5 ms·

WhatsApp moderators can read your messages if someone you talk to reports them

45 points by sidcool 5y ago

s_dev 5y ago
What I find the most shocking about all this is that people believe Facebook when they said it was E2E. If you can't inspect for yourself the default assumption should be that they're lying. I even recall recommending Signal to friends -- nope. We use WhatsApp it's E2E so even safer than Signal or Telegram that are deceitful as you have to use secret chat to get E2E! All these FB messenger advocates seem to have the same arguments and yet none of the knowledge about how it works and this ludicrous "trust" in FaceBook. At least authoritarian regimes are distrustful of Telegram and Signal -- banning them.
- prophesi 5y ago
  > We use WhatsApp it's E2E so even safer than Signal or Telegram that are deceitful as you have to use secret chat to get E2E! Just a minor correction, Telegram is the one that is only E2E encrypted via their secret chat feature. Signal is E2E encrypted at all times, and open source.
- deleted 5y ago
  [deleted]
- _ph_ 5y ago
  There is no indication that Facebook can read any messages sent encrypted. The headline might be given the wrong impression. But of course, Facebook can read messages which are sent to them in clear text to inspect them for abuse.
aborsy 5y ago
I thought WhatsApp is end to end encrypted, no?! The article is written confusingly. It looked as if Facebook has private keys, and WhatsApp is not end to end encrypted. But considering this: >> Those contractors, which Facebook acknowledges, reportedly spend their days sifting through content that WhatsApp users and the service's own algorithms flag. Does Facebook use automated tools and perform “Client-side Scanning” ? That also defeats the purpose of end to end encryption.
- sidcool 5y ago
  Same here. I think so too. It was validated by OpenWhisper systems.
  - abcd_f 5y ago
    I can’t tell if you are being sarcastic, but I sure hope that you are.
    - KaiserPro 5y ago
      https://signal.org/blog/whatsapp/ https://signal.org/blog/whatsapp/ they had a business relationship for at least two years.
      - alias_neo 5y ago
        I think that's their point. Its not just that OWS validated WhatsApps algo, they WROTE it.
  - TheChaplain 5y ago
    Correct, it is e2e, the messages are delivered intact to the receiver. It's just that the receivers are leaking.
  - alias_neo 5y ago
    You are aware that Open Whisper Systems are the person(s)[0] who wrote WhatsApp's encryption protocol, right? [0] https://en.wikipedia.org/wiki/Moxie_Marlinspike https://en.wikipedia.org/wiki/Moxie_Marlinspike
- piva00 5y ago
  Nothing stops it from sending the unencrypted version when someone reports a message they can read, it's just grabbing the plain text and sending to moderation. Completely abusable... So E2E encryption doesn't really save us here.
rvz 5y ago
Beyond the headline, it does only... > ...when a user reports abuse, unencrypted versions of the message are sent to WhatsApp's moderation contractors, ProPublica reports. So in the end, it is possible to abuse this on to anyone and the messages can be sent to Facebook unencrypted. Did WhatsApp (Facebook) disclose this anywhere? If not then, Oh dear.
- pj1115 5y ago
  It's in their "Security and Privacy" FAQ, for one: https://faq.whatsapp.com/general/security-and-privacy/about-blocking-and-reporting-contacts https://faq.whatsapp.com/general/security-and-privacy/about-...
- 0xCMP 5y ago
  Literally explains it when reporting. This should not be news or new. Just try reporting a message right now.
- criley2 5y ago
  If you think it's crazy that a user who you send messages to can send your messages to Facebook, wait until you realize they can send your messages to literally everyone and anyone. E2E only protects between the endpoints, not after.
nc 5y ago
so you can report a message thread to fb for abuse and then contractors check the messages to verify for said abuse. how is this news? it's the equivalent of taking a screenshot of a whatsapp thread and reporting that, doesn't affect e2e encrpytion in any way.
- s_dev 5y ago
  If someone other than sender or recipient can read messages -- it's not E2E.
  - glugc 5y ago
    By your logic signal is not e2e because I can copy a message from a friend and post it here.
    - silon42 5y ago
      Actual problem is that you can't (must / should not) write your own client and control your keys).
    - pluc 5y ago
      e2e is only as secure as either of your e's
    - phkahler 5y ago
      If you have access to the message, you can do whatever you want with it. There is no way around that. End-to-end encryption is like a mathematically sealed envelop and only prevents seeing the message in transit. What sender or receiver choose to do is always up to them.
  - phartenfeller 5y ago
    Technically the communication between both ends is encrypted. What each end does with the unencrypted content is out of the scope of E2E encryption.
  - KaiserPro 5y ago
deleted 5y ago
[deleted]
glugc 5y ago
I read somewhere that WhatsApp uses some AI to detect CSAM and send content automatically and without user consent to Facebook for review. Has this been confirmed?
- saurik 5y ago
  https://twitter.com/wcathcart/status/1423701473624395784 https://twitter.com/wcathcart/status/1423701473624395784 ^ This is the Head of WhatsApp at Facebook specifically calling out Apple for their client-side scanning, pointing out that Apple should instead have a way to report content; so, while he technically could be lying, I doubt that's true.
- KaiserPro 5y ago
  it is not confirmed. The wired/gizmodo article tries its best to imply that it does. the main claim comes from one of the moderators saying that: "the ai keeps sending us mundane pictures, like kids in bathtubs". This has allowed people to claim that facebook are scanning every image/message. Where as, obviously given the paltry number of moderators, your going to us AI to triage messages. Otherwise you'd have to spend more cash on staff I think there is another bit where someone says they can trace the journey of the image. Its pretty trivial to do this with metadata, given that whatsapp leaks a fair bit of metadata its not suprising.
zarzavat 5y ago
Journalists say they don't write clickbait, but they do. Wait until journalists find out about the chat export feature of WhatsApp. Or the share button. Think how much juicy clickbait could be written about those features.
cascom 5y ago
My question is whether that functionality can be triggered remotely (rather than a user creating an unencrypted message digest and sending it to Facebook)
- phkahler 5y ago
  Well if its Apple, they might have AI scan the message prior to sending. Oh wait, that's images in iCloud, not iMessages.
ike77 5y ago
I wonder if Business Insider was paid by Facebook to report a news so absolutely obvious and benign, and package it as if it was part of the serious privacy requests formulated by the public and security/privacy NGOs, in order to discredit those.
2Gkashmiri 5y ago
Many years ago I read how Facebook was developing technology where they would hash content before encrypting, checking against a list and then notifying. Current csam tech basically. That time I understood the whole e2e is for outsiders. Essentially, you cant have this data, only we do. First dibs and all.
dbsmith83 5y ago
It's a little clickbaity. Here is the core of the article: > A Facebook representative told Insider that it allows users to report abuse, and those reports are then reviewed by contractors. When a user reports abuse, WhatsApp moderators are sent "the most recent messages sent to you by the reported user or group, according to WhatsApp's FAQ. > WhatsApp is founded on so-called "end-to-end" encryption, which means that messages are scrambled before being sent and only unscrambled when they're received by the intended user. But when a user reports abuse, unencrypted versions of the message are sent to WhatsApp's moderation contractors, ProPublica reports.
merricksb 5y ago
Discussed previously... https://news.ycombinator.com/item?id=28448593 https://news.ycombinator.com/item?id=28448593

45 points by sidcool 5y ago

What I find the most shocking about all this is that people believe Facebook when they said it was E2E. If you can't inspect for yourself the default assumption should be that they're lying. I even recall recommending Signal to friends -- nope. We use WhatsApp it's E2E so even safer than Signal or Telegram that are deceitful as you have to use secret chat to get E2E! All these FB messenger advocates seem to have the same arguments and yet none of the knowledge about how it works and this ludicrous "trust" in FaceBook. At least authoritarian regimes are distrustful of Telegram and Signal -- banning them.

prophesi 5y ago
> We use WhatsApp it's E2E so even safer than Signal or Telegram that are deceitful as you have to use secret chat to get E2E! Just a minor correction, Telegram is the one that is only E2E encrypted via their secret chat feature. Signal is E2E encrypted at all times, and open source.
deleted 5y ago
[deleted]
_ph_ 5y ago
There is no indication that Facebook can read any messages sent encrypted. The headline might be given the wrong impression. But of course, Facebook can read messages which are sent to them in clear text to inspect them for abuse.

aborsy 5y ago

I thought WhatsApp is end to end encrypted, no?! The article is written confusingly. It looked as if Facebook has private keys, and WhatsApp is not end to end encrypted. But considering this: >> Those contractors, which Facebook acknowledges, reportedly spend their days sifting through content that WhatsApp users and the service's own algorithms flag. Does Facebook use automated tools and perform “Client-side Scanning” ? That also defeats the purpose of end to end encryption.

sidcool 5y ago
Same here. I think so too. It was validated by OpenWhisper systems.
- abcd_f 5y ago
  I can’t tell if you are being sarcastic, but I sure hope that you are.
  - KaiserPro 5y ago
    https://signal.org/blog/whatsapp/ https://signal.org/blog/whatsapp/ they had a business relationship for at least two years.
    - alias_neo 5y ago
      I think that's their point. Its not just that OWS validated WhatsApps algo, they WROTE it.
- TheChaplain 5y ago
  Correct, it is e2e, the messages are delivered intact to the receiver. It's just that the receivers are leaking.
- alias_neo 5y ago
  You are aware that Open Whisper Systems are the person(s)[0] who wrote WhatsApp's encryption protocol, right? [0] https://en.wikipedia.org/wiki/Moxie_Marlinspike https://en.wikipedia.org/wiki/Moxie_Marlinspike
piva00 5y ago
Nothing stops it from sending the unencrypted version when someone reports a message they can read, it's just grabbing the plain text and sending to moderation. Completely abusable... So E2E encryption doesn't really save us here.

rvz 5y ago

Beyond the headline, it does only... > ...when a user reports abuse, unencrypted versions of the message are sent to WhatsApp's moderation contractors, ProPublica reports. So in the end, it is possible to abuse this on to anyone and the messages can be sent to Facebook unencrypted. Did WhatsApp (Facebook) disclose this anywhere? If not then, Oh dear.

pj1115 5y ago
It's in their "Security and Privacy" FAQ, for one: https://faq.whatsapp.com/general/security-and-privacy/about-blocking-and-reporting-contacts https://faq.whatsapp.com/general/security-and-privacy/about-...
0xCMP 5y ago
Literally explains it when reporting. This should not be news or new. Just try reporting a message right now.
criley2 5y ago
If you think it's crazy that a user who you send messages to can send your messages to Facebook, wait until you realize they can send your messages to literally everyone and anyone. E2E only protects between the endpoints, not after.

nc 5y ago

so you can report a message thread to fb for abuse and then contractors check the messages to verify for said abuse. how is this news? it's the equivalent of taking a screenshot of a whatsapp thread and reporting that, doesn't affect e2e encrpytion in any way.

s_dev 5y ago
If someone other than sender or recipient can read messages -- it's not E2E.
- glugc 5y ago
  By your logic signal is not e2e because I can copy a message from a friend and post it here.
  - silon42 5y ago
    Actual problem is that you can't (must / should not) write your own client and control your keys).
  - pluc 5y ago
    e2e is only as secure as either of your e's
  - phkahler 5y ago
    If you have access to the message, you can do whatever you want with it. There is no way around that. End-to-end encryption is like a mathematically sealed envelop and only prevents seeing the message in transit. What sender or receiver choose to do is always up to them.
- phartenfeller 5y ago
  Technically the communication between both ends is encrypted. What each end does with the unencrypted content is out of the scope of E2E encryption.
- KaiserPro 5y ago

deleted 5y ago

[deleted]

glugc 5y ago

I read somewhere that WhatsApp uses some AI to detect CSAM and send content automatically and without user consent to Facebook for review. Has this been confirmed?

saurik 5y ago
https://twitter.com/wcathcart/status/1423701473624395784 https://twitter.com/wcathcart/status/1423701473624395784 ^ This is the Head of WhatsApp at Facebook specifically calling out Apple for their client-side scanning, pointing out that Apple should instead have a way to report content; so, while he technically could be lying, I doubt that's true.
KaiserPro 5y ago
it is not confirmed. The wired/gizmodo article tries its best to imply that it does. the main claim comes from one of the moderators saying that: "the ai keeps sending us mundane pictures, like kids in bathtubs". This has allowed people to claim that facebook are scanning every image/message. Where as, obviously given the paltry number of moderators, your going to us AI to triage messages. Otherwise you'd have to spend more cash on staff I think there is another bit where someone says they can trace the journey of the image. Its pretty trivial to do this with metadata, given that whatsapp leaks a fair bit of metadata its not suprising.

zarzavat 5y ago

Journalists say they don't write clickbait, but they do. Wait until journalists find out about the chat export feature of WhatsApp. Or the share button. Think how much juicy clickbait could be written about those features.

cascom 5y ago

My question is whether that functionality can be triggered remotely (rather than a user creating an unencrypted message digest and sending it to Facebook)

phkahler 5y ago
Well if its Apple, they might have AI scan the message prior to sending. Oh wait, that's images in iCloud, not iMessages.

ike77 5y ago

I wonder if Business Insider was paid by Facebook to report a news so absolutely obvious and benign, and package it as if it was part of the serious privacy requests formulated by the public and security/privacy NGOs, in order to discredit those.

2Gkashmiri 5y ago

Many years ago I read how Facebook was developing technology where they would hash content before encrypting, checking against a list and then notifying. Current csam tech basically. That time I understood the whole e2e is for outsiders. Essentially, you cant have this data, only we do. First dibs and all.

dbsmith83 5y ago

It's a little clickbaity. Here is the core of the article: > A Facebook representative told Insider that it allows users to report abuse, and those reports are then reviewed by contractors. When a user reports abuse, WhatsApp moderators are sent "the most recent messages sent to you by the reported user or group, according to WhatsApp's FAQ. > WhatsApp is founded on so-called "end-to-end" encryption, which means that messages are scrambled before being sent and only unscrambled when they're received by the intended user. But when a user reports abuse, unencrypted versions of the message are sent to WhatsApp's moderation contractors, ProPublica reports.

merricksb 5y ago

Discussed previously... https://news.ycombinator.com/item?id=28448593 https://news.ycombinator.com/item?id=28448593