12 ms·
Ex-WhatsApp cybersecurity head says Meta endangered billions of users
- gnabgib 1y agoEdit: Oof good catch (bad day for Meta)
- mdhb 1y agoThis is unfortunately entirely seperate from that other article. FTA: > Attaullah Baig, who served as head of security for WhatsApp from 2021 to 2025, claims that approximately 1,500 engineers had unrestricted access to user data without proper oversight, potentially violating a US government order that imposed a $5bn penalty on the company in 2020.
- wordofx 1y agoSo much for that e2e encryption that HN claimed was so good and that META couldn’t possibly use what’s app messages to do advertising from.
- alaq 1y agoMessages are e2e and WA doesn't have access to them. We're talking about the metadata here. From the article: > including contact information, IP addresses and profile photos I can confirm this, I used to work at WhatsApp.
- wordofx 1y agoMeta/WA. Same thing. Might have worked at WhatsApp but FB still advertises based on conversation content.
- jonoc 1y agoNot sure this is correct - alaq said the messages are e2e, so not visible at all by anyone other that the participants of the conversation. The meta->data<- however IS visible by them and can and is likely to be used for advertising.
- another_twist 1y agoOf course the meta data is visible. Its probably more useful than the actual content of the conversation too. I mean from an ML perspective how would you even make features out of conversation that help with CTR ? That too without creeping the users out. I'd imagine its the same reason why meta doesnt (likely) listen in on mobile mics. Why go through the whole shebang of running always on transcription when simple features like who talked to who and at what times are more useful at establishing user similarities.
- jonoc 1y agoI'm not making a stance on things, just clarifying the previous comment
- roelschroeven 1y agoWe don't really know that messages really are end-to-end encrypted though, do we? Is there a way to actually check that the messages in transit are encrypted in a way that only the other end can decrypt them? If not, we have to take Meta's word for it, which frankly doesn't carry much weight.
- lioeters 1y agoHow can we call it "E2E encryption" in any meaningful sense of the term when the ends run proprietary code, and at least one of the ends has proven themselves unworthy of trust time and again.
- varenc 1y agoNot trivially. But with painstaking reverse engineering you could prove this. And people have, so you're not exclusively just taking Meta's word. The fact that Pegasus malware relied on remote code execution vuln to run malware on your phone to extract WhatsApp messages, really suggests that the E2EE works. If it wasn't E2EE, then the makers of Pegasus could have just intercepted traffic to get your messages. Academics have also reverse engineered it as well, and though there are some weakness it's not a lie that WhatsApp is E2EE. Here's some I just found: - https://eprint.iacr.org/2025/794.pdf https://eprint.iacr.org/2025/794.pdf - https://i.blackhat.com/USA-19/Wednesday/us-19-Zaikin-Reverse-Engineering-WhatsApp-Encryption-For-Chat-Manipulation-And-More.pdf https://i.blackhat.com/USA-19/Wednesday/us-19-Zaikin-Reverse...
- wordofx 1y agoThis does not prove that Meta does not have the ability to decrypt the messages.
- varenc 1y agoEh, well painstaking reverse engineering is like having the source code, just 10000x more work. With that I feel like it should be possible to ensure this, or at least with some high level of confidence.
- const_cast 1y ago> Messages are e2e and WA doesn't have access to them. We're talking about the metadata here. You're still just blindly trusting this is the case. You can't verify the encryption or any of the code. It would be trivial to actually encrypt the message and send it out and then store an unecrypted version locally and quietly exfiltrate it later. They have to already be storing an unecrypted version locally, because you can see the messages. So unless your analyzing packets on the scale of months or years, you cannot possibly know that it isn't being exfiltrate at some point. Take it a step further: put the extiltration behind a flag, and then when the NSA asks, turn on the flag for that person. Security researchers will never find it.
- tamimio 1y agoHN isn’t monolith, I personally never said WhatsApp is good, and I’m telling you from now avoid Signal too till they remove the phone number requirement AND you can deploy your own server.
- lordofgibbons 1y agoGiven how WhatsApp is the de-facto way to communicate outside of the West and China, these security/data-handling "weaknesses" are most likely a feature, not a bug. An absolute bonanza for the certain intelligence services. Remember, kids: End to end encryption is useless if the "ends" are fully controlled by an (untrustworthy) third party.
- crypto_throwa 1y agoWithout open source, end to end encryption is useless. It's not hard to hide a piece of code that defeats the encryption in closed source code.
- another_twist 1y agoCurious, is there a poc somewhere demonstrating an attack like this ?
- joaomacp 1y agoSure: plain_msg = decrypt(encrypted_msg) send_to_nsa(plain_msg)
- __spooky__ 1y agoiMessage is end to end encrypted. Although Apple says it secure and the courts and FBI seem to not be able to get it in, it is still closed source.
- rpdillon 1y agoJust don't back it up to iCloud!
- yamazakiwi 1y agoNot able to get into it legally or without consequence, it is not infallible.
- bigiain 1y ago
- mgh2 1y ago> A Meta spokesperson, Andy Stone, wrote on Threads, the company’s text-based social network: “Sadly this is a familiar playbook in which a former employee is dismissed for poor performance and then goes public with distorted claims that misrepresent the ongoing hard work of our team.” Skeletons keep piling up while PR try to dismiss them
- neilv 1y agoThat quote is brilliant. Corporate communications has playbook damage control responses, and this quote seems to be suggesting that the quoted response is one of them (it's "familiar"). Whether "former employees" are sketchily operating from playbooks, who knows. Because PR playbook-sounding statements don't have a lot of credibility.
- Nevermark 1y agoInnocent until proven guilty. Or the PR team undermines their own credibility with a stock and specious fact-free non-response. I think the point of these is to dodge the even guiltier look of “no comment”. And signal there won’t be any potentially costly cooperative engagement from their side to their shareholders. They don’t expect to be believed.
- princevegeta89 1y agoIt will be so foolish of anyone to think that WhatsApp is a truly e2e encrypted messaging platform.
- another_twist 1y agoWhy ? You think Meta removed the privacy layers or put backdoors in place ? I mean if that's the suspicion, maybe we should read the terms of service and see if they actually guarantee E2E encryption
- princevegeta89 1y agoEvery message we send via this service still most likely goes through it's bots that try to gather user context. I'm guessing there will be some tricky legal wording in their T&C that wouldn't rule them out from being an intermediate entity that can see messages.
- alex1138 1y agoThe way Zuckerberg tricked Acton and Koum is by itself enough for me not to trust Whatsapp. Even from a hypothetical "their encryption works but that's really scummy" perspective It was bought as a power play, consolidation of tech power. Why would I trust them to do the right thing?
- farceSpherule 1y ago[flagged]
- wizzwizz4 1y agoFacebook doesn't give me a straight answer, when I ask them questions about their policies, even when my questions aren't answered by their policies. The job of the privacy team within Facebook is not privacy: it's reducing liability.
- farceSpherule 1y agoYou obviously do not or have never worked there.
- inetknght 1y agoYou obviously do not or have never paid attention to news about Meta's many and repeated moral, ethical, and legal violations. That, or you have a vested interested in making sure that your stake in Meta does not depreciate in value.
- wizzwizz4 1y agoObviously not: if I had, I'd have inside contacts I could ask, instead of having to bother their public relations people to beg for scraps of intel about what they're doing with my information, while they act I don't believe they've lied to me – I'm not so uncharitable as to assume their incorrect "it's written in the policy!" claims were deliberate lies –, but they're certainly not forthcoming.
- ath3nd 1y ago[flagged]
- ipython 1y agoI’m sure WhatsApp’s recent “secure by design” media and ad blitz is totally unrelated to these accusations …
- ath3nd 1y agoWhat a trash company Meta has consistently been. From enabling genocide in Myanmar, to interfering with elections, to giving user data to third parties in violation of its own daya policies, to straight up weird stuff like pirating/torrening books to train their steaming pile of garbage called llama, to having sex chatbots be weird to children. And then there is the even weirder decisions of zuck, the biggest loser of all: - VR didnt seem to catch on - the metaverse is a giant smelly pile of poo and he sunk millions in it - he is hiring AI engineers at absurd money in a rapidly cooling bubble market - he immediately started ass kissing the orange stain that calls himself president Is he purposefully trying to be a caricature cartoon vilain, a grotesque loser, and his company an emblem of evil? Or is it just cluelessness?
- globalnode 1y agoThey managed to tap in to a seemingly unlimited ocean of uninformed useful idiots, paid shills, bots and psychopaths. Its how you get rich in social media.
- rhizome 1y agoGreater Fool Theory
- asadotzler 1y ago>the metaverse is a giant smelly pile of poo and he sunk millions in it He sunk tens of billions. Estimates (because we don't have "Reality Labs" broken out before 2019) put Zuck's Metaverse Misadventure & Boondoggle about $75B in the hole ($10B revenue on $85B spend) with no signs of a turnaround in revenue. There are plans to turn things around with AR spectacles but decent ones are years off and will require entirely new investment with little re-use of that $75B Metaverse nonsense (Oculus acquisition, 5 generations of Quest R&D, Horizon Worlds, partnered and sponsored games and content, etc.) The only real ROI will be the experience and staff gained. The rest will almost certainly land in the dustbin.
- vladmk 1y agonothing new here.
- npalli 1y agoAll Meta guys develop a conscience after leaving Meta.
- danudey 1y agoYou have to put your conscience in escrow until your options vest.
- pixl97 1y agoI mean the options are 1) leave quietly and tell no one: con - no one on HN gets to talk about it. The next person needing money does it anyway. 2) leave loudly when you're still poor: con - you get blacklisted from tech and die from a preventable disease working at a gas station without insurance. The company implements the policy anyway. 3) leave loudly when your rich: con - people accuse you of selling out the users.
- solid_fuel 1y agoI believe you are forgetting: 4) Don't join Meta in the first place I have consistently told recruiters from Meta to leave me alone. It is a company that has knowingly done massive harm to our culture and our children, and I have no interest in ever working with or for them.
- chias 1y agoin terms of effect, this is identical to option 1.
- Vinnl 1y agoWell, not all of them: https://www.theguardian.com/politics/2025/aug/23/facebook-nick-clegg-tech-bros-trump-leaving-silicon-valley https://www.theguardian.com/politics/2025/aug/23/facebook-ni...
- mentalgear 1y agoSeems just in line with all the other Meta Scandals: from providing a platform for genocide in Myanmar, harming the psychology of 100s of millions of teenagers (Instagram) to pushing extremist and fascists content while receiving big ad cash dollars for propaganda that lifts criminals and fascist politicians into the highest offices. Meta has no red lines, as long as it lines Zuckerberg's pockets.
- mentalgear 1y agoIf you haven't already: Signal is the strongest independent e2e encrypted consumer app that is driven by a non-profit organisation using a zero knowledge approach.
- TiredOfLife 1y agoSignal is a cryptocoinscam company
- palata 1y agoI hate Meta as much as the next person, but it feels like "endangering billions of users" is exagerating here. The complaint is pretty much that WhatsApp engineers can access metadata (NOT the content of the messages). This said, WhatsApp is not open source, so it's impossible for users to verify how the encryption works, so users have to trust that it's properly end-to-end encrypted. If you care about privacy (and you should), then you should use Signal instead of WhatsApp.
- ryandrake 1y agoThe metadata of someone's communications can be almost as damning as the content. I would guess that if the FBI could merely have a list of who their suspect contacted over an app, and when, they'd have 90% of what they wanted.
- rhizome 1y agoMy understanding is that in the vast majority of investigations law enforcement will be satisfied in learning only who you're talking to, i.e. "just metadata" is fine, and dangerous.
- 3eb7988a1663 1y agoIt seems reasonable. Even those who are sloppy with their opsec probably do not detail the entirety of the plan via digital mechanisms. Being able to identify likely collaborators is probably sufficient to infer some specifics of an activity.
- palata 1y ago> I would guess that if the FBI could merely have a list of who their suspect contacted over an app, and when Well with WhatsApp they most definitely can, but it has never been a secret. WhatsApp always had access to the metadata (whereas Signal makes a lot of effort to reduce the metadata they have access to). In ~2016 WhatsApp integrated the Signal protocol to add end-to-end encryption, but did nothing about the metadata. Again: if you care about privacy, use Signal.
- btown 1y agoFull text of the lawsuit: https://www.bloomberglaw.com/public/desktop/document/BaigvMetaPlatformsIncetalDocketNo325cv07604NDCalSep082025CourtDoc?doc_id=X3U7MPVRH378J4BQ34G8T40MVST https://www.bloomberglaw.com/public/desktop/document/BaigvMe...
- diimdeep 1y agoHere is 115 pages: https://storage.courtlistener.com/recap/gov.uscourts.cand.455911/gov.uscourts.cand.455911.3.0_1.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.45... from here: https://www.courtlistener.com/docket/71293063/baig-v-meta-platforms-inc/ https://www.courtlistener.com/docket/71293063/baig-v-meta-pl... This further surprised Mr. Baig, as WhatsApp, which is known for its strong security brand externally, had such a small security team of just 6 engineers, and they were all only working on this tiny aspect of application security. All the other teams in WhatsApp were well staffed. The engineering team had about 1200 engineers. In addition, there were about 100 product managers, about 100 product designers, nearly 200 data scientists, etc. WhatsApp overall had about 3000 employees. “Are we going to be in the same situation as Mudge at Twitter?” WhatsApp is way beyond just texting and calling, it is basically global infrastructure now, used daily by governments, NGOs, and billions. This is not a startup screw-up, it's a public utility gone seriously messed up. Heads need to roll. Stop playing god. Secure the platform or step aside.
- tabbytown 1y ago> had such a small security team of just 6 engineers ≥ Company refused to allocate more than around 10 engineers to the Security team at any point If true, this tells the story here with security culture at WhatsApp. Assuming a backlog of known weaknesses (as any established code base will have), and the velocity that 100 PMs and 1200 SWEs implies, how would you do anything as a security team besides stick your fingers in the figurative holes in the dike? The ensuing conflict between Baig and his superiors about not fixing stuff is surely going to result in an assessment of "poor performance" but is likely just Baig giving a f** about user data.
- storus 1y agoDidn't Hacker News feature an article on their home page at some point (10 years ago?) that at that time Facebook misconfigured something and users could observe their data being fed directly to some Israeli intelligence company? That was the day I deleted my FB account and never looked at anything they offer anymore.
- stingraycharles 1y agoAt this point it’s best to assume that everything you communicate is being collected in some way. There are very, very few apps I really trust. E.g. the only mechanism I trust for communicating passwords securely is GPG, I wouldn’t even use Signal for that.
- cryptoegorophy 1y agoUnless you owner of the app and what they are doing exactly you can’t trust anyone. You don’t know what they are going through or if they sold the app to someone or had a certain code implementation that leaks all of your data. I stopped using Chrome when I had clear evidence of it leaking data - urls visited.
- ars 1y agoAre you thinking of Cambridge Analytica? That was a British company, not Israeli.
- alex1138 1y agoI've seen some people right here on HN say that Whatsapp was an inspired acquisition and Zuck is a great product guy, knows what to buy and who to hire Counterpoint: he's a monopolist and scummy person (https://news.ycombinator.com/item?id=1692122 https://news.ycombinator.com/item?id=1692122) who refuses to stop (https://arstechnica.com/tech-policy/2019/09/snapchat-reportedly-has-project-voldemort-dossier-on-facebooks-bad-behavior/ https://arstechnica.com/tech-policy/2019/09/snapchat-reporte...) from the early days onwards (https://news.ycombinator.com/item?id=1169354 https://news.ycombinator.com/item?id=1169354) https://news.ycombinator.com/item?id=15007454 https://news.ycombinator.com/item?id=15007454
- gerdesj 1y ago"He also claimed the company failed to remedy the hacking and takeover of more than 100,000 accounts each day, ignoring his pleas and proposed fixes and choosing instead to prioritize user growth." There is no oversight of these monstrosities of any sort. I doubt anyone would have issues with the thesis that Meta would implement anything that might curb their user numbers unless it was mandated. Why would they? They are beholden to their shareholders first. If it isn't illegal then it isn't illegal, immoral perhaps but that is not illegal, unless it is illegal. My learned friends are going to have to really get their bowling arms warmed up for this sort of skit. For starters, you need a victim ... err complainant.
- alex1138 1y agoZuckerberg has a different class of shares And not every CEO begins life in their company with "if you need any info just ask, they trust me, dumb fucks"
- bcye 1y agoWhere is that quote from?
- ThePowerOfFuet 1y agohttps://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5 https://www.businessinsider.com/well-these-new-zuckerberg-im...
- deleted 1y ago[deleted]
- fHr 1y agostill use Facebook, Instagram and WhatsApp you sheeple
- sudahtigabulan 1y ago> In his whistleblower complaint, Baig is requesting reinstatement, back pay and compensatory damages, along with potential regulatory enforcement action against the company. If the company is so bad (it is), why does he want back?! 'Just pay me the salaries I "missed", and keep them coming.' The regulatory action is just "potential". I have no sympathy for Meta, but this guy...
- skybrian 1y agoMaybe so he can quit properly? I wonder how these lawsuits work? Maybe a lawyer would know.
- saagarjha 1y agoCompanies are not relationships where once they're your ex they are never worth interacting with ever again. If you are doing good work and then HR pushes you out, then it is reasonable to sue the company to get them to pay you damages and then go back to doing what you were before with the protection that they won't do it again.
- sudahtigabulan 1y agoThe point I tried to make was not that he should be resentful about being kicked out, but that he doesn't really care that Meta is unethical and endangers billions. Even if nothing changes (the regulatory action is optional), he's happy to contribute (he insists, in fact). Even among people who don't want him there.
- mapotofu 1y agoThe points you’re making are personal attacks about the whistleblower. They don’t focus on the substance of the accusations (insecurity). Instead, they focus on your idea of their career motivations and their personality.
- Nevermark 1y agoHe got fired unjustly. For trying to do something good. (His position.) Any full remedy would require his position is reinstated. If he wins the right to be reinstated, he will be happy to negotiate a payment instead. He is made whole. What about any of that lacks sensible motives?
- transcriptase 1y agoUnsurprising given it’s been an open secret for over a decade that Meta employees will (if you have the right contacts or amount of money), orchestrate banning or seizing long-standing active accounts with desirable usernames and giving them to their friends or the highest bidder.
- mikalauskas 1y agosource?
- transcriptase 1y agoHere’s one of many articles about the phenomenon: https://www.cnbc.com/amp/2022/11/17/meta-disciplined-or-fired-employees-for-taking-over-user-accounts-wsj.html https://www.cnbc.com/amp/2022/11/17/meta-disciplined-or-fire... A related scheme is the existence of brokers who will, for a fee, recover banned or locked accounts. User pays the broker $X, broker pays their contact at Meta $Y, and using internal tooling suddenly a ban or suspension that would normally put someone in an endless loop of automated vague bullshit responses gets restored.
- xvector 1y ago> WhatsApp engineers could “move or steal user data” including contact information, IP addresses and profile photos “without detection or audit trail”. So not messages.
- United857 1y agoThat's rather surprising about the accessing user data bit. When I was at Meta, the quickest way to get fired as an engineer was to access user data/accounts without permission or business reason. Everything was logged/audited down to the database level. Can't imagine that changing and the rules are taught very early on in the onboarding/bootcamp process.
- mgh2 1y agoDo you have proof?
- YouWhy 1y agoTo the extent a random person's evidence on the Internet amounts to proof: From people at Facebook circa 2018, I know that end user privacy was addressed at multiple checkpoints -- onboarding, the UI of all systems that could theoretically access PII, war stories about senior people being fired due to them marginally misunderstanding the policy, etc. Note that these friends did not belong to WhatsApp, which was at that time a rather separate suborg.
- Jenk 1y agoDoes Attaullah Baig?
- mgh2 1y agoHe better if he is filing a lawsuit.
- lysace 1y agoThat part of the complaint is specifically about 1500 ”WhatsApp engineers”. Different culture from the blue app, or whatever they call it?
- imiric 1y agoWhatever Meta says publicly about this topic, and whatever its internal policies may be, directly contradicts its behavior. So any attempt to excuse this is nothing but virtue signalling and marketing. The privacy violations and complete disregard for user data are too numerous to mention. There's a Wikipedia article that summarizes the ones we publicly know about. Based on incentives alone, when the company's primary business model is exploiting user data, it's easy to see these events as simple side effects. When the CEO considers users of his products to be "dumb fucks", that culture can only permeate throughout the companies he runs.
- 1vuio0pswjnm7 1y agoBaig v Meta Platforms, Inc. Complaint: https://storage.courtlistener.com/recap/gov.uscourts.cand.455911/gov.uscourts.cand.455911.3.0_1.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.45...
- coppsilgold 1y agoWhen it comes to e2e encryption it's important for the ends to be static (not web apps) and auditable (open source, reproducible builds) because the software running on the ends can trivially compromise anything going trough either of them. It can be as simple as a script being loaded from the server into a runtime such as Lua (closed source app). Or custom javascript delivered (web app). When these conditions aren't met, any e2e encryption claim can be dismissed out of hand. This does not mean the service offers no value, it just means it cannot be trusted to keep anything confidential.
- kelipso 1y agoWasn’t using Whatsapp that got a bunch of people droned by Israel? You should just assume your metadata at the very least is getting leaked to all US friendly intelligence agencies if you are using a US based service.
- neilv 1y ago> Attaullah Baig, who served as head of security for WhatsApp from 2021 to 2025, claims that approximately 1,500 engineers had unrestricted access to user data without proper oversight, potentially violating a US government order that imposed a $5bn penalty on the company in 2020. If it results in a new billion-dollar penalty, maybe it would've saved money to move him quietly to a cushy rest-and-vest advisory position, in which he's not allowed to see, do, or say anything. > In his whistleblower complaint, Baig is requesting reinstatement, [...] I don't understand the "reinstatement" part. Does he actually want to go back, and think that it wouldn't be a toxic dynamic? (He already talked about retaliation. And then by going public the way he did, I'd think he burned that bridge, salted the earth for a mile around bridge, and then nuked the entire metro area from orbit.) Or is "reinstatement" simply something the lawyers just have to ask for, to ostensibly make him whole, but they actually neither want nor expect that?
- 7bit 1y ago> I don't understand the "reinstatement" part. Does he actually want to go back, and think that it wouldn't be a toxic dynamic? Maybe he's just laying a foundation for an upcoming legal dispute?
- Nevermark 1y agoIt means he would prefer to be paid to not be reinstated. But until he is paid, his position is that he wants to be reinstated.
- jnsaff2 1y ago> Or is "reinstatement" simply something the lawyers just have to ask for, to ostensibly make him whole, but they actually neither want nor expect that? “Reinstatement” is usually a legal formality in whistleblower cases: lawyers ask for it because the law says the remedy for retaliation is to make the employee whole, and it strengthens the case even if nobody expects it to happen. In reality, returning to the job is almost never feasible, so the request mostly serves as leverage for a financial settlement.
- pfortuny 1y ago
- tamimio 1y agoI never trusted fecebook which is why I never created an account or used any of its products (old Instagram placeholder only), except last year, I made a small startup and wanted to use Instagram to promote it. Despite using the other old account to avoid potential false flagging as spam, immediately after creating it I got banned and had to submit a personal picture holding a book or whatever to verify I am real. I did that although it's not a personal account. Regardless, a few seconds after submitting the picture and verifying my number it got permanently banned. So far this is understandable, maybe it's all an automated process which is expected. However, I wanted to get in touch with support, in any form or shape, only to find out that there's none, and apparently the only way to actually fix something within fecebook is knowing someone who knows someone who works there. LOL, really big LOL!! A company that size operating like an underground syndicate is a total joke and totally untrustworthy. Bottom line: Never trust anything from fecebook, no matter what they say, do not.
- tgsovlerkhgsel 1y ago> including contact information, IP addresses and profile photos “without detection or audit trail”. As many holes as WhatsApp's "E2E" encryption has, this shows how valuable it still is. It's all metadata, not message content.
- daryl_martis 1y agoMuck Feta
- haileyLlyod3 1y ago[dead]
- _DeadFred_ 1y agoIf a company can become a mega company by having billions of users, small violations must be treated as larger. At some point impacting millions/hundreds of millions of human years a year by your practices rises above the 'it's a small inconvenience to a single person'. You are costing society/humanity millions/hundred of millions of human years. That is not a 'small inconvenience' at this scale.
- cindyllm 1y ago[dead]