5 ms·

Genuine question, and I'm certainly no expert in this - just a curious end-user, aren't the backups that WhatsApp creates and uploads to iCloud/GDrive kind of e

Genuine question, and I'm certainly no expert in this - just a curious end-user, aren't the backups that WhatsApp creates and uploads to iCloud/GDrive kind of encrypted? As in, I can't simply download the backup file and access the messages and media? My understanding is that in order to restore/access said messages and media, you would need the SIM/phone number that created the backup file and would have to register again with WhatsApp to receive a decryption key from WhatsApp servers. So doesn't this mean in effect that even though it's not super secure, the backup file stored on iCloud/GDrive is also protected from Apple and Google's prying eyes? EDIT: For anyone interested, the backups are indeed encrypted. See: https://security.stackexchange.com/questions/136072/how-can-whatsapp-restore-local-or-google-drive-backups?rq=1 https://security.stackexchange.com/questions/136072/how-can-...

deleted 6y ago
[deleted]
Ashoat 6y ago
My understanding is that WhatsApp backups are plaintext. It's true that Apple/Google can't recover your WhatsApp account with just the plaintext, but I believe they can read the messages.
- srhngpr 6y ago
  Thanks for replying! This is concerning if true. Is this documented or proven anywhere? I had heard something similar, but can't seem to find any reliable source that confirms the messages are in plaintext.
  - ffpip 6y ago
    https://www.tomshardware.com/news/whatsapp-google-drive-backups-plaintext,37718.html https://www.tomshardware.com/news/whatsapp-google-drive-back... WhatsApp recently announced that users will soon be able to backup all of their data to Google Drive without that storage eating into their allocated Drive storage. What the company ommitted to say at the time was that the data backed-up to Drive will be stored in plaintext, without any encryption.
tomp 6y ago
If WhatsApp has the decryption key, it's not end-to-end encrypted. If Apple has your decryption key, then iCloud uploads aren't encrypted (and Apple seems to have the decryption key, as they offer "reset password" functionality).
- srhngpr 6y ago
  The backups aren't E2E encrypted, WhatsApp even tells you this in the backup settings page in the app. But if they hold the decryption key and the only way to get it is via registering with a WhatsApp server via SMS verification, then doesn't that imply that Apple and Google don't have the key and can't read or restore the messages?
coolspot 6y ago
WhatsApp backup is unencrypted on both iOS/iCloud and Android/GDrive.
- srhngpr 6y ago
  I keep hearing this, but is there an actual reliable source that confirms it? If it were that easy, then I could technically restore anyone's GDrive backup from WhatsApp on my Android phone simply if I got access to the same Google account, but I believe this is not possible as you have to also verify the phone number via SMS.
  - llimos 6y ago
    They say it themselves https://faq.whatsapp.com/android/chats/about-google-drive-backups/ https://faq.whatsapp.com/android/chats/about-google-drive-ba... "Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive."
    - srhngpr 6y ago
      That statement is correct. E2E encryption is only in effect between two devices communicating with each other. The moment the messages leave the app in any capacity (e.g., screenshots, backup, forwarded to another convo/contact, etc.) it is not longer protected by E2E encryption. The backup file itself that is uploaded to iCloud/GDrive is encrypted; see: https://security.stackexchange.com/questions/136072/how-can-whatsapp-restore-local-or-google-drive-backups?rq=1 https://security.stackexchange.com/questions/136072/how-can-...
      - ffpip 6y ago
        It used to be encrypted. However, Google and Whatsapp have a deal that states Whatsapp backups dont count towards drive storage quotas. It became plaintext (or at least unencrypted after that) https://www.tomshardware.com/news/whatsapp-google-drive-backups-plaintext,37718.html https://www.tomshardware.com/news/whatsapp-google-drive-back...

deleted 6y ago

[deleted]

Ashoat 6y ago

My understanding is that WhatsApp backups are plaintext. It's true that Apple/Google can't recover your WhatsApp account with just the plaintext, but I believe they can read the messages.

srhngpr 6y ago
Thanks for replying! This is concerning if true. Is this documented or proven anywhere? I had heard something similar, but can't seem to find any reliable source that confirms the messages are in plaintext.
- ffpip 6y ago
  https://www.tomshardware.com/news/whatsapp-google-drive-backups-plaintext,37718.html https://www.tomshardware.com/news/whatsapp-google-drive-back... WhatsApp recently announced that users will soon be able to backup all of their data to Google Drive without that storage eating into their allocated Drive storage. What the company ommitted to say at the time was that the data backed-up to Drive will be stored in plaintext, without any encryption.

tomp 6y ago

If WhatsApp has the decryption key, it's not end-to-end encrypted. If Apple has your decryption key, then iCloud uploads aren't encrypted (and Apple seems to have the decryption key, as they offer "reset password" functionality).

srhngpr 6y ago
The backups aren't E2E encrypted, WhatsApp even tells you this in the backup settings page in the app. But if they hold the decryption key and the only way to get it is via registering with a WhatsApp server via SMS verification, then doesn't that imply that Apple and Google don't have the key and can't read or restore the messages?

coolspot 6y ago

WhatsApp backup is unencrypted on both iOS/iCloud and Android/GDrive.

srhngpr 6y ago
I keep hearing this, but is there an actual reliable source that confirms it? If it were that easy, then I could technically restore anyone's GDrive backup from WhatsApp on my Android phone simply if I got access to the same Google account, but I believe this is not possible as you have to also verify the phone number via SMS.
- llimos 6y ago
  They say it themselves https://faq.whatsapp.com/android/chats/about-google-drive-backups/ https://faq.whatsapp.com/android/chats/about-google-drive-ba... "Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive."
  - srhngpr 6y ago
    That statement is correct. E2E encryption is only in effect between two devices communicating with each other. The moment the messages leave the app in any capacity (e.g., screenshots, backup, forwarded to another convo/contact, etc.) it is not longer protected by E2E encryption. The backup file itself that is uploaded to iCloud/GDrive is encrypted; see: https://security.stackexchange.com/questions/136072/how-can-whatsapp-restore-local-or-google-drive-backups?rq=1 https://security.stackexchange.com/questions/136072/how-can-...
    - ffpip 6y ago
      It used to be encrypted. However, Google and Whatsapp have a deal that states Whatsapp backups dont count towards drive storage quotas. It became plaintext (or at least unencrypted after that) https://www.tomshardware.com/news/whatsapp-google-drive-backups-plaintext,37718.html https://www.tomshardware.com/news/whatsapp-google-drive-back...