undefined | Better HN

0 pointsAachen0y ago0 comments

You think they (plan to) decrypt messages and then upload them again in plain text to a server?

Since on-device processing is neither as objectionable nor could be very large

I don't use WhatsApp myself because of who runs it and there are plenty of better options out there, so I certainly agree with the sentiment of steering clear, but this claim does seem pretty far out there

0 comments

worldsavior0y ago

They don't plan it because they have no use for it. They only care about the metadata. When you talked to this person; your wife; at what time of day; was it at night; how long is the message; was there a product mentioned in the message; was the message about sports; etc.

berkes0y ago

They don't plan it, because so far, they don't have the keys to do so.

We do need to trust Meta that they really don't, to some extent, but people way smarter than me have researched the WA implementation of the Signal protocol and it seems solid. I.E: Meta appears to simply be unable to read what you chat and send. (but TBC: they do see with whom and when you do this, just not the contents).

yonatan80700y ago

What prevents them from simply pushing an update that quietly uploads private keys or unencrypted messages to their servers

Presumably they use proper HTTPS, so all the data is essentially encrypted twice, if they just concatenate some packets with keys, it would be extremely difficult to detect as you'd need to decrypt HTTPS (which is possible if you can install your own certificates on a device), then dig through random message data to find a random value you don't even know.

2 more replies

worldsavior0y ago

They don't have the keys, but they probably can get them.

1 more reply

j / k navigate · click thread line to collapse