As evidence, the lawsuit cites unnamed “courageous whistleblowers” who allege that WhatsApp and Meta employees can request to view a user’s messages through a simple process, thus bypassing the app’s end-to-end encryption. “A worker need only send a ‘task’ (i.e., request via Meta’s internal system) to a Meta engineer with an explanation that they need access to WhatsApp messages for their job,” the lawsuit claims. “The Meta engineering team will then grant access – often without any scrutiny at all – and the worker’s workstation will then have a new window or widget available that can pull up any WhatsApp user’s messages based on the user’s User ID number, which is unique to a user but identical across all Meta products.”
“Once the Meta worker has this access, they can read users’ messages by opening the widget; no separate decryption step is required,” the 51-page complaint adds. “The WhatsApp messages appear in widgets commingled with widgets containing messages from unencrypted sources. Messages appear almost as soon as they are communicated – essentially, in real-time. Moreover, access is unlimited in temporal scope, with Meta workers able to access messages from the time users first activated their accounts, including those messages users believe they have deleted.” The lawsuit does not provide any technical details to back up the rather sensational claims.
Call me old fashioned but I really think that for real E2EE the vendor of the encryption and the vendor of the infrastructure should be two different entities.
For example PGP/GPG on <any mail provider>… great! Proton? Not great
Jabber/XMMP with e2ee encryption great! WhatsApp/Telegram/signal… less so (sure I take signal over the other two every day… but it’s enough to compromise a single entity for accessing the data)
Okay Old Fashioned, but doesn’t open source encryption audited by a third party solve this problem? Signal protocol for example? Also proton, I’m guessing, but I’m too lazy to check
Unfortunately even the best intentioned and best audited project can be compromised. So that is not a guarantee (sure, much better than closed source but that is a given)
You may be forced by a rubber hose attack (or legal one) to insert vulnerabilities in your code… and you have the traffic… a single point to attack… signal/proton/etc
Is it possible with two different vendors? Sure it is but it is way more complicated
That’s a really good point. All we’d need is for signal devs to be compromised in some way and the next update ends security for signal.
Cynical me would say they don’t have to use the code they put up on GitHub in production.
By this logic, can we trust any open source software, even if they claim to use some third party encryption? They could say they’re using a super secure encryption, even show it implemented in their open source code base, then just put the other, secret evil backdoor code base in production? Is there a way for any open source project to prove that the code in their open source repo is the code in production?
This is called reproducible builds. With this all builds of a version will be binary-identical. So you can build from the repo and the compare it with the appstore binary and see if the owner was honest.
I found this:
https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md
Looks like they’re working on reproducibility, at least in the desktop app. That’s a little disappointing but i guess I’m happy they’re working on it.
Neat! And can this been done with signal or proton?
Signal: https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds/README.md
Proton: didn’t find anything (but I just did a quick lookup)
If you can self host it, yes. Like matrix
But only if you self-host right? Otherwise who ever hosts the matrix instance can tinker with it.
Correct.
In the end i have to choose between some shady company or some guy with a homelab. I guess I’ll choose the one who isn’t financially incentivized to screw me over.
Yep
why
Not much people use clients anymore.
Yeah and I think it’s a pity. It’s the byproduct of “app culture” everything has to be easy. One button, plug and play…
Unfortunately like many things in life “saving” (time and effort n this case) has a cost
WhatsApp client is closed source. Any claims around E2EE is pointless, since it’s impossible to verify.
For Facebook it doesn’t matter if its e2e. They control the client on both sides. They can just let the client sent the clear text data to them.
It’s E2EE alright. Just, don’t ask what “ends” we’re talking about.
Their mouth and Zuckerberg’s ass
TMBE
Trust me bro encryption
Any claims around E2EE is pointless, since it’s impossible to verify.
This is objectively false. Reverse engineering is a thing, as is packet inspection.
Reverse engineering is theoretically possible, but often very difficult in practice.
I’m not enough of an expert in cryptography to know for sure if packet inspection would allow you to tell if a ciphertext could be decrypted by a second “back door” key. My gut says it’s not possible, but I’d be happy to be proven wrong.
Hell, as far as I know, E2EE would be indistinguishable from client to server encryption, where the server can read everything without the need for a secret “backdoor key”. You can see that the channel is encrypted, but you can’t know who has the other key.
The easiest way to break E2EE is to copy your private key to Meta’s servers. It’s very easy to implement, and close to impossible to detect.
Now you just need Meta to allow you on their networks to inspect packets and reverse engineer their servers because as far as I know, WhatsApp messages are not P2P.
/edit I betcha $5 that the connection from client to server is TLS(https), good luck decrypting that to see what its payload is.
No it is not. Whatsapp gets several updates a month. How do you keep up with that rate?
Outside of open-source. That shit is usually illegal
It isn’t. Otherwise security research would never happen for proprietary software and services.
SureSure no white hat never been sued before
In the US, CFAA is so draconian that in certain aspects it can be very illegal to reverse engineer code behind explicit ToS which whatsapp make you agree through click-wrap agreement (meaning explicit I agree button press) upon installing the app. So Meta could easily sue you with very good chance of winning. I work in security and reverse engineer a lot of stuff but just because my company has lawyers that will protect me (also I’m not an american) but generally americans are super fucked here and there are many stories of people being sued and even imprisoned for breaking ToS.
insert pikachushockedface
A lot of victim blaming in this thread. Why can’t you just be mad for someone who was deceived?
Because it’s the gazillionth time the exactly totally absolutely same kind of shit happens with the very exactly same company that didn’t even try to hide who they were.
And next week the very very same deceived people will be of Facebook, Instagram, etc. And maybe, just MAYBE they’ll migrate away from Whatsapp… to join another proprietary network of another billonaire’s controlled megacorp.Because I’m tired of being “that pain in the ass” when barely suggesting to use something else all to see at the end people crying over things they’ve be warned about.
If a kid burns themself once on a kitchen’s hotplate, you assume they learnt their lesson in an unfortunate way despite all the warnings.
If adults keep burning themselves over and over… and over and over and over, at which point are you entitled to say they’re part of the f*cking problem??I’m sick of Mark fucking zuckerberg.
If i was the mad king of the usa all of those tech bros would be in a jail in el salvador.
OH JUST USE SOMETHING ELSE!
I do but that doesn’t stop that ugly weak fuck from stealing from my business every chance he fucking gets.
It’s like buying a hot dog from a gas station and not feeling awesome tomorrow.
If you keep buying the hot dog every week, you see other people buying it and are fine, but you’re the only one getting sick week after week, at some point maybe you should just stop buying the hot dog.
No one else is getting sick. They know what they’re getting. But you keep buying it expecting this time it’ll be different. And when it isn’t it’s the gas stations fault.
at what point is it someone’s responsibility to simply know better?
this isn’t some complicated deceit it’s literally one of the most untrustworthy companies in the world lying to your face. A company we’ve known for now like two decades is untrustworthy and overtly harms people to make money
do people have responsibility at all?
People can’t take increase responsibility for every single aspect of life. It seems straightforward to you because you’re likely tech literate. Do you know every process around how the mechanic services your vehicle, how medicines are made that you consume, how food is curated that you consume, how energy is generated that you consume? People can’t have intimate knowledge of every aspect of life, therefore if a company says “this is E2EE” you should be able to believe that at face value and rely on consumer protection agencies to follow up if it’s inaccurate.
You don’t need to be tech literate to follow the news. Meta has been caught in lie after lie for YEARS and it has all been widely reported on. Meta needs to face actual repercussions for their crimes against humanity, but anybody still buying into their bullshit is being willfully ignorant.
You are correct and incorrect at the same time. Yes, nobody should trust Meta. But Meta should also be dragged into every court available for their lies.
You just agreed with my points while telling me I’m incorrect. How am I incorrect?
No that’s not correct at all. If a company says something you do not in fact just get to believe it at face value and do 0 research, this applies in every field you mentioned. What planet are you from where you are supposed to just believe what companies say at face value???
People often get second options from different mechanics, doctors, contractors, and all sorts of specialists when told something because you need to do your own research to know about stuff.
You literally do in fact need to try and learn and make informed decisions about everything in life.
Chief, if you needed to make an informed decision about every decision in life, there’d be no time for life. That’s why other people specialize in jobs so that within reason, confidence can be placed to their decision. I’m not saying you blindly agree and follow everything, but people can’t be responsible for every decision. For example, who made the seatbelt in your car? What research did you personally do to verify the safety of your seatbelt. What maintenance have you done to it to ensure that it works as intended? Pretty important life saving bit of equipment.
Edit: my presumption is that you(or the vast majority of the population) haven’t done any research into your seatbelt because you trust in the car company and the safety rating requirements of your nation to ensure adequate protection.
You don’t need to worry about who made your seatbelt the same way you don’t need to worry about which specific programmers work for meta
You do need to worry about the repairability and safety rating of your car the same way you need to worry about the core descriptions of Meta’s products
Do you see?
Repairability in what way? Outside of changing the tires, a modern car is so complex with all the electronic systems in it that you can’t really repair it yourself and you can’t even reset the error codes because you don’t have that special tablet to even hook into it.
For safety ratings, do you even know what they test and how without looking it up? I’d venture a guess that no, but I’ve been surprised before.
People maybe buy a Toyota because they once read that they just work or people may buy a Mercedes one day because their Dad used to always drive one, but they probably didn’t sift through the damn safety and repairability ratings for it, they probably just bought it after a test drive. Its the same thing with anything really, how many times have you ever seen anyone question an app or a device that they are using when it just works and they don’t even have to think about it? Its either 0 or close to it.
You can simply go look up how repairable various makes and models are considered by reputable sources it’s very simple research that a mere google will tell anyone. You’re actually making it out to be much more complicated than it is. They tell you exactly what the safety ratings are for and how they’re tested you just have to spend more than 0 minutes reading the first few google results.
People can voice ask Google simple questions they’re just not wanting to care about any of this and then are shocked when anything happens.
You admit it yourself they’re just lazy consumers lol
What you’re positing here is a view of life that Margaret Thatcher loved. The idea is, “There is no society. There are no laws. There is no oversight. Everything, all responsibility, all of it is 1000% individual.”
Of course in reality that’s nonsense. We live in a world with laws that are sometimes enforced, where governments sometimes protect us, because we want them to, because that’s good for us all.
But even if you believe in Thatcher’s view, then you have the problem of corporations. You can’t seriously argue that we should be responsible for everything ourselves, as individuals, and also that corporations should exist, because they are anti-individual.
No im telling you how it is and until we don’t live in such a world we have to take responsibility or it literally is your own fault
We all know this is the world and corporations do not follow laws and the state is weak and subservient to international capital
Until it’s not you can’t just close your eyes and trust the goddam corpos lmao
Your life must be hectic, im guessing you must also check the company and maintenance of every lift/ elevator / aircraft you use? By your rationale, itd be your fault if you were to be involved in an accident due to a company not maintaining equipment properly?
If companies are lying in their advertising to the general public, then that is something the companies are responsible for. You can blame the victims, but that’s kind of stupid because there are so many people in the world who are not technically savvy. They don’t have the resources, background, knowledge, and skills to evaluate whether what the company is telling them is true. That’s why there are laws designed to protect consumers from lying companies.
Would it be great if everyone was an expert in everything? Yes. Are they? No. They never will be. That’s why we have laws.
Do you think an attractive woman who has been raped multiple times should simply know better? Is she asking for it if she wears slightly more revealing clothing? How many times does she need to be sexually abused before it’s her fault? How much responsibility does she have for her own abuse?
Somehow you’ve managed to connect basic consumer responsibility to being raped
There is literally something wrong with your brain if these are somehow remotely appropriate to compare
It would not be surprising if found to be true. Difficult to see how the current business model operates at a profit. Their long term goal is the usual loss leader model until a monopoly is achieved and then slug us with ads, sell all the data, hike the price, etc. Sickening to watch them cosy up to fascists. They are probably supplying any and all the agencies with intelligence scraped from their user base. If Facebook were a person they would be a psychopath.
Obligatory
If Facebook were a person they would be a psychopath.
I mean, Mark Zuckerberg kind of is Facebook, and he’s a psycho.
What?!! No. The owner of WhatsApp would never lie to us.
Well if I can’t trust Meta with my information, who CAN I trust
Me
Oh okay. My location is 55.752121, 37.617664, my full name is Jeremy, and my password is hunter9. I trust you not to tell this to anybody
Your full name is “Jeremy”?
Oh god damnit chemicalprofet why did you tell this guy i thougjt i could trust you :((
All I see is ‘••••••’
I see ‘******’ though.
Maybe it’s just a different interface.
Jeremy “Iks” Hunter IX
Edit: IX. Iks. I think we got it right now.
The Ninth
Pronounced “iks”
Just like Cher (which is short for Cheremy).
Hi Vova
Your secret is safe with us and our 36,893 affiliates.
Legitimate interest, though 🤞
Nice to see the ancient lore alive.
Can confirm, chemicalprophet is the best password manager I’ve ever used.
Ah! You did your own research!
ta
The drunk dude that’s always sitting on the ground near the park entrance and sell weird tissue dolls with curly hairs is more trustworthy, I’d say.
Wait, you are telling me that the company whos entire business is collecting personal information, including people who don’t sign up for their services, to leverage for advertising, is keeping their platforms unsecured they can continually grab more information rather than secure it?
I for one am shocked, absolutely shocked.
Yes, except they’re not leveraging your data for advertising, they’re leveraging it so they can manipulate your political views and keep you from finding solidarity with other working people.
@FlyingCircus @technology These two things are the same thing
15 years ago I’d have called this a conspiracy theory given how the evidence seems to be anecdotal, but given literally every single other thing we’ve learned in recent times about how cartoonishly evil and lying the tech bros truly are, it seems entirely likely.
s/the tech bros/humans/
Despite “the tech bros” really being that, I’m learning over time about some people surprisingly cowardly and evil, while looking like better versions of me, and some other people looking pretty normal and usual, while being epic and tragic heroes, and some other people looking like a typical Nazi 80 years late to the party, yet more honorable than many, and some other people looking like weak and nice versions of me, while having real warrior spirit.
You have no idea how big the world is in all dimensions. We are all looking at it via our daily interactions, via news and internet discussions, via games and via books, and we don’t see what’s deep inside. Well, I suppose, people who read classics can see something.
And they, these people on top of big tech, being just human, have such powers. What can they do with them? Perhaps we should forgive them for not being wise in deciding to have those powers, and praise them for doing less evil with them than they could.
So. Perhaps in 15 years you’ve just grown.
DUH
No if this is proven it would be a real scandal and would bring a lot of users to better alternatives.
If it’s false that’s good too, since then WA has e2e encryption
would bring a lot of users to better alternatives.
Most users of whatsapp don’t care about e2e. They hardly even know what it is.
Right. This place sometimes forget that we are tiny community of techies that hate the system. Makes me see this place as a bit of a circlejerk at times.
Yeah the venn diagram overlap of “people who understand and care about e2ee enough to drop a messaging app for not supporting it” and “people who use whatsapp” has to be a sliver
It must really be empty… Two contradictory assumptions lol
Not empty… It’s hard to embark all your family, relatives and friends on your journey to fucking basic privacy principles
deleted by creator
No but average people understand the concept of meta reading and accessing your private message. That would be a scandal and righly so
“Your messages are public and being read by silicon valley creeps”
That’s easy enough to understand.
They don’t know what e2e encryption is, but they sure as hell know what “employees have access to all your messages” means. Sure, it makes it harder for them to find a good alternative, but it will scare some away from Meta (unknown how many will actually care).
They don’t but they do know what “Any Meta employee, and every US government employees, can read all of your messages” means
Especially if they saw it now
True. But some would care about broken promises
It’s already a known risk, because WA uses centralized key management and servers, and always has regardless what Meta says. If you believe their bullshit, then I feel sad for you.
Also…you don’t think that LAWYERS willing to go up against Meta would have rock solid proof from these whistleblowers FIRST before filing a lawsuit?
C’mon now, buddy.
I’m surprised anyone is surprised. It’s been known since WhatsApp came out that it’s not true e2ee because meta holds your keys.
Well they did this whole stupid “rebranding” of it becoming e2e after Facebook bought them a few years back, but literally every security researchers was like “Nahhhh, pass”.
considering that you can decrypt facebook e2e encryption with a 6 digit security pin… yea Facebook at least has the private keys backed up server side.
I don’t use any Meta products, so not sure how you mean. If you are a user that has been sending e2e messages, then you can surely decrypt said messages if you’re a participant in those messages transactions.
So, with facebook if you lose your device, you can register a new device to the account and recover your messages using a 6 digit security pin or a recovery code.
This means that your messages are stored in decryptable format either via a private key being stored, or as a separate server encrypted form in a backup.
I just had to go through this with my grandfather a few months back.
Also…you don’t think that LAWYERS willing to go up against Meta would have rock solid proof from these whistleblowers FIRST before filing a lawsuit?
This is not how civil court works. It’s not trial by combat. There is no standard for the quality of lawsuits filed. And despite what the ambulance chasers say on TV, Layers get paid even when they loose.
“alleged in a lawsuit…” is the same level of credibility as “they out here saying…”.
It doesn’t matter if it’s criminal or civil. The costs to bring such a case are massive, and you’re leaving yourself open to a behemoth like Meta just dragging out the case for lengthy periods of time which drastically increase those costs.
No law firm files suit against a giant company like this unless they have rock solid proof they will, at the very least, land a settlement plus recuperation of costs. Just not a thing.
What do you want from me here?
Mark zuckerberg eats scandals for breakfast
Yes but Whatsapp has been pretty reliable and trustworthy for many people. No ads etc
If it’s false
How would we know?
we can’t lose!
People wouldnt move. They know its not secure and they dont care enough.
It would not. People don’t care. People don’t care that meta is an evil corp. Encryption is not even close to the top 10 reasons people use that app. It’s just a random word normal users throw around because marketing told them it’s good.
Normal users don’t talk about encryption at all but they somewhat trust WhatsApp
What are the better alternatives? because it seems like the comment section is flooded with people (yourself included) that don’t understand that most (probably all) e2e messaging apps are vulnerable to this attack as long as they trust a centralized server.
The issue isn’t an encryption one, it’s a trust one that requires you to trust the makers of the messaging app and the servers the apps connect to (and the method by which the app is distributed to you).
Signal uses reproducible builds for its Android client, and I think for desktop as well. That means it’s possible to verify that a particular Signal package is built from the open source Signal codebase. I don’t have to trust Signal because I can check or build it myself.
If I don’t have extreme security needs, I don’t even have to check. Signal has a high enough profile that I can be confident other people have checked, likely many other people who are more skilled at auditing cryptographic code than I am.
Trusting the server isn’t necessary because the encryption is applied by the sender’s client and removed by the recipient’s client.
likely many other people who are more skilled at auditing cryptographic code than I am
Maybe but that doesn’t mean you have the same app they do, Google may have different apks for people who could check it and for those who won’t.
There is a risk Google could tamper with the app for specific users if they’re installing it from Google Play. I think it’s likely security researchers would discover that if it was widespread, but there’s a chance Google could do it undetected if they targeted it selectively enough.
People who are concerned about this can download the APK directly from Signal and check its signature before installation.
Signal
You’re just replacing trust in Meta with trust in Signal Inc without understanding why WhatsApp is vulnerable to this.
Is Signal Inc more trustworthy than Meta? probably
is Signal (app) safe from the attack described? absolutely not.
Theoretically, you can check the code actually running on the Signal servers is the code they publish under a free and open source licence, using the hardware-based TEE attestations the servers will return
Someone more knowledgeable than me may have managed to do so, I haven’t.
Tell me you don’t understand how Signal’s E2E mechanism works without telling me you don’t understand how Signal’s E2E mechanism works.
Tell me you don’t understand what E2E encryption is without telling me you don’t understand that the limits of E2E encryption.
See every other comment in this thread describing in great detail why you are wrong, but that you fundamentally DO NOT UNDERSTAND how any of this works whatsoever.
You fundamentally DO NOT UNDERSTAND how security works, go play with your algorithms and stop spamming my replies.
Um, security is based largely on encryption algorithms.
This is key and I don’t think Signal shies away from this. You MUST trust the code you’re running. We know there are unofficial Signal builds. You must trust them. Why? Because think of it this way. You’re running a build of Signal, you type a messages. In code that text you type then gets run through Signal’s encryption. If you’re running a non-trustworthy build, they have access to the clear text before encryption, obviously. They can encrypt it twice, once with their key and once with yours, send it to a server, decrypt theirs and send yours on to it’s destination. (for example, there’s more ways than this).
The code can be okay but it’s delivery method(aka Google), the OS(aka Google) or the hardware can be compromised.
Just because it’s centralized doesn’t mean that it falls under this risk sector. Theoretically if the app was open sourced and was confirmed to not share your private key remotely on generation (or cross sign the key to allow a master key…), then the most the centralized server could know is your public key, the server wouldn’t have the ability to obtain the private key (which is what is needed to read the e2e encrypted messages)
This process would be repeated for the other party. The cool part of that system is you can still share your public keys via the centralized server, so you wouldn’t need to share the key externally. You just need to be able to confirm that the app itself doesn’t contain code to send your private key to the centralized server. Then checking integrity is as easy as messaging your friend to post what their public key is, and that public key would need to match the public key that the server is supplying as your contact.
The server can’t MiTM attack it because the server has no way of deciphering the message in the first place, so the most it could do is pass the message onto the proper party whom has the private key to be able to decrypt it.
Not that I have any other suggestions aside from signal though, there aren’t many centralized e2e chat services. Most use client to server encryption which would allow decryption server side.
Just because it’s centralized doesn’t mean that it falls under this risk sector.
The attack as described almost certainly involves the server sending a message to your client and then having the messages replicated via a side channel to Whatsapp without breaking E2E encryption (it could be adding them as a desktop client or adding them as a hidden participant in all chats, that isn’t clear in the article)
If you could run Whatsapp without connecting to Meta, you would be safe from this attack, but as you’ve pointed out a secure client is a better solution.
Fully agree that in this case if the claim is true (they have had a few of these claims), it’s likely whatsapp either making itself a companion app that’s hidden, or has some form of escrow in place to allow deciphering the messages. (Considering Messenger allows decrypting e2e chats with a 6 digit security pin, I’m leaning towards an escrow)
I was just mentioning that this isn’t a fault of it being centralized, this is a design choice by the company when implementing e2e encryption, and that a properly functioning system would never give the server the ability to decipher the messages in the first place.
What is your alternative? Everybody codes their own app??
Also you’re unhinged in these comments
People should understand the limits of E2E encryption.
I’d rather be unhinged than wrong.
deleted by creator
Element / matrix.
With e2e you don’t need to trust the servers. You only need to trust the client that does the encryption.
Should you not also trust your device hardware, it’s os and the market you got the app from?
That’s a given I think. If you can’t trust the OS then you can’t trust the client.
The attack as described almost certainly involves the server sending a message to your client and then having the messages replicated via a side channel to Whatsapp without breaking E2E encryption.
But yes the point is you can’t trust the clients.
If you could run Whatsapp without connecting to Meta, you would be safe from this attack, but as you’ve pointed out a secure client is a better solution.
Shocked, I tell you
That’s just another comment
You gatta be real stupid to not realize that Facebook is harvesting your data.
No surprised at all tbf.
I would argue that the vast majority of users don’t use WhatsApp for privacy. In the UK at least, it’s just the app everyone has and it works. I’ve actively tried to move friends over to signal, to limited success, but honestly it can be escaped how encryption is not it’s killer IP.
Yup. I use Whatsapp to text my girlfriend and my work uses it as a group chat for road conditions or just shit talking.
If you’re using it for secure purposes, you’re part of the problem.
The biggest news is that Slashdot is still alive.
+5 insightful
Assume the same for Telegram and pretty much any chat platform that controls your private keys.
Telegram doesnt even pretend to be end to end encrypted.
Telegram for iOS lets you create “secret chats” but as far as I know other platforms have eliminated that functionality at the request of governments. And I would assume Apple technically controls the keys on device.
iOS lets you create “secret chats”
How? Not natively unless I’m mistaken
Not natively that I know of, but Telegram for iOS has the option when looking at someone’s profile. However, the Windows client does not.
Ah I see your edit now, thanks (and see how it was assumed implied :) )
The telegram was clear as a day they announced cooperation with the Russian government and they unblocked it. That was way before the whole France fiasco, I doubt they’re actually giving up the keys to France. I’m from East and many say that Telegram now is essentially a Russian weapon. Surveillance at home, total free reign (sell drugs, spread CP, etc.) in west.
If you’re American, I believe Telegram is actually safer than Whatsapp, as long as you can ignore the dirty side of it (surface deep web?), hence why Europe wants it under control
