[0] https://kieranhealy.org/blog/archives/2013/06/09/using-metad...
A friendly reminder to everyone that even if the encryption that is used to send the messages in WhatsApp seems to be solid they upload your entire chat history as unencrypted dumps to the cloud.
Even if you turn it off your chats will still end up there as long as whoever you are chatting with doesn't also disable this.
Can you provide more information?
For contrast, Signal does encrypt the local history and the backups (to the point that is a bit harder to backup the chat to outside in Android, you need to copy a randomly generate password manually to restore it. But it's a safe approach).
My point is mostly aimed at people claiming WhatsApp is somehow very safe just because of the end-to-end encryption.
I'm saying end-to-end encryption is a really great idea and everyone should do that and still encouraging people to look beyond that and think about the entire threat model when deciding what is important for them.
Correction: they might not have access to the message text. It's entirely possible (if not plausible: FB doesn't exactly have a good track record) for FB to just self-MitM the E2EE and see everything that passes through their servers.
From their site:
> The verification process is optional for end-to-end encrypted chats, and only used to confirm that the messages and calls you send are end-to-end encrypted.
Even this process--which I'm sure very few people do--is fallible given the lack of authenticity: there's no way to confirm that the given keys are what's actually used for encryption.
Yes, this may come across as very "tinfoil-hat-y," but do you really trust FB to not be exploring every possible avenue to increase their data streams?
Why would they even need to MitM in transit when they control the endpoints? They can just analyze the raw text locally (in the app) and extract valuable information.
And looking at what has unfolded in the last decade, chances are against the user and we must, for ours and our peers' safety, assume the worst.
Similarly Google runs 8.8.8.8 so they know what services you use that aren’t HTTP that they don’t have bugged already.
Just adding an example for the people who don't see the value of metadata: WhatsApp is still a viable revenue source for Facebook even as they have no access to the text of the messages due to E2EE.
Knowing who talks to who, at what times, the type and approximate size of messages, the members of groups, and the contents of the phone book of every user gives enough information to keep their business model without exposing them to court orders asking for the plaintext (that's the reason they added E2EE to start with, there is no incentive to improve the service when they have a billion heads of cattle to milk).