8 ms·

If you read around their points, it sounds like they track general location, log group messages, and provide specific information on request to a government.

by Saris 1y ago

changoplatanero 1y ago
I think group messages would still be considered personal. It would only be messages you send to a business or in a group with a business that wouldn't be personal.
- cess11 1y ago
  They're under the CLOUD Act, doesn't matter what their policies say.
  - orthecreedence 1y ago
    PRISM too.
  - chgs 1y ago
    Aren’t groups end-end encrypted still, with key exchange on joining groups?
    - femto 1y ago
      Does the WhatsApp program generate and store/mange the private keys? If so, it would be possible for the program to send private keys on request, effectively backdooring the endpoint. Such an arrangement would allow Meta to put its hand on it heart and truthfully say it is end-to-end encrypted (on the network), whilst still providing a way around it.
      - lxgr 1y ago
        Yes, but users can compare fingerprints (sure, most probably don't, but it's definitely a deterrence against MITMing all conversations by default), receive warnings whenever fingerprints change etc. There's also supposedly a key transparency service deployed (similar to Certificate Transparency), but I haven't looked into that in detail.
        BenjiWiebe 1y ago
        Sharing private keys gets around all that.
        lxgr 1y ago
        That would require explicit code to do so, which would probably be extremely hard to explain away.
        gkbrk 1y ago
        Are people publicly archiving, reverse engineering, and auditing every single version of Whatsapp? Would you even know if you got a special copy of Whatsapp (still signed by Meta and valid) that has this explicit code?
        lxgr 1y ago
        > Are people publicly archiving, reverse engineering, and auditing every single version of Whatsapp? Absolutely for archiving: https://androidapks.com/whatsapp-messenger/com-whatsapp/old/ https://androidapks.com/whatsapp-messenger/com-whatsapp/old/ Reverse engineering to some extent as well – it's an extremely popular app, and as such attracts both security researchers and bloggers that just want to get scoops on new features behind feature flags etc. > Would you even know if you got a special copy of Whatsapp (still signed by Meta and valid) that has this explicit code? Given the above, it's feasible – at least on Android, it's fairly easy to hash the .apk you've received and compare it to publicly know versions. The threat of somebody finding unusual code on their phone will probably not deter targeted deploys by sophisticated/state level actors to specific users, but it goes some way towards making it implausible that everybody is running a backdoored version, potentially backdoored by Meta themselves, which is arguably the goal.
        megous 1y ago
        Yeah. Go review eg. okta verify apk and tell me it doesn't do anything nefarious. It's an app that basically just does a TOTP hash from some short secret for all I care/use it for. I can probably implement what it does for me in about 200-300 lines of C code without any dependencies. The shit app has 60 MiB compressed. I was not even able to find where in the code it works with the damn secrets it uses for TOTP. Now do WhatsApp with its zillion features. If you mean that it's hard to explain away for the devs themselves, then people do much worse things in this world, and are able explain it to themselves just fine as something good, even.
mgraczyk 1y ago
And they are legally required to do this in most places
- luis8 1y ago
  I don't know why you are being downvoted. https://transparency.meta.com/reports/government-data-requests/country/US/ https://transparency.meta.com/reports/government-data-reques... They can't see your messages but then can give ips or accounts that can be inferred to be related given the info meta has access to
  - selcuka 1y ago
    Also take the "can't see your messages" statement with a grain of salt. Like the famous Lotus Notes backdoor [1] they might have given the government an easy(ier) way to decrypt those messages. The backdoor in Lotus Notes (differential cryptography) wasn't a secret. It was public information. Ray Ozzie used it as a way to circumvent US encryption export laws. Today companies have to be more discrete. [1] http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html
bboygravity 1y ago
"'specific information request to government" == fully automated requests for literally everything all the time.
perihelions 1y ago
Meta can also just lie about it. If they were secretly granting backdoor root access to some NSA spooks, like Microsoft did with PRISM or AT&T did with 641A, most likely no one would find out, so, there'd be zero actual downside to simply lying.
- wordofx 1y ago
  Meta does lie. They lie about e2e.
- EGreg 1y ago
  They usually just do a mea culpa: Camera: https://www.bitdefender.com/en-us/blog/hotforsecurity/facebook-app-for-ios-caught-accessing-camera-in-background https://www.bitdefender.com/en-us/blog/hotforsecurity/facebo... Audio: https://news.ycombinator.com/item?id=41424016 https://news.ycombinator.com/item?id=41424016 Conversations: https://www.vice.com/en/article/facebook-said-it-wasnt-listening-to-your-conversations-it-was/ https://www.vice.com/en/article/facebook-said-it-wasnt-liste... Mass surveillance: https://thehill.com/video/facebook-spying-on-users-new-report-details-social-networks-mass-surveillance/9305488/ https://thehill.com/video/facebook-spying-on-users-new-repor... Across the web: https://www.wired.com/story/ways-facebook-tracks-you-limit-it/ https://www.wired.com/story/ways-facebook-tracks-you-limit-i... Beacon: https://www.wired.com/2007/12/facebook-ceo-apologizes-lets-users-turn-off-beacon/ https://www.wired.com/2007/12/facebook-ceo-apologizes-lets-u... Apps: https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election https://www.theguardian.com/news/2018/mar/17/cambridge-analy... People who aren't even on facebook: https://www.vox.com/2018/4/20/17254312/facebook-shadow-profiles-data-collection-non-users-mark-zuckerberg https://www.vox.com/2018/4/20/17254312/facebook-shadow-profi... Others do it too, e.g. Amazon: https://www.bloomberg.com/news/articles/2019-04-10/is-anyone-listening-to-you-on-alexa-a-global-team-reviews-audio?embedded-checkout=true https://www.bloomberg.com/news/articles/2019-04-10/is-anyone... But Facebook has always been on a whole other level https://www.theguardian.com/technology/2018/apr/17/facebook-people-first-ever-mark-zuckerberg-harvard https://www.theguardian.com/technology/2018/apr/17/facebook-...
  - bdangubic 1y ago
gnarlouse 1y ago
Yep. Learning to read legal is an invaluable modern skill.
1oooqooq 1y ago
it's well know they track group messages and messages (metadata), messages to business accounts (these they can read in full as the client send to a meta owned private key), and who forwards media to who (deduplication and cdn) and links (thanks to previews) and it scans and uploads your contact list in full all the time.
sudahtigabulan 1y ago
De Morgan's transformations come in handy here :^)
bawolff 1y ago
I mean, i would be pretty shocked if meta refused to honour american search warrants/NSL. The real question is where they draw the line, not if they do it ever.
- NoOn3 1y ago
  Unfortunately, They has no lines.
lotharcable 1y ago
Meta works by identifying users, modelling their behavior, and then combining that data with third party sources (typically your financial activities) and then selling access to that data to third parties. Mostly for advertising. When you use credit or debit cards your transactions and data related to it is collected and sold. When you apply for mortgages and close on a house all that information you put in there is collected and sold. When you put your address in for the post office, when you apply for a drivers or fishing license... Your local governments collect that information and sell access to it. Meta tries to then tie in your online and app/phone activity with your legal/financial identity it can obtain through partner data brokers. This is Facebook's businesses model. So, yes, this data is available to pretty much anybody that is willing to pay for it. Which includes governments. None of this should be surprising to anybody at this point. Apple, Google, Microsoft, etc.. all of these companies will do this to greater or lesser extents nowadays since has worked out so well for Meta's bottom line.

If you read around their points, it sounds like they track general location, log group messages, and provide specific information on request to a government.

by Saris 1y ago

If you read around their points, it sounds like they track general location, log group messages, and provide specific information on request to a government.

changoplatanero 1y ago

I think group messages would still be considered personal. It would only be messages you send to a business or in a group with a business that wouldn't be personal.

cess11 1y ago
They're under the CLOUD Act, doesn't matter what their policies say.
- orthecreedence 1y ago
  PRISM too.
- chgs 1y ago
  Aren’t groups end-end encrypted still, with key exchange on joining groups?
  - femto 1y ago
    Does the WhatsApp program generate and store/mange the private keys? If so, it would be possible for the program to send private keys on request, effectively backdooring the endpoint. Such an arrangement would allow Meta to put its hand on it heart and truthfully say it is end-to-end encrypted (on the network), whilst still providing a way around it.
    - lxgr 1y ago
      Yes, but users can compare fingerprints (sure, most probably don't, but it's definitely a deterrence against MITMing all conversations by default), receive warnings whenever fingerprints change etc. There's also supposedly a key transparency service deployed (similar to Certificate Transparency), but I haven't looked into that in detail.
      - BenjiWiebe 1y ago
        Sharing private keys gets around all that.
        lxgr 1y ago
        That would require explicit code to do so, which would probably be extremely hard to explain away.
        gkbrk 1y ago
        Are people publicly archiving, reverse engineering, and auditing every single version of Whatsapp? Would you even know if you got a special copy of Whatsapp (still signed by Meta and valid) that has this explicit code?
        lxgr 1y ago
        > Are people publicly archiving, reverse engineering, and auditing every single version of Whatsapp? Absolutely for archiving: https://androidapks.com/whatsapp-messenger/com-whatsapp/old/ https://androidapks.com/whatsapp-messenger/com-whatsapp/old/ Reverse engineering to some extent as well – it's an extremely popular app, and as such attracts both security researchers and bloggers that just want to get scoops on new features behind feature flags etc. > Would you even know if you got a special copy of Whatsapp (still signed by Meta and valid) that has this explicit code? Given the above, it's feasible – at least on Android, it's fairly easy to hash the .apk you've received and compare it to publicly know versions. The threat of somebody finding unusual code on their phone will probably not deter targeted deploys by sophisticated/state level actors to specific users, but it goes some way towards making it implausible that everybody is running a backdoored version, potentially backdoored by Meta themselves, which is arguably the goal.
        megous 1y ago
        Yeah. Go review eg. okta verify apk and tell me it doesn't do anything nefarious. It's an app that basically just does a TOTP hash from some short secret for all I care/use it for. I can probably implement what it does for me in about 200-300 lines of C code without any dependencies. The shit app has 60 MiB compressed. I was not even able to find where in the code it works with the damn secrets it uses for TOTP. Now do WhatsApp with its zillion features. If you mean that it's hard to explain away for the devs themselves, then people do much worse things in this world, and are able explain it to themselves just fine as something good, even.

mgraczyk 1y ago

And they are legally required to do this in most places

luis8 1y ago
I don't know why you are being downvoted. https://transparency.meta.com/reports/government-data-requests/country/US/ https://transparency.meta.com/reports/government-data-reques... They can't see your messages but then can give ips or accounts that can be inferred to be related given the info meta has access to
- selcuka 1y ago
  Also take the "can't see your messages" statement with a grain of salt. Like the famous Lotus Notes backdoor [1] they might have given the government an easy(ier) way to decrypt those messages. The backdoor in Lotus Notes (differential cryptography) wasn't a secret. It was public information. Ray Ozzie used it as a way to circumvent US encryption export laws. Today companies have to be more discrete. [1] http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html

bboygravity 1y ago

"'specific information request to government" == fully automated requests for literally everything all the time.

perihelions 1y ago

Meta can also just lie about it. If they were secretly granting backdoor root access to some NSA spooks, like Microsoft did with PRISM or AT&T did with 641A, most likely no one would find out, so, there'd be zero actual downside to simply lying.

wordofx 1y ago
Meta does lie. They lie about e2e.
EGreg 1y ago
They usually just do a mea culpa: Camera: https://www.bitdefender.com/en-us/blog/hotforsecurity/facebook-app-for-ios-caught-accessing-camera-in-background https://www.bitdefender.com/en-us/blog/hotforsecurity/facebo... Audio: https://news.ycombinator.com/item?id=41424016 https://news.ycombinator.com/item?id=41424016 Conversations: https://www.vice.com/en/article/facebook-said-it-wasnt-listening-to-your-conversations-it-was/ https://www.vice.com/en/article/facebook-said-it-wasnt-liste... Mass surveillance: https://thehill.com/video/facebook-spying-on-users-new-report-details-social-networks-mass-surveillance/9305488/ https://thehill.com/video/facebook-spying-on-users-new-repor... Across the web: https://www.wired.com/story/ways-facebook-tracks-you-limit-it/ https://www.wired.com/story/ways-facebook-tracks-you-limit-i... Beacon: https://www.wired.com/2007/12/facebook-ceo-apologizes-lets-users-turn-off-beacon/ https://www.wired.com/2007/12/facebook-ceo-apologizes-lets-u... Apps: https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election https://www.theguardian.com/news/2018/mar/17/cambridge-analy... People who aren't even on facebook: https://www.vox.com/2018/4/20/17254312/facebook-shadow-profiles-data-collection-non-users-mark-zuckerberg https://www.vox.com/2018/4/20/17254312/facebook-shadow-profi... Others do it too, e.g. Amazon: https://www.bloomberg.com/news/articles/2019-04-10/is-anyone-listening-to-you-on-alexa-a-global-team-reviews-audio?embedded-checkout=true https://www.bloomberg.com/news/articles/2019-04-10/is-anyone... But Facebook has always been on a whole other level https://www.theguardian.com/technology/2018/apr/17/facebook-people-first-ever-mark-zuckerberg-harvard https://www.theguardian.com/technology/2018/apr/17/facebook-...
- bdangubic 1y ago

gnarlouse 1y ago

Yep. Learning to read legal is an invaluable modern skill.

1oooqooq 1y ago

it's well know they track group messages and messages (metadata), messages to business accounts (these they can read in full as the client send to a meta owned private key), and who forwards media to who (deduplication and cdn) and links (thanks to previews) and it scans and uploads your contact list in full all the time.

sudahtigabulan 1y ago

De Morgan's transformations come in handy here :^)

bawolff 1y ago

I mean, i would be pretty shocked if meta refused to honour american search warrants/NSL. The real question is where they draw the line, not if they do it ever.

NoOn3 1y ago
Unfortunately, They has no lines.

lotharcable 1y ago

Meta works by identifying users, modelling their behavior, and then combining that data with third party sources (typically your financial activities) and then selling access to that data to third parties. Mostly for advertising. When you use credit or debit cards your transactions and data related to it is collected and sold. When you apply for mortgages and close on a house all that information you put in there is collected and sold. When you put your address in for the post office, when you apply for a drivers or fishing license... Your local governments collect that information and sell access to it. Meta tries to then tie in your online and app/phone activity with your legal/financial identity it can obtain through partner data brokers. This is Facebook's businesses model. So, yes, this data is available to pretty much anybody that is willing to pay for it. Which includes governments. None of this should be surprising to anybody at this point. Apple, Google, Microsoft, etc.. all of these companies will do this to greater or lesser extents nowadays since has worked out so well for Meta's bottom line.