If you enable backups in WhatsApp those backups aren't stored on Facebook's servers, but they are probably not encrypted very well, since you don't enter your own encryption key, and WhatsApp has to be able to decrypt those backups if you lose your device. So those probably aren't secure if you are directly targeted.
Also if you are directly targeted, it's not completely impossible that Facebook has a way to send you a custom "update" that simply sends all your messages to Facebook encrypted with their keys.
But in terms of mass surveillance, it seems fairly unlikely that Facebook can read WhatsApp messages, because something like that would not be hard to find for someone from the outside, especially since the protocol WhatsApp is supposed to use is completely known.
Facebook probably cares more about your meta-data (who has who in their address book) anyway than it cares about the content of your messages.
> My point is that security people need to get their priorities straight. The "threat model" section of a security paper resembles the script for a telenovela that was written by a paranoid schizophrenic: there are elaborate narratives and grand conspiracy theories, and there are heroes and villains with fantastic (yet oddly constrained) powers that necessitate a grinding battle of emotional and technical attrition. In the real world, threat models are much simpler (see Figure 1). Basically, you're either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you'll probably be fine if you pick a good password and don't respond to emails from [email protected]. If your adversary is the Mossad, YOU'RE GONNA DIE AND THERE'S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they're going to use a drone to replace your cellphone with a piece of uranium that's shaped like a cellphone, and when you die of tumors filled with tumors, they're going to hold a press conference and say "It wasn't us" as they wear t-shirts that say "IT WAS DEFINITELY US," and then they're going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// and two dollars will get you a bus ticket to nowhere. Also, SANTA CLAUS ISN'T REAL. When it rains, it pours.
As to benefiting from WhatsApp, I'm sure they benefited just fine. They bought it for the contact info from millions of non-Facebook customers that they could use to cross sell. Their growth in, for example, LatAm seems to imply that it worked ok.
> No, we don’t see any of the content in WhatsApp, it’s fully encrypted
It's clear he's speaking about his company. Given Snowden, it would be monumentally stupid to make such a bare faced lie to Congress if they were reading, or facilitating the ability to read, unencrypted content.
Especially as he could have chosen not to say anything so specific. Congressman Schatz was talking about advertising. He could have just said something innocuous like: we don't have the ability to use WhatsApp content for advertising.
What he also didn't say there was whether others routinely saw with Facebooks help.
Not saying they do, just saying he didn't strictly say they didn't.
He may of also being talking in the context of using content for advertising, not surveillance.
Finally a lot of intelligence gathering is just based on who has talked to who kind of networks in the first instance, rather than content because:
1. Content can be obfuscated, but not the connections
2. Easier to store and navigate
3. Less noise
I'm not suggesting that no-one can read them. I have no idea. I am saying that his testimony makes me very comfortable that Facebook is not because he has way more to lose from lying than from not in those circumstances.
I have trouble with this logic. Also, I'm not quite clear - what are the consequences for lying to Congress?
It would be pre-2013 naive to imagine that, now that WhatsApp traffic is no longer end-to-end encrypted, no use is being made of the change.
I'm sorry, what?
Is everyone intentionally ignoring this or actually unaware?
Things stored in plain text client side, can be read in plain text client side and resyndicated.
All this focus on the first transmission being encrypted while in flight and server side is just a bit negligent.
Its a system ripe for abuse and thats it.
Not wittingly.
WA has a lot to lose, and big enough target on it for a backdoor to have been found, if E2E is false.
> WhatsApp's end-to-end encryption is available when you and the people you message use our app.
Is that what you're referring to?
Like, how many people click on forwarded messages or pictures.
- who is communicating with whom,
- dates, times, and durations,
- method (text / voice / video),
- amount of data transferred,
- type of attachment if applicable, and
- location of each device,
along with unique device identifier, and perhaps other information.
See the Privacy International report[0] or video[1] on how much data FB glean from on other apps that merely use the Facebook SDK, each time an app that uses it it opened for a clue... how much more will they want from a service they paid billions for?
[0]: https://privacyinternational.org/report/2647/how-apps-androi...
[1]: https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...
Yes, like everyone says it's all about your threat model. If it really includes nation states, you should not use WhatsApp. Everyone else can use it for iMessage like functionality over-the-top.
This cryptography blog seems to, but... is WhatsApp really trusted as secure end-to-end encryption chat client?
Colloquially, for one thing it's now owned by one of the biggest personal-data collection companies in the world, which would have little interest in owning a chat client it couldn't benefit from data-wise. For another, I read an article mentioning it was "known" that WhatsApp decrypted your message, stored it, then resubmitted it encrypted to the destination. (Inconveniently, I can't seem to find the article now.) If, say, your life relied on privacy, would you trust WhatsApp, and if not, why?