A 10-month Commerce Department probe concluded Meta could view all WhatsApp messages in unencrypted form
“The claim that WhatsApp can access people’s encrypted communications is patently false,” Meta spokesperson Andy Stone said. He added that the bureau had already “disavowed this purported investigation, calling its own employee’s allegations unsubstantiated.”
I can’t help but notice that in response to people’s concern that Meta may be able to read people’s messages, the Meta spokesperson responds that WhatsApp can’t read them. A little bit of administrative juggling on Meta’s end so that the team with access to the messages doesn’t fall within the WhatsApp department, and both claims could be true.
But Facebook/“Meta” would never lie.
Oopsie! Hang on, they even lie to lawmakers in case buying them off fails? Bummer!
Seriously: this company needs to be scoured from the face of the earth.
Mergers: Commission fines Facebook €110 million for providing misleading information about WhatsApp takeover - Brussels, 18 May 2017
Classic
Profit made from yet more abuse of user data: 500m EUR
Cost ofmisleadinglying to lawmakers: 110m EUR
Net profit: 390m EUR
“We got 'em good, boys! I’m sure they’re never going to try that again!”:’( poor general public
Yeah, there are lots of ways for this to be true but misleading:
The communications are not encrypted if they have the keys.
The encrypted communications are not the people’s. By the TOS everything is the property of WhatsApp and they can access their own ‘Business Records’ perfectly legally.
A third party, like a federal agency, isn’t WhatsApp. (WhatsApp can also voluntarily give their ‘Business Records’ to said agencies without warrant or subpoena.)
Meta isn’t WhatsApp.
An internal project with an undisclosed codename isn’t WhatsApp.
Nitpicking; even if they have the keys, the messages can be encrypted. It’s just worthless as they can now decrypt them.
Sure, when they say WhatsApp can’t access the encrypted messages they could mean that Meta/another internal group has access to the encrypted messages and they decrypt them in order to provide them to WhatsApp/whoever.
(Obviously, as someone pointed out, this is all assuming that he’s telling the truth in some legalistic way and not just flat out lying.)
My favorite option is that they don’t access the encrypted communications, they access messages before encryption takes place and send copies home for safe keeping. With a closed source client they can do anything they want to the plaintext even if they handle the ciphertext appropriately.
Yeah, that or either of the ends is compromised by one of the various commercial spyware which offers zero-click installation of their software or the person you’re talking to is intentionally recording the messages.
End-to-End encryption only protects you from someone eavesdropping on the communication on the line. It doesn’t secure the endpoints or make the participants trustworthy.
Which end is the encrypted end lmao
C’mon. It’s not that hard. You’re making the assumption that Andy Stone is telling the truth, with a gotchya astrict.
What if…the big business just…LIES???
a gotchya astrict
Asterisk? This little fella? *
Nah, probably meant the other little fella - Asterix the Gaul.
Then they might get in trouble for false advertising.
In what world do you live where billionsires face actual consequences?
Worst case scenario, Meta pays a small fine, and doesn’t even blink. The day just goes on.
I mean yeah, but they’d usually not pay even a small fine (or pay for legal proceedings), so it’s a lot more efficient to use conveniently placed loopholes.
GDPR has entered the chat
…assuming the EU representatives have some balls
Let’s hope!!
The best lies have some kind of truth in them. Half truths are way more effective than complete falsehoods.
It’s likely the cloud backups they can read. Encrypted archives are hard to sync across devices while still keeping the same level of security. I always advise against it if you don’t have a good reason to do it.
It’s also all but confirmed that they use on-device keyword recognition for targeted advertising. So if the app can phone home for some keywords, then it can phone home for anything.
Are you telling me that the company that hosts “free” not propaganda services and has been caught repeatedly stealing all possible data including data about women and presumably girls’ periods and has been caught in one of the largest data manipulation scandals this century could be betraying my trust with their “vawwy vawwy pwivate and vawwy vawwy encwypted” closed source and again operated by the most sinister motherfuckers of all time messaging app???
I. Am. Shocked.
I’m also looking for a bridge on the cheap if you guys have any leads.
If you think ANYTHING owned by FB is “secure” you had this coming
They own the (closed source) app, which has full access to your decrypted messages. The messages might be e2ee in transit, but they must be decrypted for you to read. This means that they also have access to them in this state, the same as you, and there is nothing preventing them from resending those decrypted messages back to their servers while you send them (before they encrypt) or after your receive them (after they decrypt).
Didn’t read the article, but maybe a back door to spy on people?
The fact that Trump’s own goon uses Signal and not WhatsApp should probably tell you all you need to know about using WhatsApp.
Yes, not to mention that their security breach on Signal was of their own making. Some moron invited a member of the press to their chat. XD
Settle down. There’s nothing to see here. Move along quietly and please remain calm… /s
The most important question to ask when evaluating end-to-end encryption: who manages the keys?
If Facebook manages all of the keys and is responsible for telling which public key belongs to who, then of course Facebook can read every message.
oh lol. the trust chain is harder and harder to verify these days. i miss the good old days where I would write emails in vi and encrypt with gpg.
I still write emails with vi. but I lost touch with the one other friend I had who how to use gpg 😂😂😂
Cory Doctorow still uses pgp if you email him, I think his key is on his website, IIRC
There are dozens of us! Dozens!
Is there an ELI5, foolproof, step-by-step tutorial? I tried Kleopatra on my own and was so completely befuddled; why is that, like, literally the only app out there in the whole world for PGP or GPG or whatever? Shouldn’t there be dozens of such encoders?
It heavily depends in your usecase but if you want to use gpg to encrypt emails and dont want to do it all in the terminal i really recommend using Thunderbird it integrates gpg very well and makes it mostly seamless.
Other than that afaik Kleopatra is the only standalone GUI for gpg simply because most of the time gpg is integrated in workflows (simply using the cli interface vor gpg libraries) and plain gpg for simple tex/file encryption/signing is just not a usecase.many people have
even better - as far as I am aware the client isn’t open (and even if it were, is your installed build from the same source?).
so, even if the keys are local only, who says there isn’t a hidden API that simply sends locally decrypted content back to a remotely calling endpoint?
Or steganographically leaks back the keys …
thought it was proper e2e
https://signal.org/blog/whatsapp-complete/
but if whatsapp owns both ends, what is stopping them from just reading the decrypted text? i duno crypto good enough
That, and if WhatsApp has the keys, then no amount of encryption is going to help.
If I remember, the allegation was that they did keep all the keys and many employees could request them to decrypt specific sessions.
And here I thought the E2EE of Whatsapp was based on the one developed by Signal or at least so they say.
But I guess it’s hard to inspect anything, if it’s no open source software.
I’m so glad there’s SIgnal and a lot of my contacts use it.
Back when it was called Textsecure it was a different story.So that ad campaign that they ran saying no one but you can see your messages. That was a bit strange that they were pushing it, since no one appeared to be saying otherwise, might be a lie? I never would have guessed.
I work at Meta and interface with WhatsApp enough to know a couple things. First of all, data is encrypted at rest; that’s not even a WhatsApp thing, that’s literally how our infra works (it’s actually an efficiency thing, since deletions requires only deleting the key). So the “source” of the article saying
“Meta can and does view and store all the text messages, photographs, audio and video recordings” in an unencrypted format.
Is either lying or wrong.
Second of all, the encryption is legit. The only time “Meta employees” and “Contractors” are seeing your message content is when someone reports your message; because the person reporting it is sending a decrypted copy.
It may be true that there is some sort of device-level backdoor on your phone, or possibly that there’s a remote switch of some sort to send a second copy of the message in decrypted format for some targets, but I have not heard or seen this.
Fyi I use Signal and not WhatsApp, but in general I don’t think this article holds much weight
Well who creates the keys and who stores them? That’s all you need to have a back door.
The client does, AKA your phone
I dont believe you.
Ok
Just assume anything you’re writing online, on any app, any website, any social media platform… ANYTHING is being tracked now.
We learned from the FBI’s disclosure of the Guthrie kidnapping video that every camera and microphone are surveilling you and feeding that data into a government database without a warrant, so why would you think your apps are doing anything different?
If you still use faecebook products, you’re an idiot.
I guess you don’t live in Europe, you can’t escape it here.
I’m gonna borrow FaecesBook from you - that’s hilarious!
my brain automatically makes it faecesbook now. I’ve been saying it for a decade or more.
Here’s the original reporting, instead of another website’s summary of Bloomberg’s actual report:
So it sounds like the agent was investigating allegations, from content moderation contractors, that Meta could access the contents of WhatsApp messages, and came to the conclusion that yes, Meta could.
There are a few possibilities here.
- Meta does have full plain text access to all Whatsapp messages, but guards that access very closely. Although the clients seem to generate E2EE keys for each session, somehow they’re leaking those keys to Meta’s servers somewhere, and the closed source code sufficiently hides that so that there’s no whistleblower or security researcher able to detect this definitively.
- Meta has a secret wiretap functionality where they can compromise the E2EE keys somehow, but uses it only for narrow cases. This helps keep the functionality secret, because security researchers and other reviewers may never see the functionality in action.
- Meta allows users to report objectionable content in the threads they’re already part of. The reporting function either forwards the E2EE key itself, or all the plaintext data, that gives content moderators access to the underlying message contents. The contractor whistleblowers and the federal agent investigating these allegations simply got it wrong, and misunderstood the technical process of how the plaintext messages end up in the content moderator’s possession.
Meta claims that it’s #3. They acknowledge they have plaintext access to messages when a party to the thread presses the report button.
This unnamed federal agent believes it’s #1, after 10 months of investigation, and sent out an email to other investigators that they should look into that possibility.
I’m skeptical of #1, simply because I don’t believe that conspiracies to keep that kind of stuff secret can be maintained. It’s not just that there would be technically skilled whistleblowers who have actual access to the code (not the non-technical content moderator contractors who review the content), but a weakness in such an important and widely used protocol would attract all sorts of hackers, state sponsored or otherwise.
But option #2 might explain everything we’ve seen so far. Full wiretap capability that is rarely used and very tightly controlled.
Thanks for the sane interpretation of the situation!
It’s decided. No more arms deals on Whatsapp for this guy.
No. Shit.
People who say Facebook (now Meta) paid $21 billion (with a B) for WhatsApp to be charitable. Even though the original creators have distanced themselves from it after the acquisition.
Fun fact: every forum running phpBB, Invision, or vBulletin (as in, traditional Internet forums) can read your DMs in plaintext. They’re unencrypted in the SQL database. However, the forum’s Admin Control Panel (ACP) does not provide this functionality. All three have mods that add it in. So imagine you run a forum. You have a hidden forum where only your mods and admins can interact. No one else can even see it. You could have a whole other one that is just all the DMs. I’m not sure about social networks. But I know if you have command-line access to the SQL database, you can query a user and see everything that user has put in the database. Public messages… and private ones. So a lot of the forums started saying “Personal messages” or “Direct messages” instead of “Private messages” because they were never private.
Disbelieve anyone who says they can’t see your private or personal messages.
I can confirm this, I used to run several phpbb and (pirated) vbulletin juggalo forums and when I found out this was possible I read everyone’s DMs for funzies.
Lotttts of requests for noodz.
Since you are a self proclaimed professional, what percentage of nude requests were answered positively, and is it as close to zero as I expect?
Honestly, it often went over better than you’d think. A lot of lettes like showing of their tits, and would want to see dick (and sometimes butt hole) in return!
Turns out building a community primarily focused on gathering people who are even further outcasted from poor white trash lends itself to a serious lack of inhibition and disregard for taboo.
Pirated vBulletin. I sure didn’t have the sack for that. I figure, pirated software running on a server, especially if it’s not your hardware (and self hosting wasn’t an option for me back then) is kind of dangerous.
When I found out I could get at the DMs in an Invision board I was running for a minute, I made a post letting everyone know, and worked it into the thing you agree to when you sign up. I made it clear that I wasn’t good with SQL and it wasn’t easy to read them, but that I did have that access and to not use our DMs for anything you wouldn’t want someone to be able to see.
I assume most of the noods requests were from the juggaloes to the juggalettes exclusively? Or did it go both ways? Never cared much for ICP, though “The Amazing Jekyll Brothers” had some cool songs on it (“Everybody Rize,” “I Stab People,” “Mad Professor,” and maybe a couple others)… but the fandom? Absolutely wild. Even if I thought ICP straight up sucked, I’d have to admit the fandom is awesome.
I sorta recently (couple years ago) learned that some US states actually brand juggaloes a gang. Like it’s illegal to be one. That’s wild to me. I don’t think Deadheads ever got the same treatment, and, same thing, different genre.
When it was personal forums with low traffic mostly just for friends I never had any trouble, but the couple times I pirated vBulletin for larger, more popular sites, we’d get warning emails within a couple months and have to stop or face a lawsuit.
Honestly juggalos are, not unanimously, but more often than not, pretty sex-positive and severely lacking in shame or social inhibition, so the requests honestly went both ways, though typically initiated by the dudes.
Thanks for your kind words about my people 😊 - Yea, actually it was the FBI who decided to nationally declare us a “loosely organized hybrid-gang”, which is in some ways worse than just being classified as a gang, because it meant that all it took in some places, usually places with serious gang activity, was a bumper sticker or a t-shirt and you’d be assumed to be affiliated and thus severely harassed or arrested. Some people even temporarily lost custody of their kids over it.
It’s disgusting and baseless, and it never had any merit. There were some kids in Denver and other places with a big juggalo community and massive gang problem that decided to integrate juggalo culture and insignia into their local set, and for the FBI, that was enough. It’s like if, in the early 90s when Starter jackets started being used as gang symbols, if the FBI decided that anyone who was a Raiders fan was a fucking gang member. ICP tried to sue, with the help of the Michigan ACLU, and we even famously marched on Washington in 2014, but it never amounted to anything. To this day, in some areas, you can legally be removed from your life, thrown in jail, lose your job and your kids, put on a national gang member list, and be permanently labeled a felon just for owning a copy of Riddlebox.
I can’t see your private or personal messages.
