4 ms·

WhatsApp is end-to-end encrypted, so I'm not trusting Meta with much, and it's the only way I can reach quite a lot of people. A lot of people I know trust them

by lxgr 1mo ago

WhatsApp is end-to-end encrypted, so I'm not trusting Meta with much, and it's the only way I can reach quite a lot of people. A lot of people I know trust them begrudgingly (primarily with Instagram, because all of their friends are on it as well). People don't need to love a company to use its products. The perceived benefit merely needs to be bigger than the perceived cost.

cyanydeez 1mo ago
someone's questioning that claim legally: https://www.pcmag.com/news/lawsuit-alleges-that-whatsapp-has-no-end-to-end-encryption https://www.pcmag.com/news/lawsuit-alleges-that-whatsapp-has...
- lxgr 1mo ago
  And has a verdict been reached? Otherwise, people are pursuing all kinds of outlandish claims legally.
- Egrodo 1mo ago
  I work there. The claims made in this article are just blatantly false, and so obviously so to any employee I'm not sure how this hasn't been thrown out.
  - cyanydeez 1mo ago
    I agree, it should be rediculously easy to demo it's real e2e capabilities. to everyones benefit
augment_me 1mo ago
This assumes completely techo-rational actors that continuously monitor cost-benefit analysis, other alternatives and switch products when one outweights the others. This is even further away from the reality where people have breakdowns because their app icon moved location and is not in the usual spot. The average person is optimizing towards energy use minimization by default because life is already hard enough with plans, kids, etc. Use incentives and we will arrive at closer truths than by claims and expressions.
- lxgr 1mo ago
  Slightly different lens, same outcome: It's there, it lets people do what they want to do with acceptable effort/other negative consequences, so they use it.
- larodi 1mo ago
  People have breakdowns because they are left without mobile reception for a few hours. Indeed this IS happening and I would expect people soon to have breakdowns, because they lack access to AI.
bossyTeacher 1mo ago
> WhatsApp is end-to-end encrypted, - Meta data of your messages is not encrypted so meta can make a graph of who you talk to and when - backups are not encrypted by default so plaintext of your private chats can be obtained - even if you enable encryption for backups all it takes is for the other person in your private convo (or a person in a group chat) to not enable it for your messages to be available in plaintext
- lxgr 1mo ago
  > - backups are not encrypted by default so plaintext of your private chats can be obtained Yes, but importantly not by Meta themselves. > - Meta data of your messages is not encrypted so meta can make a graph of who you talk to and when Fair enough and worth mentioning. I'm personally fine with it. > - even if you enable encryption for backups all it takes is for the other person in your private convo (or a person in a group chat) to not enable it for your messages to be available in plaintext Yes, but how would you prevent that even in principle? I can't control what the people I'm messaging do with their copy of my messages. As long as there isn't unnecessary non-repudiation (e.g. by the sender cryptographically signing all outbound messages, which the Signal protocol intentionally avoids), I think this is fair as well. I do agree that e.g. vanishing chats with a short timeout/"view only once" images should probably not be included in backups, though; last time I checked, I think they were.
  - cobbzilla 1mo ago
    > Yes, but importantly not by Meta themselves. Don’t they save backups to Meta? Even if not, they can read whatever’s (unencrypted) on your phone if they really want to.
    - lxgr 1mo ago
      They currently go on iCloud on iOS and Google Drive on Android. There are rumors about a first-party backup service, which would obviously change that calculus, but nothing concrete yet.
- addandsubtract 1mo ago
jcgl 1mo ago
WhatsApp is E2EE, but Meta controls both ends. Instead of reading your plaintext on the server, they read it on the client. Not that tricky. I presume the hardest part would be avoiding detection via decompilation and other reverse engineering techniques. Not familiar with that space (can anyone here shed some light?), but it seems likely that an entity with Meta’s resources would be able to figure that out. E2EE probably protects well against bulk data collection (traffic analysis would sniff out sending 2x volume of data pretty quickly). But something more subtle and targeted, smuggled out in various fields of various protocols, would be hard to detect.
- lxgr 1mo ago
  They only need to get caught doing it once to have a gigantic lawsuit on their hands. They could possibly pull it off very selectively, but doing it in a dragnet fashion seems incredibly risky.
  - netsharc 1mo ago
    My suspicion is that things like URL previews, or when the app calls a handler to open a link (YouTube, browser), are still monitored. So e.g. opening a link to an Amazon product that a friend sent makes you a target for ads in that category. It's a suspicion, they'd probably argue their EULA allows this. The typical "we have to monitor links for dangerous content" is always the standard bullshit.
    - lxgr 1mo ago
      This is indeed a common vector of privacy leaks on either the recipient side (to the sender, in this case, if they operate the target of the link for which a preview is being rendered) or to the platform provider (if the preview is rendered server-side). But last time I checked, in WhatsApp, URL previews are rendered exclusively on the sender side and then sent as (E2E encrypted) media to the recipient.
  - jcgl 1mo ago
    What grounds would the lawsuit be based on? I can’t imagine that slurping any kind of data would be inconsistent with their EULA. The only risk would be the reputational damage. And as far as their bottom line is concerned, the impact of that would be negligible—how many of WhatsApp’s billion(?) users know that it’s supposed to be E2EE, let alone are under the illusion that Meta doesn’t have access to their data?

by lxgr 1mo ago

cyanydeez 1mo ago

someone's questioning that claim legally: https://www.pcmag.com/news/lawsuit-alleges-that-whatsapp-has-no-end-to-end-encryption https://www.pcmag.com/news/lawsuit-alleges-that-whatsapp-has...

lxgr 1mo ago
And has a verdict been reached? Otherwise, people are pursuing all kinds of outlandish claims legally.
Egrodo 1mo ago
I work there. The claims made in this article are just blatantly false, and so obviously so to any employee I'm not sure how this hasn't been thrown out.
- cyanydeez 1mo ago
  I agree, it should be rediculously easy to demo it's real e2e capabilities. to everyones benefit

augment_me 1mo ago

This assumes completely techo-rational actors that continuously monitor cost-benefit analysis, other alternatives and switch products when one outweights the others. This is even further away from the reality where people have breakdowns because their app icon moved location and is not in the usual spot. The average person is optimizing towards energy use minimization by default because life is already hard enough with plans, kids, etc. Use incentives and we will arrive at closer truths than by claims and expressions.

lxgr 1mo ago
Slightly different lens, same outcome: It's there, it lets people do what they want to do with acceptable effort/other negative consequences, so they use it.
larodi 1mo ago
People have breakdowns because they are left without mobile reception for a few hours. Indeed this IS happening and I would expect people soon to have breakdowns, because they lack access to AI.

bossyTeacher 1mo ago

> WhatsApp is end-to-end encrypted, - Meta data of your messages is not encrypted so meta can make a graph of who you talk to and when - backups are not encrypted by default so plaintext of your private chats can be obtained - even if you enable encryption for backups all it takes is for the other person in your private convo (or a person in a group chat) to not enable it for your messages to be available in plaintext

lxgr 1mo ago
> - backups are not encrypted by default so plaintext of your private chats can be obtained Yes, but importantly not by Meta themselves. > - Meta data of your messages is not encrypted so meta can make a graph of who you talk to and when Fair enough and worth mentioning. I'm personally fine with it. > - even if you enable encryption for backups all it takes is for the other person in your private convo (or a person in a group chat) to not enable it for your messages to be available in plaintext Yes, but how would you prevent that even in principle? I can't control what the people I'm messaging do with their copy of my messages. As long as there isn't unnecessary non-repudiation (e.g. by the sender cryptographically signing all outbound messages, which the Signal protocol intentionally avoids), I think this is fair as well. I do agree that e.g. vanishing chats with a short timeout/"view only once" images should probably not be included in backups, though; last time I checked, I think they were.
- cobbzilla 1mo ago
  > Yes, but importantly not by Meta themselves. Don’t they save backups to Meta? Even if not, they can read whatever’s (unencrypted) on your phone if they really want to.
  - lxgr 1mo ago
    They currently go on iCloud on iOS and Google Drive on Android. There are rumors about a first-party backup service, which would obviously change that calculus, but nothing concrete yet.
addandsubtract 1mo ago

jcgl 1mo ago

WhatsApp is E2EE, but Meta controls both ends. Instead of reading your plaintext on the server, they read it on the client. Not that tricky. I presume the hardest part would be avoiding detection via decompilation and other reverse engineering techniques. Not familiar with that space (can anyone here shed some light?), but it seems likely that an entity with Meta’s resources would be able to figure that out. E2EE probably protects well against bulk data collection (traffic analysis would sniff out sending 2x volume of data pretty quickly). But something more subtle and targeted, smuggled out in various fields of various protocols, would be hard to detect.

lxgr 1mo ago
They only need to get caught doing it once to have a gigantic lawsuit on their hands. They could possibly pull it off very selectively, but doing it in a dragnet fashion seems incredibly risky.
- netsharc 1mo ago
  My suspicion is that things like URL previews, or when the app calls a handler to open a link (YouTube, browser), are still monitored. So e.g. opening a link to an Amazon product that a friend sent makes you a target for ads in that category. It's a suspicion, they'd probably argue their EULA allows this. The typical "we have to monitor links for dangerous content" is always the standard bullshit.
  - lxgr 1mo ago
    This is indeed a common vector of privacy leaks on either the recipient side (to the sender, in this case, if they operate the target of the link for which a preview is being rendered) or to the platform provider (if the preview is rendered server-side). But last time I checked, in WhatsApp, URL previews are rendered exclusively on the sender side and then sent as (E2E encrypted) media to the recipient.
- jcgl 1mo ago
  What grounds would the lawsuit be based on? I can’t imagine that slurping any kind of data would be inconsistent with their EULA. The only risk would be the reputational damage. And as far as their bottom line is concerned, the impact of that would be negligible—how many of WhatsApp’s billion(?) users know that it’s supposed to be E2EE, let alone are under the illusion that Meta doesn’t have access to their data?