stored in your Google Drive under an API key that is dedicated to whatsapp (in some kind of per-app storage). I don't really know much about Google Drive API. However, I am fairly sure that the key is in the binary on your phone, so it shouldn't be much of a challenge to get access. I think there was something like this on Github once, that no longer works (due to trivial changes, likely). Update: https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithread https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre... Looks recent, didn't try myself.
  - arp242 6y ago
    I tried it, but I can't seem to get it to work. Possibly because I don't know the "device ID" of my Android phone since I lost it. I got an iPhone SE and turns out I can't really import the Android backup on an iPhone, and there's no way to access it either. Some backup. Damnit why is everything related to mobile so needlessly fecking difficult. I just want to read some damn plain text files that are right there but it doesn't allow me to access for no reason in particular. I hate everything about mobile so much.
    - beagle3 6y ago
      There are 3rd party products who convert WA data from iOS to Android and vice versa (and also, you might be able to get your data using a new android device or even android installed in a VM). The main problem here is that like everything FB related, you are the product, not the customer At least, I haven't found any reasonable explanation about why Google and Apple get an unencrypted copy of your chat history but you can't. (And not for lack of trying - there are always ridiculous answers on Reddit and HN about "but if you could read your messages, so can the bad guys")
- mtgx 6y ago
  Of course, why else would Google agree to store all the backup data of a competing company for free? Google would have had no interest in storing Facebook's end-to-end encrypted data unless it could read it. The moment Google and Facebook announced this partnership together I knew it was bad news and I should stay the hell away from doing such backups. But apparently many people cheered for it without realizing the implications.
- Gabrielfair 6y ago
  Thanks for pointing this out. I suspect this why Google agreed to store all the backup data of a competing company for free. Google would have had no interest in storing Facebook's end-to-end encrypted data for free unless it could read it and possibly resell it back to Facebook.
ajvs 6y ago
E2EE is a lie, Facebook hold the private encryption keys server-side so they're able to decrypt messages at any time.
- eganist 6y ago
  > E2EE is a lie, Facebook hold the private encryption keys server-side so they're able to decrypt messages at any time. This is a pretty bold claim. Do you have a citation for this?
  - Fnoord 6y ago
    It is a bold claim, indeed. What about WhatsApp Web though? I wonder how that works. I guess it connects to the device via a 3rd party (Facebook's) to send the data over HTTPS? Does it use public-key authentication where the key is only known to the WhatsApp Web client? Either way, it is a compromise on E2EE.
    - gruez 6y ago
      >I wonder how that works. I guess [...] Either way, it is a compromise on E2EE. How about instead of guessing and concluding it must be compromised (argument from ignorance), you do a cursory search and get an actual response? https://security.stackexchange.com/questions/148321/how-does-the-whatsapp-web-client-synchronize-with-the-mobile-application-keeping https://security.stackexchange.com/questions/148321/how-does...
      - Fnoord 6y ago
        I suggest you read the guidelines for this website [1] > Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. As for your link, I'm aware how they claim it works, and even if that is all true (we can't audit the source code), then it is still a compromise of E2EE. E2EE is between two devices, a receiver and a sender. The third device also able to receive, without the sender knowing or agreeing about it, is dangerous. Why? Because you can't know for sure the receiver has access to both machines. If you consider laptop and PCs are much less safe than mobile devices, then the danger is obvious. [1] https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
legulere 6y ago
Also on iOS on iCloud. Thanks for that hint. I turned off the backup functionality.

by keyme 6y ago

pw6hv 6y ago

So it is not only Facebook that has complete access to the message history, but also Google. The funny thing is that I cannot find a way to access that backup myself, is anyone aware of a method to download that backup as a data dump and inspect it?

ffpip 6y ago
I don't know if it is included in your Google takeout. 98% of users enable that option. The fact that whatsapp is e2ee is a complete lie. Use Signal for true e2ee, or if you don't like it, Telegram. Telegram stores everything in the cloud tho. (they haven't disclosed any private messages, and are much more trustworthy than Whatsapp). They just wanted to back up messages without giving it to Google/Apple
- jandrese 6y ago
  Seems like the messages were e2ee, and when they got to the last e they were decrypted and then immediately uploaded to a third party because yay cloud.
- JohnBerea 6y ago
  Shouldn't we prefer Matrix over Signal, since it's federated and doesn't require a phone number / phone to sign up.
  - screamingninja 6y ago
    We should, but it is much harder to get my family and friends to use Matrix.
  - ffpip 6y ago
    It's just something about Matrix. I don't know what it is. I've never opened the app after logging in. It has a good UX which is rare for open source apps. It seems to be based around a decent community. But I don't know why I don't use it.
    - anoncake 6y ago
      Network effects?
  - dbrgn 6y ago
    Federation is no panacea either, it's also a privacy tradeoff, since the communication metadata is distributed across multiple servers operated by different people (unless you only communicate with people on the same homeserver that hosts your own account).
- merlinscholz 6y ago
  Isn't telegram by default not encrypted? I thought only "private" chats are being e2ee.
  - ffpip 6y ago
    Yes. That is what 'stores everything in the cloud' means. Even the e2ee thing is not audited properly. They are just more trustworthy, have open source apps, better usability [ and unlimited storage :) ] . Signal > Telegram > Whatsapp
    - baby 6y ago
      I would use Whatsapp before Telegram personally
      - scottlocklin 6y ago
        Yeah a FB employee would say that
keyme 6y ago
There is no "official" way for you to download it. IIRC it is stored in your Google Drive under an API key that is dedicated to whatsapp (in some kind of per-app storage). I don't really know much about Google Drive API. However, I am fairly sure that the key is in the binary on your phone, so it shouldn't be much of a challenge to get access. I think there was something like this on Github once, that no longer works (due to trivial changes, likely). Update: https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithread https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre... Looks recent, didn't try myself.
- arp242 6y ago
  I tried it, but I can't seem to get it to work. Possibly because I don't know the "device ID" of my Android phone since I lost it. I got an iPhone SE and turns out I can't really import the Android backup on an iPhone, and there's no way to access it either. Some backup. Damnit why is everything related to mobile so needlessly fecking difficult. I just want to read some damn plain text files that are right there but it doesn't allow me to access for no reason in particular. I hate everything about mobile so much.
  - beagle3 6y ago
    There are 3rd party products who convert WA data from iOS to Android and vice versa (and also, you might be able to get your data using a new android device or even android installed in a VM). The main problem here is that like everything FB related, you are the product, not the customer At least, I haven't found any reasonable explanation about why Google and Apple get an unencrypted copy of your chat history but you can't. (And not for lack of trying - there are always ridiculous answers on Reddit and HN about "but if you could read your messages, so can the bad guys")
mtgx 6y ago
Of course, why else would Google agree to store all the backup data of a competing company for free? Google would have had no interest in storing Facebook's end-to-end encrypted data unless it could read it. The moment Google and Facebook announced this partnership together I knew it was bad news and I should stay the hell away from doing such backups. But apparently many people cheered for it without realizing the implications.
Gabrielfair 6y ago
Thanks for pointing this out. I suspect this why Google agreed to store all the backup data of a competing company for free. Google would have had no interest in storing Facebook's end-to-end encrypted data for free unless it could read it and possibly resell it back to Facebook.

ajvs 6y ago

E2EE is a lie, Facebook hold the private encryption keys server-side so they're able to decrypt messages at any time.

eganist 6y ago
> E2EE is a lie, Facebook hold the private encryption keys server-side so they're able to decrypt messages at any time. This is a pretty bold claim. Do you have a citation for this?
- Fnoord 6y ago
  It is a bold claim, indeed. What about WhatsApp Web though? I wonder how that works. I guess it connects to the device via a 3rd party (Facebook's) to send the data over HTTPS? Does it use public-key authentication where the key is only known to the WhatsApp Web client? Either way, it is a compromise on E2EE.
  - gruez 6y ago
    >I wonder how that works. I guess [...] Either way, it is a compromise on E2EE. How about instead of guessing and concluding it must be compromised (argument from ignorance), you do a cursory search and get an actual response? https://security.stackexchange.com/questions/148321/how-does-the-whatsapp-web-client-synchronize-with-the-mobile-application-keeping https://security.stackexchange.com/questions/148321/how-does...
    - Fnoord 6y ago
      I suggest you read the guidelines for this website [1] > Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. As for your link, I'm aware how they claim it works, and even if that is all true (we can't audit the source code), then it is still a compromise of E2EE. E2EE is between two devices, a receiver and a sender. The third device also able to receive, without the sender knowing or agreeing about it, is dangerous. Why? Because you can't know for sure the receiver has access to both machines. If you consider laptop and PCs are much less safe than mobile devices, then the danger is obvious. [1] https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

legulere 6y ago

Also on iOS on iCloud. Thanks for that hint. I turned off the backup functionality.