News for hackers. Stuff that matters.
Re:Show HN: A journaling service that runs over WhatsApp by meiraleal on Monday September 23, 2024 @01:06PM (#41628223)
They also handle and store users backup unencrypted by default so they have access to all messages in plaintext in multiple opportunities.
Re:Show HN: A journaling service that runs over WhatsApp by ylk on Monday September 23, 2024 @05:11PM (#41630599)
Meta has access to the backups that are stored on each individual’s Google Drive/iCloud? How does that work exactly? Please elaborate.
Re:Show HN: A journaling service that runs over WhatsApp by meiraleal on Tuesday September 24, 2024 @07:55AM (#41635565)
> Meta has access to the backups that are stored on each individual’s Google Drive/iCloud?

Why the surprise?

Meta has access to the folder it manages in the user's Google Drive. That's obvious, otherwise they wouldn't be able to write to it.

Re:Show HN: A journaling service that runs over WhatsApp by ylk on Tuesday September 24, 2024 @11:19AM (#41637480)
The app uses the (i)phone OS’s cloud storage APIs to write to the backup folder, meta’s servers don’t have access to any credentials. For Android I currently can’t check, but it’s obvious from their FAQs that they have the app upload to Google‘s servers even if they don’t use the OS APIs there: https://faq.whatsapp.com/481135090640375/?cms_platform=andro...

They have indirect control over the user’s backup folder via the app, but meta would need to distribute a malicious update to everyone that causes the user’s apps to download the backup and send it to meta, at which point they could just skip trying to access the backup and directly upload the chats from the app.

It’s impressive how much misinfo you’re spreading.

Edit: Meta’s actions over the years clearly show that they don’t want to know the contents of your messages. Not knowing their contents means, for example, that they don’t have to run scanners to detect illegal content (but users can report messages). They benefit from making WhatsApp a secure platform, as it allows them to collect everyone’s metadata, which apparently has lots of value to them.

Re:Show HN: A journaling service that runs over WhatsApp by meiraleal on Wednesday September 25, 2024 @07:35AM (#41646160)
> but it’s obvious from their FAQs

Haha. That's a great proof! Not the closed source, not the proprietary protocol they use to talk with their server, but their FAQ.

> They have indirect control over the user’s backup folder via the app, but meta would need to distribute a malicious update to everyone

Please give us the results of your research when you reverse-engineered Meta's apk to prove your point as this is what you think others should do. Otherwise it is just big talk.