15 ms·
WhatsApp would not remove end-to-end encryption for UK law, says chief
- rany_ 4y agoI can't believe Meta is fighting the good fight for once.
- jacooper 4y agoThey have been on the side of encryption since the beginning really. I think had WhatsApp not added E2EE in 2014, Encryption wouldn't be that wide spread today.
- mr_mitm 4y agoWasn't that right before WhatsApp was bought though? From what I remember they made an effort to implement E2EE before Facebook had any say in it.
- bryan_w 4y agoNope, it was implemented after purchase. It's been (optional) in messenger too for almost as long.
- RandallBrown 4y agoFacebook Messenger has had (opt in) E2EE since 2017 I believe.
- haskaalo 4y agoThey're starting to enable it by default recently
- eikenberry 4y ago2014 was also the year Let's Encrypt was founded.
- jacooper 4y agoTruly game changing.
- hackernewds 4y agoCurious how it benefits Meta
- baby 4y agoThey’ve been fighting it since adding e2e encryption to their products, but people don’t know that
- saurik 4y agoThey partly don't know that because Signal likes to throw WhatsApp under the bus any chance they get, rather than treating them as an ally; I wish Signal would redirect their efforts to choosing new targets, whether in their current app or in a new different product, taking on the ilk of Snapchat/Telegram or even Discord.
- baby 4y agoWhere did Signal do that? Moxie was contracted by fb back then to help implement the signal protocol so I’m not sware of them dunking on whatsapp
- saurik 4y agoYou must not be paying much attention, then? ;P / :( https://www.forbes.com/sites/enriquedans/2021/05/07/how-signal-cleverly-exposed-facebooks-disregard-forprivacy/?sh=5af750364172 https://www.forbes.com/sites/enriquedans/2021/05/07/how-sign... > Signal’s idea was to get users to abandon WhatsApp and switch to Signal, an instant messaging service run by a non-profit foundation, which has proven its commitment to protecting the privacy of its users and that is seeing significant take up, especially after the latest changes to WhatsApp’s privacy policies. This whole ordeal was doubly-dishonest, as not only were they running ads against one product line (Instagram) with the specific goal of getting people to switch away from a different one (WhatsApp), but the entire thing was just FUD designed to attack Facebook for going out of their way to build something that actually did honor end-to-end encrypted goals: companies wanted to be able to do Facebook Messenger -like company-to-user chat stuff, and so Facebook wanted to provide a way--specifically for companies--to use a portal to access a "hosted" WhatsApp client. But like, that would mean that Facebook would, for just these specific chats with business accounts, potentially (if the company was using this service) be able to read those messages, so they had to adjust their privacy policy. In some cases, this didn't even involve removing text, but was just a matter of moving some text... but Signal didn't care much about accuracy: they were stoking the flames every way they could and in the process frankly harmed their own mission because a ton of people ended up going in the exact opposite direction, moving to apps like Telegram. Here is a comment I had left at the time of this specific particularly-big incident going down, which has then a link to another comment I'd left with more detail on this (as my memory is fading on this stuff) including quotes from both Facebook representatives and their documentation. https://news.ycombinator.com/item?id=26801760 https://news.ycombinator.com/item?id=26801760 Signal is a non-profit whose mission should be to get people to move to encrypted technologies whether or not that decision involves Signal and they should be trying to work with Facebook on the narrative surrounding WhatsApp, not throwing them under the bus any chance they have to get some publicity for Signal. Here's the real question: have you ever seen them publicly go after Snapchat, or Telegram? As far as I can tell--not just from memory, but from doing some searches on the topic--the answer seems to be "no": they go after WhatsApp, because that product is the closest to being a direct competitor to Signal. (That said, I also want to be clear: the actual part where Facebook didn't allow them to run the ads and the feud there is also not good... but not only are the morals there a bit more murky, it makes both sides look shitty to be sitting around in some epic fight over their market, and all the meanwhile the benefactors were the apps other than Signal and WhatsApp, and Signal should be sticking to their mission and teaming up there to help clarify to prevent those kinds of losses.)
- upofadown 4y agoAs of something like 2015 they allowed you to add your PGP public key to your profile to get encrypted notification messages. They are pretty much encryption hipsters.
- tgv 4y agoThey're just defending their (enormous) market share. I don't expect they are doing it from the goodness of their heart.
- rany_ 4y agoI'm not that cynical. They could just drop E2EE from their product and call it a day. It wouldn't make much of a difference for them.
- mokash 4y agoi think to expect a multi-billion dollar organisation to make consequential decisions like this based on anything other than cold calculation is naive at best and enormously stupid at the very worst.
- m463 4y agoOn the other hand, it's not really end to end encrypted. They've inserted a sort of man-in-the-end bit so they can check your content in the app and send out information about the content out-of-band. I don't know if they do this for advertising purposes, but I know they do image recognition to detect for example, specific types of pornography.
- mariojv 4y ago“If the company refused to do, it could face fines of up to 4% of its parent company Meta’s annual turnover – unless it pulled out of the UK market entirely.” Wow. I wonder if it got to that point if Meta would change course and disable end to end encryption for UK users and people messaging UK users, if that would be sufficient to comply. If this lobbying causes the UK to change course, I wonder what impact that would have on other countries’ attempts to weaken encryption, if any other such attempts are happening.
- Kim_Bruning 4y agoThey say that 98% of users are outside the UK (and those users very likely won't want reduced encryption), so whatsapp would probably just exit the UK.
- brundolf 4y agoI know in some non-US countries, WhatsApp is the default way of communicating (like SMS is in the US). Is that true in the UK? That could put significant pressure on the government
- lewispollard 4y agoEveryone I know here (UK) uses WhatsApp as their default communication tool. I have a few friends using Signal or Telegram, but I'd say WhatsApp is by and large the default, at least for my social circle.
- 2Gkashmiri 4y agouh.... will this not push other countries to force whatsapp a la blackberry?
- omgomgomgomg 4y agoCall me sceptic, but does not whatsapp see what you are typing when you are creating messages? They need to log the keydown event somehow, right? And the predictive text spits out what it thinks you want to type. And backups are possible even if you never had one before. This is so very dodgy to me. Maybe its e2e from the moment you submit until it arrives at the desired destination. Which brings me to the next issue, they need to parse the text to display and when you quote a text, does it just blindly quote a blurb? I do not believe in conspiracies and such, but there are so many double speech possibilities here...
- josh2600 4y agoIf it ain't open-source, you can't trust it. Signal or GTFO.
- deejaaymac 4y agoI trust matrix over signal. signal has a shitcoin and the new ceo is sketch.
- seanw444 4y agoI trust XMPP over Matrix. Both for security and less bloat.
- skrowl 4y ago[dead]
- Smaug123 4y agoI believe you don't know the meaning of the term "end-to-end encryption". Obviously the application itself (and the phone) can see the text you put into it, because it has to display that text. "End-to-end encrypted" means "from the moment the text leaves the phone, to the moment the text arrives at the recipient's phone, the text is encrypted such that no intermediate party can read it". You must of course trust or verify that the WhatsApp app isn't leaking your text, that the keyboard you are using isn't leaking your text, that Android or iOS or whatever isn't leaking your text, that you yourself aren't somehow taking unencrypted backups and you aren't using whatever unencrypted-backup features WhatsApp might make available, etc.
- ridiculous_leke 4y agoWhat are the government's arguments against end-to-end encryption?
- eddsh1994 4y agoIt allows criminals to do bad things, common examples would be CP or terrorism.
- danbruc 4y agoWhich always makes me wonder, what is the extend of the child pornography problem? How big is the nail compared to the proposed hammer? If I had to guess, I would guess this is hammer affecting 80+ % of the population to go after a group constituting a fraction of a percent of the population.
- andrejguran 4y agoThat's a very good question: how to quantify child suffering to one of the worst crimes imaginable? I am not saying I am for or against. I am just trying to point how really difficult is to quantify both sides of the equation.
- spoiler 4y agoThis will do a grand total of nothing to reduce CP, though. It's probably not even going to be an inconvenience. They're already breaking the law and probably jumping through hoops to get access to it.
- andrejguran 4y agoI disagree that it will be nothing. It will be something larger than 0. First question is how to predict the impact. But more interestingly when we have the impact analysis how to quantify the suffering that will be reduced in comparison with reducing security and how to quantify even that and put these into comparison. (Again I am not on either side just pointing how hard it is to quantify these things)
- yosser 4y agoIsn't this a red herrring? I thought the law didn't require the removal of E2E encryption, but rather mandated the addition of a back door that submits some kind of meta data summary to a third party service?
- developer93 4y agoIs that better? The effect is the same.
- spoiler 4y agoI think they meant to say that this is just a PR stunt by saying they won't remove encryption (because they don't even need to to comply)
- 29083011397778 4y agoThat depends entirely upon who gets to define "End-to-end", and whether they are held to task for any inaccuracies in that definition
- FalconSensei 4y agois it truly E2E encryption if it has a backdoor?
- m463 4y agowhatsapp has that.
- rwaksmunski 4y agoDark patterns trick WhatsApp users to enable backups to Google and Apple. If you have them disabled odds are good the other side got tricked into them. Even if your backups are encrypted, it's using only a 64bit key. That means Five Eyes have near real-time access to your "encrypted" messages. Hell, I have to decline backups every time I use WhatsApp on my iPhone, yet after a phone reset all my messages were still there. They were gone in Signal for example. Is UK making a stink about it to lure bad people into a false sense of security? We all know why large US tech companies bought Skype (twice) back in the day. It's naive to think WhatsApp was bought for a different purpose.
- Quarrelsome 4y ago> It's naive to think WhatsApp was bought for a different purpose. Sorry, is it naive to think that Facebook bought WhatsApp for its userbase and technology?
- rwaksmunski 4y ago> Sorry, is it naive to think that Facebook bought WhatsApp for its userbase and technology? Well, no. Absolutely not. Until you notice the 20B pricetag. I'm not seeing 20B worth of ads on WhatsApp, are you?
- Quarrelsome 4y agoFrom my limited understanding of WhatsApp revenues were healthy prior to the buyout. I have seen some revenue estimates since the buyout that could justify the sale price, should they be accurate.
- robertlagrant 4y agoWho was paying them?
- martincmartin 4y agoWhatsApp stopped charging users, and doesn't run ads. It has no revenue.
- ciancimino 4y agoWell this is quite the turn of events...
- d33 4y agoIt's intriguing which battles they choose. It wasn't long since there was a discussion where some people were arguing that they can't make moral judgements because disobeying the law would put them in a very difficult situation: https://news.ycombinator.com/item?id=35028107& https://news.ycombinator.com/item?id=35028107&
- saddlerustle 4y agoThe consequence for not obliging with the online safety bill is pulling out from the UK market. The consequence for ignoring legally sound US court orders is Meta executives going to jail.
- Barrin92 4y agoalso as the Meta representative points out the UK is 2% of Whatsapp users. Honestly another reason why Brexit was a shot in their own foot. IF they'd gotten legislation like this through in the EU that'd be a much harder market to opt out of.
- wkat4242 4y agoAnd the EU is in fact pushing for the same insanity under the "Chat Control" proposals.
- nsenifty 4y agoThe above case was with FB messenger which is (was?) not e2e encrypted and since Meta already had the data they were obliged to comply with a court-issued warrant. With E2EE, they can legally skirt such demands since they can claim they don't have the data so that's a win for them as well.
- seanw444 4y agoE2EE on platforms like FB Messenger means absolutely nothing to me if their client apps are closed-source.
- egberts1 4y agoDoesn't matter for WhatsApp because a social cloud map is easily obtained without their engineers' help.
- skizm 4y agoIf E2EE in messaging becomes table stakes and Meta can find a way to inject ads subtly enough not to piss off users into quitting, Meta wins hard since they've been building their AI infra to "get around" Apple's tracking restrictions for a while now and there are reports that it is finally showing good results. They'll be able to dial in their ads way better than any competitors until they catch up in the AI department. https://www.ft.com/content/fc95a0f7-5e4e-4616-9b17-7b72daee6c60 https://www.ft.com/content/fc95a0f7-5e4e-4616-9b17-7b72daee6...
- jcarrano 4y agoThis could be very good for Meta, just get the government to never exercise the law on you and to do it instead on smaller competitors that may threaten you. Now everyone wanting to make a communications app (or anything implementing that functionality) is risking an expensive lawsuit on the UK. Meta too, but they have the bucks and influence to weather it.
- ttt3ts 4y agoJust block the UK and make everyone use a VPN this is already the case with age verification for adult content.
- tiernano 4y agoVPN wouldn't work. Whatsapp is tied to a mobile number so they would just blacklist all +44 numbers. No matter where you are, even if your an expat, it won't work....
- unxdfa 4y agoThis instantly puts me off WhatsApp from a reliability perspective. Your identity needs to be decoupled from something someone else controls.
- ttt3ts 4y agoI don't care what Meta does they are big enough to solve the issue. I was talking about smaller messaging apps that can't just refuse to comply.
- joseftexas 4y agoMeta has multiple server relay nodes in EU. Just shutfown the relay nodes in UK and geolocation block all incoming connections to EU servers coming from UK IP address. The phone number is just at user registration. Back-end they know. Heck, my whatsapp even route my voice call info (likely they transcribe and send to FB adverts processing via chatGPT-like solution) and flooded my FB with related ads derived from my voice call keywords.
- h10h10h10 4y ago[flagged]
- explodingcamera 4y agowhat does this have to do with the eu? The bad proposals I've seen have all been shut down, and instead good laws like gdpr and net neutrality have been enacted eu-wide.
- penguin_booze 4y agoI was wondering why can't chat apps be like email apps: i.e., let users point to a private key on their own phone, and publish their public key. Then, just like exchanging secure emails, people transparently chat using the same encrypt-decrypt mechanism? Won't this work?
- cassianoleal 4y agoThat's essentially what we had with Jabber/XMPP [0] and OTR [1]. Since the encryption happened client-side, it would also work across networks. There was a time when Google chat, Facebook Messenger and other high profile chat networks could all interconnect through it. [0] https://xmpp.org/ https://xmpp.org/ [1] https://wiki.xmpp.org/web/OTR https://wiki.xmpp.org/web/OTR Edit: typo
- CameronNemo 4y agoNow, years after shuttering their XMPP service, Google is complaining about Apple not following "messaging standards" (aka the piece of shit messaging protocol RCS). Shouldn't have worn that petard if you didn't want to be hoisted by it.
- thaumasiotes 4y ago> Shouldn't have worn that petard if you didn't want to be hoisted by it. A petard is a bomb, not a piece of clothing.
- prettyStandard 4y agoA reference to this community quote: > Britta: Shouldn't have worn that petard if you didn't want to be hoisted by it. > Jeff: ...What do you think the expression "hoisted by your own petard" is referencing? > Britta: I guess I just assumed that in the old days a petard was a special outfit like a leotard, with a lot of fancy buckles and loops on it, and that rich people would wear them when they were feeling especially smug, but then poor people would tie a rope through one of the loops, and hoist them up a pole and then let them dangle there as punishment for being cocky. > Jeff: Never look it up. Your explanation is way better. https://www.reddit.com/r/community/comments/7vs6ec/brittas_most_underrated_quote https://www.reddit.com/r/community/comments/7vs6ec/brittas_m... You seem to be referring to the more normal use of it https://en.m.wikipedia.org/wiki/Hoist_with_his_own_petard https://en.m.wikipedia.org/wiki/Hoist_with_his_own_petard
- acqbu 4y agoInstead of removing end-to-end encryption, there may be alternative solutions to address law enforcement concerns. For example, law enforcement agencies could work with WhatsApp to develop lawful access mechanisms that allow them to access messages in specific cases where they have a legitimate need to do so. These mechanisms could be subject to strict oversight and transparency to prevent abuse.
- pgalvin 4y agoIf the messages are end-to-end encrypted, there is no way to do this. A backdoor or other mechanism means it is no longer end-to-end - some third party is involved. Furthermore, the UK has a long history of such “strict oversight and transparency” hardly existing, when it comes to these matters, with numerous controversies with police and other agencies abusing their access to systems. It is worth noting, however, that WhatsApp messages can generally be accessed with such a backdoor anyway. The majority of users backup their messages to iCloud or Google Drive, encrypted, with WhatsApp holding the key. Consumer tools already exist that can access these encrypted backups, and fetch the key from WhatsApp with nothing but a text message. A warrant to Google/Apple for the backup is all that is needed, apart from the small % of users who have enabled the new E2EE backups.
- ranguna 4y agoMaybe it can still be called e2ee, but instead of having 2 ends you have 3. Much like on a group where everyone involved in a group chat has access to the messages. With UK law, all 1 on 1 chats would turn into group chats: 2 people + UK law enforcement. So it's not like everyone and your grandma will have access to your messages. It's you, the people you chat with and law enforcement. But regardless, I still think this is stupid because not even governments can be trusted with our privacy, much less law enforcement. Not to mention leaks.
- Havoc 4y agoRarely a fan...but I've got to say hell yeah FB! Not because FB as platform in particular but because I appreciate someone with weight telling the UK law makers that their insane ideas are insane. Just the fact that there is a different position suggests that there is a question to be answered and thought about. Get everyone stop and think.
- okamiueru 4y agoIs the E2EE used by WhatsApp actually E2E? Or is it the "encrypted between you and our servers, and our servers and your friend"? Anyone know?
- sureglymop 4y agoCan I ask.. how can I as a user verify that my messages are even being encrypted? Is the client open source? I am genuinely curious.
- irthomasthomas 4y agoBut they will let you have the keys
- hiurwbkjlfjo 4y ago[dead]