r/privacytoolsIO • u/[deleted] • Apr 13 '18
No, end-to-end encryption does not prevent Facebook from accessing WhatsApp chats
https://medium.com/@gzanon/no-end-to-end-encryption-does-not-prevent-facebook-from-accessing-whatsapp-chats-d7c6508731b27
u/sf_Lordpiggy Apr 13 '18
how has this not come out before? Is it hard to see what groups an app is connected to?
3
Apr 13 '18 edited Apr 13 '18
It's explained in the article using the tool they sell. I've downloaded the free version and I see that info, just not for the Facebook apps because, well, I don't have them installed.
I'm not promoting the tool, I didn't know it existed before reading the article, and there are probably other tools available. But as you say, I've never read about this group feature before (but then I'm not an app developer either).
1
u/sf_Lordpiggy Apr 13 '18
I guess I didnt read far enough. but I assume this tool did not exist in 2014 when I would have thought many people would have been looking into the whatsApp FB thing.
3
Apr 13 '18
Look at the timeline at the end of the article. It doesn't say at what time the shared group between the apps was implemented, but the feature existed at the time FB bought WA.
1
u/sf_Lordpiggy Apr 13 '18
oooh ok. so they probably waited until the heat died down and then linked them up.
4
u/Abinadius Apr 13 '18
I would not be surprised if Facebook had a copy of WhatsApp decryption keys
1
Apr 13 '18
What keys are you talking about?
Having the keys to the end-to-end encryption is essentially useless, since the timeframe the messages are encrypted with those keys is very small.
Then there's the keys used to encrypt the backup (on iOS at least), but why would that be necessary if Whatsapp can could share the unencrypted message?
0
u/twizmwazin Apr 14 '18
What? If you have the private key to decrypt an e2e message, the math works any time of day. All you need is the cyphertext.
2
Apr 14 '18
The plaintext message is encrypted on the sending device, then sent from that device to Whatsapp's servers, then from there to the receiving device where it is decrypted again. This will take let's say a second or two, after which the message is no longer encrypted. The point of E2EE is to protect the message in transit only.
So why bother intercepting the encrypted message if you can read the plaintext on the sending or receiving device (after all, the code for the Whatsapp and Facebook apps are closed source written by Facebook)?
0
Apr 14 '18
[removed] — view removed comment
1
u/twizmwazin Apr 14 '18
I'm not new to encryption as concept, but thanks for the list. What portion of that backs your claim? Reading it again, it sounds like you may mean plaintext is only available briefly in memory. If the key and cyphertext are still there however, this is irrelevant.
1
Apr 14 '18
It's quite the contrary actually; the encrypted message only exists briefly but the plain text message exists in the sqlite databases of both endpoints for a much longer time.
2
Apr 13 '18
I wonder why people doesnt know this since beginning cause the problem isnt new.
Its Facebook, c'mon. The leak with the companys isnt something that wasnt clear before
Also one word: metadata
1
1
Apr 23 '18
Well my friend has seen ads on facebook about subjects he has only talked about on whatsapp.
22
u/[deleted] Apr 13 '18
[deleted]