12 ms·

WhatsApp whitepaper removed sentence about never having access to private keys

491 points by Aissen 6y ago

nxoxn 6y ago
Yikes. The bad news about WhatsApp just keeps pouring in. For me personally I only ever used WhatsApp very lightly with a few work friends. After all of the recent news surrounding the app I sent a message saying I plan on leaving the app soon. I wish it were easier to switch apps like this but it makes sense that they wouldn't want that to be the case.
GrayShade 6y ago
Probably because: All chats use the same Signal protocol outlined in this whitepaper, regardless of their end-to-end encryption status. The WhatsApp server has no access to the client’s private keys, though if a business user delegates operation of their Business API client to a vendor, that vendor will have access to their private keys - including if that vendor is Facebook. (https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857720642275_2152527586907531259_n.pdf/WA_Security_WhitePaper.pdf https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857..., p. 13)
- voxic11 6y ago
  Probably not because that doesn't say whatsapp will have the private keys, just that the vender will. In fact the next sentence you left out of the quote is > However, these private keys will still not be stored on the WhatsApp chat server.
  - GrayShade 6y ago
    That's in a different place (p. 11), but the gist is still the same. Even my quote includes "The WhatsApp server has no access to the client’s private keys". I guess it wasn't clear, but I was trying to refute the claim implied by the Twitter post (by showing that the document still claims that WhatsApp servers don't have access to the private keys).
- saurik 6y ago
  Yeah. It is really clear that Facebook is finally getting around to just implementing this feature of effectively having "hosted clients" for companies to be able to more easily--and yes: less securely--build chat bots (a mechanism that I appreciate is maybe less than ideal to encourage, but frankly just doesn't feel that bad and certainly isn't a surprise: Facebook has been taking about this for a year or two now); and all of the "changes" this week have been directly because of this, including the Privacy Policy update... the key article about which even explicitly said: > The move, the spokeswoman said, is part of a previously disclosed move to allow businesses to store and manage WhatsApp chats using Facebook's infrastructure. Users won't have to use WhatsApp to interact with the businesses and have the option of blocking the businesses. She said there will be no change in how WhatsApp shares provides data with Facebook for non-business chats and account data. And yet, somehow, everyone is just in complete hysterics over all of this, claiming Facebook is evil and undermining the feeling of security people have in WhatsApp, with lots of talk of switching not only to reasonable alternatives like Signal, but also to less secure messaging protocols like Telegram (or, frankly, Matrix). People at my supposedly-smart privacy company--Orchid, building something akin to "incentivized Tor for general VPN use"--are even panicking about this news, and it is really frustrating how no one even seems to want to analyze this carefully... "bUt FaCeBoOk Is EvIl!!" :/.
  - jarkhen 6y ago
    Unfortunately, your interpretation of facebook's motives require trusting that they'll only do what their PR says they'll do, and not what they're able to do. Or, even if that is their current reasoning, one then has to trust that they won't then take advantage of said ability in the future. For many of us, facebook's past actions are more than enough to prove that they do not deserve the benefit of the doubt in this case.
    - shuckles 6y ago
      In addition, if this is indeed the backstory, then Facebook’s product management team failed miserably by not owning the story and instead deferring to anonymous internet commenters to explain their changes.
- Stierlitz 6y ago
  > .. The WhatsApp server has no access to the client’s private keys .. обманывать
emaro 6y ago
Is anyone surprised?
cartmanishere 6y ago
They are talking about public keys though. They just removed the part about not having access to private keys. Omission of the line doesn't actually mean that they now have access to private keys as well.
- LockAndLol 6y ago
  It doesn't mean they don't either. It's the removal of the previous claim that's worrying. But honestly, it doesn't matter anyway since Whatsapp is somehow able to backup all your data on Google Drive and restore it on separate phones. How are they able to do that without backing up the private key? https://faq.whatsapp.com/android/chats/how-to-restore-your-chat-history/?lang=en https://faq.whatsapp.com/android/chats/how-to-restore-your-c...
  - SahAssar 6y ago
    I thought the backups were unencrypted (or encrypted with a key that was specific to backups) for that exact purpose.
  - AkshitGarg 6y ago
    The backups are unencrypted as highlighted in the UI (if I recall correctly). They re-generate the keys when you switch phones / re-install / clear data. That's when you get to see the "XYZ's security code changed" service message
    - LockAndLol 6y ago
      I guess it makes sense. Doesn't make a difference if you deliver the chest with the key to the lock or the chest without the lock. > For example, if you use a data backup service integrated with our Services (like iCloud or Google Drive), they will receive information you share with them, such as your WhatsApp messages. https://www.whatsapp.com/legal/updates/privacy-policy/?lang=en https://www.whatsapp.com/legal/updates/privacy-policy/?lang=... Looks like you're right, it must be unencrypted.
- lukashed 6y ago
kevincox 6y ago
The charitable view would be that they are simplifying the document by removing redundant information. Of course the implication by the tweet is that they removed this claim because they added some mechanism for the client to turn over the keys.
trollied 6y ago
A TD:DR; for people. The "WhatsApp Encryption Overview" technical whitepaper [1] had the following text removed between revisions: "At no time does the WhatsApp server have access to any of the client's private keys." [1] https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857720642275_2152527586907531259_n.pdf/WA_Security_WhitePaper.pdf?ccb=2&_nc_sid=2fbf2a&_nc_ohc=U4i2jUSaMEwAX-hPQRz&_nc_ht=scontent.whatsapp.net&oh=9c7d28c9e915eed519735042d2aa688b&oe=601F0119 https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857...
- LockAndLol 6y ago
  Would you have a link to the previous version?
  - programbreeding 6y ago
    This website seems to have version 2 which includes that text on page 11. You can scroll down and read it without downloading it. https://www.academia.edu/36044237/WhatsApp_Encryption_Overview?auto=download https://www.academia.edu/36044237/WhatsApp_Encryption_Overvi...
  - ffpip 6y ago
    https://files.catbox.moe/fopl6w.pdf https://files.catbox.moe/fopl6w.pdf A copy I had downloaded on 29 July 2020
    - ignoramous 6y ago
      Thanks. Archived: https://archive.is/FenEt https://archive.is/FenEt
- luto 6y ago
  Instead, they added the following on page 13: > The WhatsApp server has no access to the client’s private keys, (...)
  - jjoonathan 6y ago
yarcob 6y ago
Can anybody remember the story, I think it was a few years ago, when a journalist warned in an article that messaging apps like Whatsapp are vulnerable because they rely on a server for key exchange, and all the security researchers requested that the story should be retracted because it would lead people to use SMS which is even less secure? I may be misremembering some details.
- ffpip 6y ago
  https://www.theguardian.com/technology/2017/jan/13/whatsapp-backdoor-allows-snooping-on-encrypted-messages https://www.theguardian.com/technology/2017/jan/13/whatsapp-... HN Comments - https://news.ycombinator.com/item?id=13389935 https://news.ycombinator.com/item?id=13389935 https://indianexpress.com/article/technology/tech-news-technology/researchers-ask-guardian-to-retract-whatsapp-backdoor-story-4485370/ https://indianexpress.com/article/technology/tech-news-techn...
  - yarcob 6y ago
    Thanks!
- Aachen 6y ago
  Warning that it's vulnerable because it relies on a server for key exchange is like warning that water is wet and you shouldn't let it loose in your house to prevent water damage. It's correct, but redundant. The very definition of end to end encryption is not trusting the server, so you need to verify the exchanged keys. This is a requirement in Signal, Wire, Threema, Jami, Briar, Element/Matrix, Keybase, OTR, and all other protocols. If you don't do that, then yes, you rely on whoever owns (or "owned") the server. What might need a warning is that the server can push new keys to your phone at any time and, unless you go into your security settings, you will never notice. Being warned of key changes is opt-in. That's why WhatsApp does, by default, opportunistic encryption. But Moxie was involved in the implementation and got only a few million for publishing that claim so no worries y'all.
  - thu2111 6y ago
luch 6y ago
A a side-note I'm interested in the PDF diffing tool the author is using, seems pretty well made
- dfc 6y ago
  I have always used diffpdf. Its been around forever. I don't know if it is what is used in the screenshot: http://www.qtrac.eu/diffpdf-foss.html http://www.qtrac.eu/diffpdf-foss.html
- LockAndLol 6y ago
  sudo apt-get install diffpdf https://www.linuxlinks.com/diffpdf-compare-two-pdf-files/ https://www.linuxlinks.com/diffpdf-compare-two-pdf-files/
- AkshitGarg 6y ago
  They are using https://draftable.com/compare https://draftable.com/compare
philliphaydon 6y ago
After Facebook bought what’s app, I’ve never for a moment believed it was secure. I’ve mentioned on here before about a conversation i had on what’s app and was presented with ads for the topic in Facebook right after. I’ve heard people have had similar stories. What’s app isn’t secure.
- MaxBarraclough 6y ago
  It's closed-source/proprietary/non-Free software. Even if it weren't from Facebook, that would be enough to warrant skepticism.
- ketamine__ 6y ago
  I've also heard many people claim this with Facebook and other platforms. I would love to see a study on this because I'm unsure of the evidence so far. Humans can make mistakes. They can forget typing something into Google, Facebook, etc. I can't even remember the Google searches I did yesterday!
  - andechs 6y ago
    Even then, a lot of the "I was talking about something with a friend and never even Googled it then got an ad for it" can be explained by Facebook leveraging their social graph to target ads if your friend googled something. They have a social graph that indicates who your probable friends are, regardless of actual Facebook/Instagram/Whatsapp friend status; using Bluetooth & Wifi identifiers based on physical closeness.
- therockhead 6y ago
  > I’ve mentioned on here before about a conversation i had on what’s app and was presented with ads for the topic in Facebook right after I have heard something similar to this but just assumed it was a coincidence. Has this every been proven with verified results ?
  - djeiasbsbo 6y ago
    I always see claims like this but never with actual evidence or research done. On Android, I can spoof the microphone access permission so that Whatsapp thinks it has access. I can then log whenever this permission is being used while giving it spoofed data. I have it done this for many apps and unsurprisingly, most try to access the microphone in the background over and over again. I have not done this experiment with Whatsapp yet, though. What I use for this is XPrivacyLua by M66B, which also has suppory for scriptable hooks in Lua.
john4532452 6y ago
The WhatsApp client is a closed source, so why is this news ? Is this some kind of promise from the company that the client will not have access to private keys ?
- eloff 6y ago
  WhatsApp promises end to end encryption, with no access to the content of your messages, just like iMessage and signal. This tweet doesn't establish otherwise.
  - parliament32 6y ago
    The app can still provide end-to-end encryption while simultaneously piping your private keys direct to FB. They're not really related.
    - eloff 6y ago
      Of course it's related. To do that undermines the entire point of end to end encryption. It's a strong allegation with no evidence to support it. It would also completely invalidate their "we don't have the keys" defence to law enforcement requests.
drcongo 6y ago
Don't they _need_ the private keys to mine all your messages for data on which to base the in-chat ads? This shouldn't be a surprise after recent announcements.
- arendtio 6y ago
  Not necessarily. In the past, there were also reports which showed, that if the Facebook App is installed on the same device, it would have access to the decrypted messages (not sure for which platform though).
tuyguntn 6y ago
I have a question to people who said Telegram is worse than WhatsApp in every possible way for privacy. Do you still hold this belief? At least Telegram is holding its promise, if you start secret chat only you and your peer knows encryption keys
- eurasiantiger 6y ago
  Didn’t Telegram roll their own crypto?
  - tuyguntn 6y ago
    Sure, they rolled their own encryption. But, lets look at this problem from different point of view. Every encryption protocol is invented by some group of people, Signal and Telegram is no exception, only difference is other encryption algorithms are tested, audited and verified by time for security. Keep in mind, every algorithm is rolled out by someone, you can't say there will be no better encryption algorithm in the future than all available today. So someone will roll their own crypto anyway in the future, which might be more secure than everything we have today.
  - dbrgn 6y ago
    Please stop bringing up this "never roll your own crypto" argument. It's a guideline, not a hard rule. Signal actually rolled their own crypto and aren't constantly criticized for that, on the contrary. Signal is praised for rolling it's own crypto. Don't get me wrong, the Telegram crypto can (and should) definitely be criticized. But please criticize that they use "bad crypto" or "strange crypto" or "unreviewed crypto", not that it's their own. (And of course, substantiate such claims with references that can be discussed.)
    - maxerickson 6y ago
      There's no need to continue litigating Telegram's crypto. (the criticisms are well enough known that people either aren't going to listen or can just go read them)
0x426577617265 6y ago
Might be worth a search of court cases to see if there are any cases out there where Facebook provided WhatsApp messages to law enforcement.
- inetknght 6y ago
  Unfortunately I think that would be suppressed by asking the court to seal documents et al
deleted 6y ago
[deleted]
freakynit 6y ago
Has anyone tried getsession.org? Seems one step further to signal and telegram..
- kseistrup 6y ago
  In spite of what their website says, I'm pretty sure they removed multi-device support a good while ago, which makes it less useful. I just tried out version 1.4.4 for desktop, and device linking is nowhere to be found anymore.
  - kseistrup 6y ago
    Issue from April 2020 says “We only allow one linked device currently”: ⌘ https://github.com/loki-project/session-desktop/issues/1104 https://github.com/loki-project/session-desktop/issues/1104
  - adsharma 6y ago
    I like their idea though. Encryption without a server. I independently implemented similar ideas over the holidays and then discovered that there were people with similar ideas. Code: https://github.com/adsharma/zre_raft/blob/main/zre_raft/zre_signal.py https://github.com/adsharma/zre_raft/blob/main/zre_raft/zre_... Usage: https://github.com/adsharma/zre_raft/commit/b6f897539d1bef10c3467b8478b109a463003067 https://github.com/adsharma/zre_raft/commit/b6f897539d1bef10...
Turm 6y ago
Old version of the document: https://web.archive.org/web/20201006213050/https://scontent.whatsapp.net/v/t39.8562-34/89275998_627986927772871_4167828889579552768_n.pdf?_nc_sid=2fbf2a&_nc_ohc=qZfipuJqvJ4AX_CVBf4&_nc_ht=scontent.whatsapp.net&oh=c5da860a45943b6a8b349cdde1464df8&oe=5FA418D1 https://web.archive.org/web/20201006213050/https://scontent.... This change was introduced in October 2020
Aussie747400 6y ago
Was anyone even the least bit surprised at this point?
janlukacs 6y ago
I've deleted my WhatsApp account today. It was the only product I've ever used from Facebook, and it will be the last. Say no to this spyware machine.
- leokennis 6y ago
  Yep. Probably the recent WhatsApp hype was overblown, and the situation after 08-02-2021 will not be so different from the situation now. But that situation is still that WhatsApp profits, and is produced and maintained by, one of the most morally bankrupt companies on earth. So to ditch it is still a good thing.
brokenwallet 6y ago
For many people, moving from WhatsApp can only happen if enough people are on the alternative. This momentum is a good opportunity to ask friends and family to install Signal. Go for it!
nottorp 6y ago
It really depends on what you use whatsapp for. The US usage patterns seem different, but where I am everyone has whatsapp and it's basically used as a sms system that actually works. If you compare whatsapp's security and features to sms security and features, you stop caring. If you really want trustable end to end encryption, there are other apps for that :)
leokennis 6y ago
So if I understand correctly, when a business uses WhatsApp, to maintain E2EE WhatsApp must "emulate" as if all customer reps of that business were sending WhatsApp messages through one phone. To do that, all reps connect to what is essentially one WhatsApp instance in a Docker container. This container holds the private key. And if a business tells Facebook to host that container, this means Facebook has possession of the private key?

491 points by Aissen 6y ago

Yikes. The bad news about WhatsApp just keeps pouring in. For me personally I only ever used WhatsApp very lightly with a few work friends. After all of the recent news surrounding the app I sent a message saying I plan on leaving the app soon. I wish it were easier to switch apps like this but it makes sense that they wouldn't want that to be the case.

GrayShade 6y ago

Probably because: All chats use the same Signal protocol outlined in this whitepaper, regardless of their end-to-end encryption status. The WhatsApp server has no access to the client’s private keys, though if a business user delegates operation of their Business API client to a vendor, that vendor will have access to their private keys - including if that vendor is Facebook. (https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857720642275_2152527586907531259_n.pdf/WA_Security_WhitePaper.pdf https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857..., p. 13)

voxic11 6y ago
Probably not because that doesn't say whatsapp will have the private keys, just that the vender will. In fact the next sentence you left out of the quote is > However, these private keys will still not be stored on the WhatsApp chat server.
- GrayShade 6y ago
  That's in a different place (p. 11), but the gist is still the same. Even my quote includes "The WhatsApp server has no access to the client’s private keys". I guess it wasn't clear, but I was trying to refute the claim implied by the Twitter post (by showing that the document still claims that WhatsApp servers don't have access to the private keys).
saurik 6y ago
Yeah. It is really clear that Facebook is finally getting around to just implementing this feature of effectively having "hosted clients" for companies to be able to more easily--and yes: less securely--build chat bots (a mechanism that I appreciate is maybe less than ideal to encourage, but frankly just doesn't feel that bad and certainly isn't a surprise: Facebook has been taking about this for a year or two now); and all of the "changes" this week have been directly because of this, including the Privacy Policy update... the key article about which even explicitly said: > The move, the spokeswoman said, is part of a previously disclosed move to allow businesses to store and manage WhatsApp chats using Facebook's infrastructure. Users won't have to use WhatsApp to interact with the businesses and have the option of blocking the businesses. She said there will be no change in how WhatsApp shares provides data with Facebook for non-business chats and account data. And yet, somehow, everyone is just in complete hysterics over all of this, claiming Facebook is evil and undermining the feeling of security people have in WhatsApp, with lots of talk of switching not only to reasonable alternatives like Signal, but also to less secure messaging protocols like Telegram (or, frankly, Matrix). People at my supposedly-smart privacy company--Orchid, building something akin to "incentivized Tor for general VPN use"--are even panicking about this news, and it is really frustrating how no one even seems to want to analyze this carefully... "bUt FaCeBoOk Is EvIl!!" :/.
- jarkhen 6y ago
  Unfortunately, your interpretation of facebook's motives require trusting that they'll only do what their PR says they'll do, and not what they're able to do. Or, even if that is their current reasoning, one then has to trust that they won't then take advantage of said ability in the future. For many of us, facebook's past actions are more than enough to prove that they do not deserve the benefit of the doubt in this case.
  - shuckles 6y ago
    In addition, if this is indeed the backstory, then Facebook’s product management team failed miserably by not owning the story and instead deferring to anonymous internet commenters to explain their changes.
Stierlitz 6y ago
> .. The WhatsApp server has no access to the client’s private keys .. обманывать

emaro 6y ago

Is anyone surprised?

cartmanishere 6y ago

They are talking about public keys though. They just removed the part about not having access to private keys. Omission of the line doesn't actually mean that they now have access to private keys as well.

LockAndLol 6y ago
It doesn't mean they don't either. It's the removal of the previous claim that's worrying. But honestly, it doesn't matter anyway since Whatsapp is somehow able to backup all your data on Google Drive and restore it on separate phones. How are they able to do that without backing up the private key? https://faq.whatsapp.com/android/chats/how-to-restore-your-chat-history/?lang=en https://faq.whatsapp.com/android/chats/how-to-restore-your-c...
- SahAssar 6y ago
  I thought the backups were unencrypted (or encrypted with a key that was specific to backups) for that exact purpose.
- AkshitGarg 6y ago
  The backups are unencrypted as highlighted in the UI (if I recall correctly). They re-generate the keys when you switch phones / re-install / clear data. That's when you get to see the "XYZ's security code changed" service message
  - LockAndLol 6y ago
    I guess it makes sense. Doesn't make a difference if you deliver the chest with the key to the lock or the chest without the lock. > For example, if you use a data backup service integrated with our Services (like iCloud or Google Drive), they will receive information you share with them, such as your WhatsApp messages. https://www.whatsapp.com/legal/updates/privacy-policy/?lang=en https://www.whatsapp.com/legal/updates/privacy-policy/?lang=... Looks like you're right, it must be unencrypted.
lukashed 6y ago

kevincox 6y ago

The charitable view would be that they are simplifying the document by removing redundant information. Of course the implication by the tweet is that they removed this claim because they added some mechanism for the client to turn over the keys.

trollied 6y ago

A TD:DR; for people. The "WhatsApp Encryption Overview" technical whitepaper [1] had the following text removed between revisions: "At no time does the WhatsApp server have access to any of the client's private keys." [1] https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857720642275_2152527586907531259_n.pdf/WA_Security_WhitePaper.pdf?ccb=2&_nc_sid=2fbf2a&_nc_ohc=U4i2jUSaMEwAX-hPQRz&_nc_ht=scontent.whatsapp.net&oh=9c7d28c9e915eed519735042d2aa688b&oe=601F0119 https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857...

LockAndLol 6y ago
Would you have a link to the previous version?
- programbreeding 6y ago
  This website seems to have version 2 which includes that text on page 11. You can scroll down and read it without downloading it. https://www.academia.edu/36044237/WhatsApp_Encryption_Overview?auto=download https://www.academia.edu/36044237/WhatsApp_Encryption_Overvi...
- ffpip 6y ago
  https://files.catbox.moe/fopl6w.pdf https://files.catbox.moe/fopl6w.pdf A copy I had downloaded on 29 July 2020
  - ignoramous 6y ago
    Thanks. Archived: https://archive.is/FenEt https://archive.is/FenEt
luto 6y ago
Instead, they added the following on page 13: > The WhatsApp server has no access to the client’s private keys, (...)
- jjoonathan 6y ago

yarcob 6y ago

Can anybody remember the story, I think it was a few years ago, when a journalist warned in an article that messaging apps like Whatsapp are vulnerable because they rely on a server for key exchange, and all the security researchers requested that the story should be retracted because it would lead people to use SMS which is even less secure? I may be misremembering some details.

ffpip 6y ago
https://www.theguardian.com/technology/2017/jan/13/whatsapp-backdoor-allows-snooping-on-encrypted-messages https://www.theguardian.com/technology/2017/jan/13/whatsapp-... HN Comments - https://news.ycombinator.com/item?id=13389935 https://news.ycombinator.com/item?id=13389935 https://indianexpress.com/article/technology/tech-news-technology/researchers-ask-guardian-to-retract-whatsapp-backdoor-story-4485370/ https://indianexpress.com/article/technology/tech-news-techn...
- yarcob 6y ago
  Thanks!
Aachen 6y ago
Warning that it's vulnerable because it relies on a server for key exchange is like warning that water is wet and you shouldn't let it loose in your house to prevent water damage. It's correct, but redundant. The very definition of end to end encryption is not trusting the server, so you need to verify the exchanged keys. This is a requirement in Signal, Wire, Threema, Jami, Briar, Element/Matrix, Keybase, OTR, and all other protocols. If you don't do that, then yes, you rely on whoever owns (or "owned") the server. What might need a warning is that the server can push new keys to your phone at any time and, unless you go into your security settings, you will never notice. Being warned of key changes is opt-in. That's why WhatsApp does, by default, opportunistic encryption. But Moxie was involved in the implementation and got only a few million for publishing that claim so no worries y'all.
- thu2111 6y ago

luch 6y ago

A a side-note I'm interested in the PDF diffing tool the author is using, seems pretty well made

dfc 6y ago
I have always used diffpdf. Its been around forever. I don't know if it is what is used in the screenshot: http://www.qtrac.eu/diffpdf-foss.html http://www.qtrac.eu/diffpdf-foss.html
LockAndLol 6y ago
sudo apt-get install diffpdf https://www.linuxlinks.com/diffpdf-compare-two-pdf-files/ https://www.linuxlinks.com/diffpdf-compare-two-pdf-files/
AkshitGarg 6y ago
They are using https://draftable.com/compare https://draftable.com/compare

philliphaydon 6y ago

After Facebook bought what’s app, I’ve never for a moment believed it was secure. I’ve mentioned on here before about a conversation i had on what’s app and was presented with ads for the topic in Facebook right after. I’ve heard people have had similar stories. What’s app isn’t secure.

MaxBarraclough 6y ago
It's closed-source/proprietary/non-Free software. Even if it weren't from Facebook, that would be enough to warrant skepticism.
ketamine__ 6y ago
I've also heard many people claim this with Facebook and other platforms. I would love to see a study on this because I'm unsure of the evidence so far. Humans can make mistakes. They can forget typing something into Google, Facebook, etc. I can't even remember the Google searches I did yesterday!
- andechs 6y ago
  Even then, a lot of the "I was talking about something with a friend and never even Googled it then got an ad for it" can be explained by Facebook leveraging their social graph to target ads if your friend googled something. They have a social graph that indicates who your probable friends are, regardless of actual Facebook/Instagram/Whatsapp friend status; using Bluetooth & Wifi identifiers based on physical closeness.
therockhead 6y ago
> I’ve mentioned on here before about a conversation i had on what’s app and was presented with ads for the topic in Facebook right after I have heard something similar to this but just assumed it was a coincidence. Has this every been proven with verified results ?
- djeiasbsbo 6y ago
  I always see claims like this but never with actual evidence or research done. On Android, I can spoof the microphone access permission so that Whatsapp thinks it has access. I can then log whenever this permission is being used while giving it spoofed data. I have it done this for many apps and unsurprisingly, most try to access the microphone in the background over and over again. I have not done this experiment with Whatsapp yet, though. What I use for this is XPrivacyLua by M66B, which also has suppory for scriptable hooks in Lua.

john4532452 6y ago

The WhatsApp client is a closed source, so why is this news ? Is this some kind of promise from the company that the client will not have access to private keys ?

eloff 6y ago
WhatsApp promises end to end encryption, with no access to the content of your messages, just like iMessage and signal. This tweet doesn't establish otherwise.
- parliament32 6y ago
  The app can still provide end-to-end encryption while simultaneously piping your private keys direct to FB. They're not really related.
  - eloff 6y ago
    Of course it's related. To do that undermines the entire point of end to end encryption. It's a strong allegation with no evidence to support it. It would also completely invalidate their "we don't have the keys" defence to law enforcement requests.

drcongo 6y ago

Don't they _need_ the private keys to mine all your messages for data on which to base the in-chat ads? This shouldn't be a surprise after recent announcements.

arendtio 6y ago
Not necessarily. In the past, there were also reports which showed, that if the Facebook App is installed on the same device, it would have access to the decrypted messages (not sure for which platform though).

tuyguntn 6y ago

I have a question to people who said Telegram is worse than WhatsApp in every possible way for privacy. Do you still hold this belief? At least Telegram is holding its promise, if you start secret chat only you and your peer knows encryption keys

eurasiantiger 6y ago
Didn’t Telegram roll their own crypto?
- tuyguntn 6y ago
  Sure, they rolled their own encryption. But, lets look at this problem from different point of view. Every encryption protocol is invented by some group of people, Signal and Telegram is no exception, only difference is other encryption algorithms are tested, audited and verified by time for security. Keep in mind, every algorithm is rolled out by someone, you can't say there will be no better encryption algorithm in the future than all available today. So someone will roll their own crypto anyway in the future, which might be more secure than everything we have today.
- dbrgn 6y ago
  Please stop bringing up this "never roll your own crypto" argument. It's a guideline, not a hard rule. Signal actually rolled their own crypto and aren't constantly criticized for that, on the contrary. Signal is praised for rolling it's own crypto. Don't get me wrong, the Telegram crypto can (and should) definitely be criticized. But please criticize that they use "bad crypto" or "strange crypto" or "unreviewed crypto", not that it's their own. (And of course, substantiate such claims with references that can be discussed.)
  - maxerickson 6y ago
    There's no need to continue litigating Telegram's crypto. (the criticisms are well enough known that people either aren't going to listen or can just go read them)

0x426577617265 6y ago

Might be worth a search of court cases to see if there are any cases out there where Facebook provided WhatsApp messages to law enforcement.

inetknght 6y ago
Unfortunately I think that would be suppressed by asking the court to seal documents et al

deleted 6y ago

[deleted]

freakynit 6y ago

Has anyone tried getsession.org? Seems one step further to signal and telegram..

kseistrup 6y ago
In spite of what their website says, I'm pretty sure they removed multi-device support a good while ago, which makes it less useful. I just tried out version 1.4.4 for desktop, and device linking is nowhere to be found anymore.
- kseistrup 6y ago
  Issue from April 2020 says “We only allow one linked device currently”: ⌘ https://github.com/loki-project/session-desktop/issues/1104 https://github.com/loki-project/session-desktop/issues/1104
- adsharma 6y ago
  I like their idea though. Encryption without a server. I independently implemented similar ideas over the holidays and then discovered that there were people with similar ideas. Code: https://github.com/adsharma/zre_raft/blob/main/zre_raft/zre_signal.py https://github.com/adsharma/zre_raft/blob/main/zre_raft/zre_... Usage: https://github.com/adsharma/zre_raft/commit/b6f897539d1bef10c3467b8478b109a463003067 https://github.com/adsharma/zre_raft/commit/b6f897539d1bef10...

Turm 6y ago

Old version of the document: https://web.archive.org/web/20201006213050/https://scontent.whatsapp.net/v/t39.8562-34/89275998_627986927772871_4167828889579552768_n.pdf?_nc_sid=2fbf2a&_nc_ohc=qZfipuJqvJ4AX_CVBf4&_nc_ht=scontent.whatsapp.net&oh=c5da860a45943b6a8b349cdde1464df8&oe=5FA418D1 https://web.archive.org/web/20201006213050/https://scontent.... This change was introduced in October 2020

Aussie747400 6y ago

Was anyone even the least bit surprised at this point?

janlukacs 6y ago

I've deleted my WhatsApp account today. It was the only product I've ever used from Facebook, and it will be the last. Say no to this spyware machine.

leokennis 6y ago
Yep. Probably the recent WhatsApp hype was overblown, and the situation after 08-02-2021 will not be so different from the situation now. But that situation is still that WhatsApp profits, and is produced and maintained by, one of the most morally bankrupt companies on earth. So to ditch it is still a good thing.

brokenwallet 6y ago

For many people, moving from WhatsApp can only happen if enough people are on the alternative. This momentum is a good opportunity to ask friends and family to install Signal. Go for it!

nottorp 6y ago

It really depends on what you use whatsapp for. The US usage patterns seem different, but where I am everyone has whatsapp and it's basically used as a sms system that actually works. If you compare whatsapp's security and features to sms security and features, you stop caring. If you really want trustable end to end encryption, there are other apps for that :)

leokennis 6y ago

So if I understand correctly, when a business uses WhatsApp, to maintain E2EE WhatsApp must "emulate" as if all customer reps of that business were sending WhatsApp messages through one phone. To do that, all reps connect to what is essentially one WhatsApp instance in a Docker container. This container holds the private key. And if a business tells Facebook to host that container, this means Facebook has possession of the private key?