News for hackers. Stuff that matters.
Re:Who else sees their deleted messages on WhatsApp that sho... by saurik on Tuesday October 05, 2021 @12:16AM (#28755448)
To map this to e-mail: if you receive an e-mail from me, and you delete it, but my e-mail infrastructure--the part on my end, not on your end--isn't sure I really sent it because the servers are flaking out and having tons of errors, and it retries the delivery, what would normally be an idempotent operation (because of how the e-mail you received twice will have the same message identifier) will cause the e-mail to re-appear... specifically because you have no record of having received it; and to make this even "cooler": if you use one of those dishonest "recall e-mail" features that people keep wishing existed (but not only can not should not), and the other side has already received both the e-mail and the recall, but the sender's SMTP server is still attempting to retry the messages, you will receive the e-mail, see it deleted, and then later see the e-mail again and see it deleted again. Is this really so hard to understanding? WhatsApp is nothing but an e2e event queue: it isn't a server that is storing data on your behalf... all of your messages are local to your phone, and with the exception of the shitty "delete for everyone" feature that WhatsApp implemented, your data is your data and the server knows nothing because it is just trying to deliver encrypted events on behalf of other people (who would, of course, own those queues, just like e-mail... but it is encrypted, so whatever weird mental model you have where this is somehow a bad thing terrifies me as to fix the weird issue you have would involve removing the encryption by adding permanent identifiers to queue objects that were visible to WhatsApp and then exposing to their server all of your otherwise-local message storage intentions).
Re:Who else sees their deleted messages on WhatsApp that sho... by proc0 on Tuesday October 05, 2021 @12:59AM (#28755634)
> your data is your data and the server knows nothing because it is just trying to deliver encrypted events on behalf of other people

Yes I'm sure that is the feature on paper. There's no way to know (unless there's a leak or something) but I'm willing to bet this isn't really the case and there are backdoor keys to this encryption, if anything to comply with whatever government wants, as has been the case with Apple and iPhone encryption in the past already.

The email model was just an example of how, in my opinion, it should be simple and straight forward. We're just talking about people sending text to other people, just like email. The only difference is on the client side, so how fast it happens and what kind of interface is presented with features to interact with the data. Ideally like owning your own email server, you would control not just the interface but the database with the data as well. This could mean some redundant messaging if the other server decides to send it again, but that isn't really a problem.