2 ms·

> They used to have encrypted backups, but at some point in time, the Android backup (and AFAIK the iOS backup as well) dropped encryption. Is this actually th

> They used to have encrypted backups, but at some point in time, the Android backup (and AFAIK the iOS backup as well) dropped encryption. Is this actually the case? I know they say it's not protected by E2EE, but my understanding is: - images are unencrypted (just like they're accessible on your phone's external storage, where many apps can read them) - the text messages are encrypted, but the key is escrowed with Facebook, who will provide it to anyone who can pass SMS verification This means that an attacker has to get access to both your Whatsapp account and your Google/Apple account. This isn't a very high hurdle (for governments, this likely just means two subpoenas, and for other attackers, it just means getting access to your phone number through one way or another, because in many cases that will let them hijack most of your accounts), but it seems slightly better than unencrypted.

beagle3 6y ago
The copy of the backup on Google drive/storage (whatever they call the app backup) is completely unencrypted. Google won’t just give it to you - if you want it, you have to impersonate the WhatsApp app. The local backup on your device is encrypted. Facebook will give it to anyone who can read their SMS message, as long as they also impersonate WhatsApp. The bottom line is that without much work, google has full access to your data in whichever way they desire, but you only have access through the sanctioned app. Which means for a state level actor, it’s at most one subpoena and likely they have streamlined that XKeyScore style, so not even that.
- strogonoff 6y ago
  Can WhatsApp’s own backup be turned off? On the iOS side of things, if WhatsApp data gets backed up to iCloud alongside the rest of the device, it will be encrypted but not E2E (which makes it largely pointless)—however, you can turn iCloud backup off.
  - beagle3 6y ago
    It can be turned off, but IIRC it's on by default, and probably on for 99% of all users.
- tgsovlerkhgsel 6y ago
  > The copy of the backup on Google drive/storage (whatever they call the app backup) is completely unencrypted. Any idea why they do that, instead of applying exactly the same encryption? Also, is there any place where this is documented (where I can point people to that ask me the same question)?

beagle3 6y ago

The copy of the backup on Google drive/storage (whatever they call the app backup) is completely unencrypted. Google won’t just give it to you - if you want it, you have to impersonate the WhatsApp app. The local backup on your device is encrypted. Facebook will give it to anyone who can read their SMS message, as long as they also impersonate WhatsApp. The bottom line is that without much work, google has full access to your data in whichever way they desire, but you only have access through the sanctioned app. Which means for a state level actor, it’s at most one subpoena and likely they have streamlined that XKeyScore style, so not even that.

strogonoff 6y ago
Can WhatsApp’s own backup be turned off? On the iOS side of things, if WhatsApp data gets backed up to iCloud alongside the rest of the device, it will be encrypted but not E2E (which makes it largely pointless)—however, you can turn iCloud backup off.
- beagle3 6y ago
  It can be turned off, but IIRC it's on by default, and probably on for 99% of all users.
tgsovlerkhgsel 6y ago
> The copy of the backup on Google drive/storage (whatever they call the app backup) is completely unencrypted. Any idea why they do that, instead of applying exactly the same encryption? Also, is there any place where this is documented (where I can point people to that ask me the same question)?