4 ms·

Whatsapp FAQ: WhatsApp's end-to-end encryption is used when you chat with another person using WhatsApp Messenger. End-to-end encryption ensures only you and t

by Maro 4y ago

Whatsapp FAQ: WhatsApp's end-to-end encryption is used when you chat with another person using WhatsApp Messenger. End-to-end encryption ensures only you and the person you're communicating with can read or listen to what is sent, and nobody in between, not even WhatsApp. This is because with end-to-end encryption, your messages are secured with a lock, and only the recipient and you have the special key needed to unlock and read them. All of this happens automatically: no need to turn on any special settings to secure your messages. https://faq.whatsapp.com/791574747982248 https://faq.whatsapp.com/791574747982248

spinningslate 4y ago
> only you and the person you're communicating with can read or listen to what is sent, and nobody in between, not even WhatsApp I guess the key lies in "what is sent" in the above statement. The casual reader might reasonably interpret as "no-one except the intended recipient can see _what I type_". But it doesn't say that. It only covers what gets _sent_. It doesn't say anything about what happens to the content outside specifically _sending_ it to the other party(ies).
- beardyw 4y ago
  Maybe Meta are not as trustworthy as I imagined.
  - endofreach 4y ago
    Stop calling them Meta. It‘s Facebook.
    - snapcaster 4y ago
      don't die on this hill, it's all arbitrary and won't make a difference
    - dwater 4y ago
      Comcast rebranded as Xfinity because they knew everyone hated Comcast. Now everyone also hates Xfinity. It's fine.
- andrewinardeer 4y ago
  So lying by ommission?
- InsomniacL 4y ago
  Even if that interpretation was correct in a broader sense, which I don't believe it is, certainly in this context of e2ee it isn't correct. The more obvious explanation is that before or after the e2ee (i.e within the app itself), an algorithm scans the content, categorizes it and sends this to Meta/Facebook. In this scenario, *Nobody* has read the content other than the person you're communicating with.
  - Melatonic 4y ago
    The local app running on your phone might even legally by considered "you" since it is running on your device under your user agent. I realize that is a bit of a nefarious take but I could see that being the case.....
InsomniacL 4y ago
> End-to-end encryption ensures only you and the person you're communicating with can read or listen to what is sent, and nobody in between, not even WhatsApp. This does not exclude an algorithm running running on the sender/recipient's App from scanning the content and sending suggestions to AD servers.
- Mordisquitos 4y ago
  I thought that too, but if that is the case then it should be relatively easy to find this hidden functionality by decompiling the APK and exploring it.
leobg 4y ago
Can I not train a text classifier on encrypted text? Basically, let the AI figure out what ads get clicked the most for a given string of encrypted 24h window of chat history. Eventually, the AI is going to hit on its “Rosetta Stone”, even without ever formally decrypting the text, much less any human reading it. With millions of conversations happening on WhatsApp, why shouldn’t that be possible? And it’s not even a breach, technically, because nothing ever got decrypted, and the similarity vector generated by the AI have, per se, nothing to do with the content of the conversation or the individual that sent them. Run the same training algorithm again and they’d look completely different! Hence they can’t possibly be “personal data” in the sense of the law.
- MAGZine 4y ago
  No. Encryption means the data is scrambled. Essentially unrecognizable from noise, save perhaps for some headers. If you can discern meaning from noise, then your theory would work. But discerning meaning from random noise is obviously impossible (i.e. what if there is no meaning?). If you leak information than you say, then the encryption is worthless. Harmful, even, because you think you have protection when you do not.
- cumshitpiss 4y ago
- mminer237 4y ago
  It doesn't matter how many conversations are going. With private key encryption, what a phrase encrypts to for one person would be different than the next. It would have to be trained solely on your conversation. Encryption is also dependent on all the text before it as well as text in the same block, so it would have to be the beginning of the message with no metadata to throw off alignment saying the 16-byte phrase so many times that it could pick up a difference. I'm pretty confident it's impossible to get anything useful out of that.
- roywiggins 4y ago
  If any algorithm can get even one bit of data about the plaintext then the encryption is broken by definition.
donedealomg 4y ago

by Maro 4y ago

spinningslate 4y ago

> only you and the person you're communicating with can read or listen to what is sent, and nobody in between, not even WhatsApp I guess the key lies in "what is sent" in the above statement. The casual reader might reasonably interpret as "no-one except the intended recipient can see _what I type_". But it doesn't say that. It only covers what gets _sent_. It doesn't say anything about what happens to the content outside specifically _sending_ it to the other party(ies).

beardyw 4y ago
Maybe Meta are not as trustworthy as I imagined.
- endofreach 4y ago
  Stop calling them Meta. It‘s Facebook.
  - snapcaster 4y ago
    don't die on this hill, it's all arbitrary and won't make a difference
  - dwater 4y ago
    Comcast rebranded as Xfinity because they knew everyone hated Comcast. Now everyone also hates Xfinity. It's fine.
andrewinardeer 4y ago
So lying by ommission?
InsomniacL 4y ago
Even if that interpretation was correct in a broader sense, which I don't believe it is, certainly in this context of e2ee it isn't correct. The more obvious explanation is that before or after the e2ee (i.e within the app itself), an algorithm scans the content, categorizes it and sends this to Meta/Facebook. In this scenario, *Nobody* has read the content other than the person you're communicating with.
- Melatonic 4y ago
  The local app running on your phone might even legally by considered "you" since it is running on your device under your user agent. I realize that is a bit of a nefarious take but I could see that being the case.....

InsomniacL 4y ago

> End-to-end encryption ensures only you and the person you're communicating with can read or listen to what is sent, and nobody in between, not even WhatsApp. This does not exclude an algorithm running running on the sender/recipient's App from scanning the content and sending suggestions to AD servers.

Mordisquitos 4y ago
I thought that too, but if that is the case then it should be relatively easy to find this hidden functionality by decompiling the APK and exploring it.

leobg 4y ago

Can I not train a text classifier on encrypted text? Basically, let the AI figure out what ads get clicked the most for a given string of encrypted 24h window of chat history. Eventually, the AI is going to hit on its “Rosetta Stone”, even without ever formally decrypting the text, much less any human reading it. With millions of conversations happening on WhatsApp, why shouldn’t that be possible? And it’s not even a breach, technically, because nothing ever got decrypted, and the similarity vector generated by the AI have, per se, nothing to do with the content of the conversation or the individual that sent them. Run the same training algorithm again and they’d look completely different! Hence they can’t possibly be “personal data” in the sense of the law.

MAGZine 4y ago
No. Encryption means the data is scrambled. Essentially unrecognizable from noise, save perhaps for some headers. If you can discern meaning from noise, then your theory would work. But discerning meaning from random noise is obviously impossible (i.e. what if there is no meaning?). If you leak information than you say, then the encryption is worthless. Harmful, even, because you think you have protection when you do not.
cumshitpiss 4y ago
mminer237 4y ago
It doesn't matter how many conversations are going. With private key encryption, what a phrase encrypts to for one person would be different than the next. It would have to be trained solely on your conversation. Encryption is also dependent on all the text before it as well as text in the same block, so it would have to be the beginning of the message with no metadata to throw off alignment saying the 16-byte phrase so many times that it could pick up a difference. I'm pretty confident it's impossible to get anything useful out of that.
roywiggins 4y ago
If any algorithm can get even one bit of data about the plaintext then the encryption is broken by definition.

donedealomg 4y ago