819
A federal agent said WhatsApp's encryption is a lie. Then the investigation was shut down (www.techspot.com)
submitted 5 months ago by to c/technology@lemmy.world
108 comments fedilink hide all child comments
 

A 10-month Commerce Department probe concluded Meta could view all WhatsApp messages in unencrypted form

you are viewing a single comment's thread
view the rest of the comments
[–] 26 points 5 months ago (15 children)

You can actually report a message to WhatsApp within the app. If you report the message it then the full text gets sent to WhatsApp.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 15 child comments
    •
  • [–] 12 points 5 months ago (2 children)

    That's a little disingenuous...

    1. You receive an encrypted message.
    2. You decrypt the message.
    3. You report the message.
    4. You forward the decrypted message.

    When you send a message, no E2EE scheme can prevent your recipient from forwarding the decrypted message to a third party.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 14 points 5 months ago

    It's really important for people to understand that E2EE cannot protect the message portions that aren't between the ends themselves. The best encryption in the world can't help you if the person you're talking to is an undercover cop, because that "end" can do with the plaintext whatever they want, including record/store/forward the plaintext of any messages they then encrypt and send, or any messages they receive and then decrypt.

    That's not a flaw of the E2EE protocol itself, but is a limit to the scope of protection that E2EE provides.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 5 months ago

    Well, yeah, you can't control other people. Even if you use a walkie-talkie, they can still record your voice with a device. Ideally you should only be talking about safely publishable content, or with mature-enough individuals. We ultimately must settle for good-enough...

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 5 months ago (11 children)

    So... anyone with access to the report API can read any message they want?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 3 points 5 months ago (10 children)

    Any reported message ? Back when I was doing anti spam at my ISP we could read reported spam from our customers. Obviously not all mails from / to the customers. That would be way disproportionate.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 7 points 5 months ago (9 children)

    If this is true:

    If you report the message it then the full text gets sent to WhatsApp.

    That means there's a software switch that dumps a plaintext copy of a supposedly encrypted message when flipped.

    Therefore, all you need to read any WhatsApp message is the ability to flag the message as "reported", and access to wherever the plaintext copies get sent.

    Considering how often security is an afterthought for corporations, the access part is probably easy.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 13 points 5 months ago (2 children)

    The easiest implementation of this is that the recipient of an infringing message flags it from its local client. At that point it’s not encrypted if their claim of e2ee is true.

    It also means that only parties involved in the message exchange can flag / report them.

    Corporations are often not so monolithic ; the guys doing abuse are likely not the one who try to milk users (looking at you marketing).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 5 months ago (1 child)

    I don't want to defend whatsapp, but if messages are actually properly end to end encrypted, but one of the recipients (one of the ends) knowingly shares it (e.g. with the report function), that is still end to end encryption.

    don't be surprised if signal or matrix implements this. I'm strongly against scanning messages, but if the recipient willfully decides so, they should be able to share a message with moderators. that would be an actual tool against actual pedophiles, and scammers.
    but this can only work safely if the client is not sending the decrypted message, because it could modify it, but instead it sends the decryption keys for it. both signal and matrix are regularly rotating the keys, so it wouldn't grant the moderators to read all messages, but it would grant them the ability to see what was actually sent. with that the client should also show how far into the past messages will be revealed to moderators, so they can decide if that's ok for them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 5 months ago (5 children)

    That means there’s a software switch that dumps a plaintext copy of a supposedly encrypted message when flipped.

    Kinda, sorta, but no, not really. What's happening is that the recipient is decrypting the message. When you report the message, you include a cleartext copy with your report.

    The "switch" you are talking about is in the same app that is doing the decryption. For the bad actor to toggle that "switch", they would have to control the app.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 5 months ago* (4 children)

    For the bad actor to toggle that "switch", they would have to control the app.

    Are you talking about physical control? Regardless, it's closed-source... There is nothing that says they can't also generate the keys on the other end that they had your devices generate. Outside of open source code that's buildable from source, they can claim whatever they want about lack of access to switches.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 5 months ago (3 children)

    Technically true.

    However, doing so would be perpetrating a fraud. If they denied the capability you're talking about in response to a warrant or subpoena, someone would be in contempt.

    I don't know if any corpo actually cares about such things, but I know that if you or I were to do this, we'd quickly find ourselves broke and possibly in prison.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 5 months ago (2 children)

    But my point is that Meta is committing fraud against the public for advertising WhatsApp as E2EE when it's not, as per this entire post...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 5 months ago (1 child)

    There is no indication that they can actually acquire the clear text of an E2EE communicatiom. without one of the ends being complicit in the process. There is no evidence of the fraud you refer to.

    That doesn't mean they are telling the truth, merely that they haven't been proven to have lied. They could release their source code tomorrow. That code could prove you are correct and they are liars. That code could prove that they are correct, and you were wrong.

    We don't have to resort to unfounded claims to justify criticism here. Proving their claims to be unverifiable is more damning than failing to prove they are committing fraud.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •