5 ms·

159-169, about Google being able to decrypt end-to-end encrypted WA (WhatsApp) communications is terrifying. The fact that Google has known this for over 5 year

159-169, about Google being able to decrypt end-to-end encrypted WA (WhatsApp) communications is terrifying. The fact that Google has known this for over 5 years and made no effort to notify the public is what really got me. What's fucked up is that Google Drive backups are the only ones WA offers, and naturally everyone wants their messages backed up so they turn it on, not knowing the implications.

ikiris 5y ago
WA?
- deleted 5y ago
  [deleted]
- djrockstar1 5y ago
  WhatsApp. My bad on that one - edited it.
throwawaysea 5y ago
I think WhatsApp addressed this recently. It was an issue with both iOS and Android, where chat backups were not end to end encrypted. I think this was an absolutely absurd gap that betrayed customer trust, but it isn’t clear to me if Facebook is more at fault than Google and Apple or if it is the other way. WhatsApp blog post on encrypted backups: https://about.fb.com/news/2021/10/end-to-end-encrypted-backups-on-whatsapp/ https://about.fb.com/news/2021/10/end-to-end-encrypted-backu...
zahllos 5y ago
Slight nitpick I know but decrypt here is the not quite the right word. The communications are still encrypted in flight but they are necessarily decrypted (by WhatsApp) on the end (your device). This unencrypted file is then provided to drive if you select back up with Google drive in WhatsApp. I'm in two minds about this one. I'm not really a fan of Google but realistically we're talking about backing up messages from a Facebook app. It is also possible to opt out and I know non technical people who have done so on the basis they don't want "more Google".
- Springtime 5y ago
  > This unencrypted file is then provided to drive if you select back up with Google drive in WhatsApp. And in terms of the grandparent's point about the public not being notified for 5 years, perhaps not by Google is accurate, though it was raised by Telegram's founder in response to Snowden's recommendation of WA back in 2016 [1] and covered elsewhere [2]. Snowden was rather dismissive of the relevant point about this, which always puzzled me. [1] https://twitter.com/durov/status/778618631060066304 https://twitter.com/durov/status/778618631060066304 [2] https://web.archive.org/web/20170729003715/https://www.makeuseof.com/tag/4-security-threats-whatsapp-users-need-know/ https://web.archive.org/web/20170729003715/https://www.makeu...
- matheusmoreira 5y ago
  > This unencrypted file is then provided to drive if you select back up with Google drive in WhatsApp. Why can't they just encrypt the data?! It makes no sense. I manually back up my messages because of this. After some time WhatsApp will start nagging me to enable cloud backups. I suppose this fits into the "annoy users until they give up their privacy" theme in the litigation document.
  - lozenge 5y ago
    Encrypt it with what key? WhatsApp doesn't have passwords, it's fully based on phone number verification. Do you want WhatsApp to hold the key for you? Or prompt you to create a key which they won't be able to recover?
    - matheusmoreira 5y ago
      > Or prompt you to create a key which they won't be able to recover? Yes. I have a YubiKey I could use for this.
bawolff 5y ago
Google clearly should have communicated this better, but also not exactly shocking. How would you make a backup end-to-end encrypted without asking for a passphrase or relying on on device storage? I don't think its technically possible. Maybe google could have tied it to your login credentials, but then no more password resets.
oezi 5y ago
And what are the implications? Is Google analyzing uploads to Google Drive to serve you targeted ads? That would be a big breach in trust.
- matheusmoreira 5y ago
  > Is Google analyzing uploads to Google Drive to serve you targeted ads? Is there any reason to believe they're not doing that? It's already a known fact that they scan files for malware and other illegal files such as CSAM. WhatsApp backup contents are a gold mine of personal information.
  - jvolkman 5y ago
    Well, they explicitly say so in their privacy policy. > We don’t show you personalized ads based on your content from Drive, Gmail, or Photos.
    - teflodollar 5y ago
      Yes, but that wording carefully evades explicitly saying they don’t scan content in the service of ads. For example they still could use your drive content to enrich how they target to other people who have similar profiles.
- RNCTX 5y ago
  > and what are the implications? Remember when Google was working on the DoD’s autonomous murder drone project? Isn’t WA the predominant means of text communication for people who travel abroad regularly?
  - Jensson 5y ago
    > Remember when Google was working on the DoD’s autonomous murder drone project? They did just a demo, Amazon and Microsoft are the biggest contractors in that space. News media loves to shit on Google in these scenarios but most of it is just Google trying to take a pie of markets others are already in. So all these articles just amounts to Google becoming as evil as the other tech giants. For example, we know Microsoft takes on these DoD AI projects. Maybe the VSCode telemetry is used to help them make murder drones? We also know Microsoft collaborates with CCP to operate its bing search in China. Maybe they hand over the VSCode telemetry to CCP? People don't ask those questions about Microsoft, so why ask them about Google?

ikiris 5y ago

WA?

deleted 5y ago
[deleted]
djrockstar1 5y ago
WhatsApp. My bad on that one - edited it.

throwawaysea 5y ago

I think WhatsApp addressed this recently. It was an issue with both iOS and Android, where chat backups were not end to end encrypted. I think this was an absolutely absurd gap that betrayed customer trust, but it isn’t clear to me if Facebook is more at fault than Google and Apple or if it is the other way. WhatsApp blog post on encrypted backups: https://about.fb.com/news/2021/10/end-to-end-encrypted-backups-on-whatsapp/ https://about.fb.com/news/2021/10/end-to-end-encrypted-backu...

zahllos 5y ago

Slight nitpick I know but decrypt here is the not quite the right word. The communications are still encrypted in flight but they are necessarily decrypted (by WhatsApp) on the end (your device). This unencrypted file is then provided to drive if you select back up with Google drive in WhatsApp. I'm in two minds about this one. I'm not really a fan of Google but realistically we're talking about backing up messages from a Facebook app. It is also possible to opt out and I know non technical people who have done so on the basis they don't want "more Google".

Springtime 5y ago
> This unencrypted file is then provided to drive if you select back up with Google drive in WhatsApp. And in terms of the grandparent's point about the public not being notified for 5 years, perhaps not by Google is accurate, though it was raised by Telegram's founder in response to Snowden's recommendation of WA back in 2016 [1] and covered elsewhere [2]. Snowden was rather dismissive of the relevant point about this, which always puzzled me. [1] https://twitter.com/durov/status/778618631060066304 https://twitter.com/durov/status/778618631060066304 [2] https://web.archive.org/web/20170729003715/https://www.makeuseof.com/tag/4-security-threats-whatsapp-users-need-know/ https://web.archive.org/web/20170729003715/https://www.makeu...
matheusmoreira 5y ago
> This unencrypted file is then provided to drive if you select back up with Google drive in WhatsApp. Why can't they just encrypt the data?! It makes no sense. I manually back up my messages because of this. After some time WhatsApp will start nagging me to enable cloud backups. I suppose this fits into the "annoy users until they give up their privacy" theme in the litigation document.
- lozenge 5y ago
  Encrypt it with what key? WhatsApp doesn't have passwords, it's fully based on phone number verification. Do you want WhatsApp to hold the key for you? Or prompt you to create a key which they won't be able to recover?
  - matheusmoreira 5y ago
    > Or prompt you to create a key which they won't be able to recover? Yes. I have a YubiKey I could use for this.

bawolff 5y ago

Google clearly should have communicated this better, but also not exactly shocking. How would you make a backup end-to-end encrypted without asking for a passphrase or relying on on device storage? I don't think its technically possible. Maybe google could have tied it to your login credentials, but then no more password resets.

oezi 5y ago

And what are the implications? Is Google analyzing uploads to Google Drive to serve you targeted ads? That would be a big breach in trust.

matheusmoreira 5y ago
> Is Google analyzing uploads to Google Drive to serve you targeted ads? Is there any reason to believe they're not doing that? It's already a known fact that they scan files for malware and other illegal files such as CSAM. WhatsApp backup contents are a gold mine of personal information.
- jvolkman 5y ago
  Well, they explicitly say so in their privacy policy. > We don’t show you personalized ads based on your content from Drive, Gmail, or Photos.
  - teflodollar 5y ago
    Yes, but that wording carefully evades explicitly saying they don’t scan content in the service of ads. For example they still could use your drive content to enrich how they target to other people who have similar profiles.
RNCTX 5y ago
> and what are the implications? Remember when Google was working on the DoD’s autonomous murder drone project? Isn’t WA the predominant means of text communication for people who travel abroad regularly?
- Jensson 5y ago
  > Remember when Google was working on the DoD’s autonomous murder drone project? They did just a demo, Amazon and Microsoft are the biggest contractors in that space. News media loves to shit on Google in these scenarios but most of it is just Google trying to take a pie of markets others are already in. So all these articles just amounts to Google becoming as evil as the other tech giants. For example, we know Microsoft takes on these DoD AI projects. Maybe the VSCode telemetry is used to help them make murder drones? We also know Microsoft collaborates with CCP to operate its bing search in China. Maybe they hand over the VSCode telemetry to CCP? People don't ask those questions about Microsoft, so why ask them about Google?