What a new lawsuit claims about WhatsApp’s end-to-end encryption | Proton

2 Likes

It’s important to distinguish between allegations and established facts. The complaint does not include technical evidence demonstrating a cryptographic backdoor or otherwise proving that WhatsApp’s encryption has been compromised. At this stage, the claims remain unproven.

That kinda kills it right there for me. Just claims with no evidence.

11 Likes

That’s definitely a clickbait title.

2 Likes

Can’t create a backdoor just for yourself without it becoming a huge juicy target for everyone else. I call BS.

1 Like

What a confusing lawsuit. At one point it says

As the whistleblowers here have explained

but there are no whistleblower testimonies or explanations offered. While I don’t trust Meta I see nothing presented to invalidate their claims of E2EE. Feels frivolous unless more evidence becomes available.

1 Like

There’s a decent discussion addressing this on r/privacy

From what I understand, Meta has gone to great length to articulate on the record that encryption has not been broken. The whistleblower alleges Meta does not need to break E2EE, as the messages can be accessed at rest. This comment is pretty informative:

36. As the whistleblowers here have explained, WhatsApp and Meta store and have unlimited access to WhatsApp encrypted communications, and the process for Meta workers to obtain that access is quite simple. A worker need only send a “task” i.e., request via Meta’s internal system) to a Meta engineer with an explanation that they need access to WhatsApp messages or their job. The Meta engineering team will then grant access—often without any scrutiny at all—and the worker’s workstation will then have a new window or widget available that can pull up any WhatsApp user’s messages based on the user’s User ID number, which is unique to a user but identical across all Meta products.

37. Once the Meta worker has this access, they can read users’ messages by opening the widget; no separate decryption step is required. The WhatsApp messages appear in widgets commingled with widgets containing messages from unencrypted sources. Messages appear almost as soon as they are communicated—essentially, in real-time. Moreover, access is unlimited in temporal scope, with Meta workers able to access messages from the time users first activated their accounts, including those messages users believe they have deleted.

2 Likes

Although Meta has kept the circle on its fraud small, it has not kept it small enough. It attempted to prevent dissemination of this information by heavily siloing workers in different groups and telling them to “stay in [their] lane” when and if they started to piece together the truth. As discussed below, Meta also actively misrepresented the facts about its access and storage when journalists came close to discovering the truth. Meta has also tried to prevent the truth from coming out by imposing onerous nondisclosure agreements on its workers, essentially threatening the full force of one of the world’s richest companies if any of these individuals dared reveal what goes on behind closed doors at the company. These efforts have now failed, but they worked for many, many years by obscuring the truth.

They need a literary agent more than they need an attorney, honestly

1 Like

Why is the burden of proof to prove that there is a backdoor? I’m not saying there is, but this is proprietary software from a highly untrustworthy company that regularly loses lawsuits for abusing user data? Why isn’t the burden of proof on Meta to prove there isn’t a backdoor? Of course they can’t prove that because it would require open sourcing their code in a way that allowed reproducible builds. It just rubs me the wrong way, this “there’s no proof" argument that is prevalent on this forum. It’s a massive double standard.

1 Like

I’m not super interested in this story, because the most likely answer is that WhatsApp is and has always been doing what I’ve said they’ve always been doing for years now lol

5 Likes

That’s just how US code of justice works. The plaintiff submits evidence of wrongdoing, the defendant attempts to dismiss those allegations. Innocent until proven guilty, even if the defendant is evil (often, especially)

1 Like

Yeah, but this isn’t a US court, this is a privacy forum.

When the mods are on here essentially defending Meta instead of asking Meta to prove they’re doing what they say they do, it makes me scratch my head.

1 Like

Because the party initiating the action must prove their claims? It would be insane to live in a world if the opposite were true.

5 Likes

This thread is a discussion about a US lawsuit

And ‘innocent until proven guilty’ is everyday philosophy. Otherwise we could make arbitrary accusations on a whim. Believing an accusation because we ‘feel’ it’s just is immoral and unreasonable. Extraordinary claims demand extraordinary evidence

I look forward to seeing this whistlebower’s evidence; I have not yet found any

3 Likes

You’re making the assumption that I don’t want meta to open source WhatsApp, of course I do that would be great. I think every messenger should be open source with reproducible builds so you can prove it’s not backdoored. I also think if you’re going to make claims that something is backdoored you should have evidence as well, both can be true. The attitude I see a lot more commonly is that everything made by a big tech company is automatically backdoored which I don’t think is a reasonable assumption. Closed source software can be analyzed still through the binary, security researchers are always analyzing these popular programs looking for vulnerabilities. I would think if WhatsApp wasn’t E2EE they would’ve found that out by now.

It’s worth noting that Signal actually helped WhatsApp implement their E2EE and disagrees that there’s a WhatsApp backdoor, although the blog posts are a bit old now.

1 Like

This is not a court. There are no repercussions for Meta if people on this forum question their continuously shady data practices. Therefore it is not insane to use their terrible reputation and repeatedly terrible behavior to inform whether something might be likely or not. Repeat, this is a privacy forum, not a US court. We do not need to uphold US burden of proof standards when discussing an issue on a forum. Continue to stan for Meta, and I’ll continue to scratch my head over why that’s happening on a privacy forum.

Are we to believe that no hostile intelligence agency made it worth their while, and that a bunch of nondisclosure agreements are all that’s holding this thing together? That’s why conspiracy theories are so hard to believe, even though some of them occasionally turn out to be true.

It’s a thread about a court case with far reaching implications if the claims are true, Meta’s reputation notwithstanding. I can think these claims are fictional while continuing to hate on its products and avoiding them for other reasons. Most people here are no fans of them either. But everyone should be interested in the truth

3 Likes

I think @fria has made it clear. Sometimes it might seem that maintaining a rational position implies supporting a demon like Meta, but I don’t believe that’s the case either. There’s no evidence yet, period. Going beyond that is mere irrational and conspiratorial speculation. And if evidence suddenly emerged tomorrow, I wouldn’t be surprised.

Personally, I find the position of the moderators commendable and exemplary. I don’t work in the technology world, so years ago I let myself be carried away by my ignorance and thought everything was “bugged.” But reading this forum and others equally or more technical, I realize that we must trust the evidence, as well as the technologies and technical methodologies.

Moreover, conspiracy theories lead to inaction. Following these chains of reasoning, one can end up deducing that any mobile device or computer is compromised (Pixel phones with GrapheneOS included).

6 Likes

Theyre not stanning for Meta lol. Wanting evidence that there’s a backdoor does not mean they are defending Meta. It means they are demanding a reason to believe that there’s a backdoor. Meta’s privacy-invasive history can of course be a reason to believe such a thing. It’s the reason why I and pretty much everyone here does not use WhatsApp. But that reason is not enough to spread it around the internet as a factual statement, that there is “in fact” and without-a-doubt a (kleptographic) backdoor.

3 Likes