The case, led by a special agent in the Commerce Department's Bureau of Industry and Security, focused on claims that some Meta employees and contractors could access...
A 10-month Commerce Department probe concluded Meta could view all WhatsApp messages in unencrypted form
I’m just here to satisfy my confirmation bias, but my question all along has been this: how does Meta simultaneously satisfy their claims of both E2EE and content moderation on WhatsApp? I can’t say that I’ve done anything even close to a deep dive on the topic, but those two things seem mutually exclusive.
It’s really important for people to understand that E2EE cannot protect the message portions that aren’t between the ends themselves. The best encryption in the world can’t help you if the person you’re talking to is an undercover cop, because that “end” can do with the plaintext whatever they want, including record/store/forward the plaintext of any messages they then encrypt and send, or any messages they receive and then decrypt.
That’s not a flaw of the E2EE protocol itself, but is a limit to the scope of protection that E2EE provides.
Well, yeah, you can’t control other people. Even if you use a walkie-talkie, they can still record your voice with a device. Ideally you should only be talking about safely publishable content, or with mature-enough individuals. We ultimately must settle for good-enough…
Any reported message ? Back when I was doing anti spam at my ISP we could read reported spam from our customers. Obviously not all mails from / to the customers. That would be way disproportionate.
If you report the message it then the full text gets sent to WhatsApp.
That means there’s a software switch that dumps a plaintext copy of a supposedly encrypted message when flipped.
Therefore, all you need to read any WhatsApp message is the ability to flag the message as “reported”, and access to wherever the plaintext copies get sent.
Considering how often security is an afterthought for corporations, the access part is probably easy.
That means there’s a software switch that dumps a plaintext copy of a supposedly encrypted message when flipped.
Kinda, sorta, but no, not really. What’s happening is that the recipient is decrypting the message. When you report the message, you include a cleartext copy with your report.
The “switch” you are talking about is in the same app that is doing the decryption. For the bad actor to toggle that “switch”, they would have to control the app.
For the bad actor to toggle that “switch”, they would have to control the app.
Are you talking about physical control? Regardless, it’s closed-source… There is nothing that says they can’t also generate the keys on the other end that they had your devices generate. Outside of open source code that’s buildable from source, they can claim whatever they want about lack of access to switches.
However, doing so would be perpetrating a fraud. If they denied the capability you’re talking about in response to a warrant or subpoena, someone would be in contempt.
I don’t know if any corpo actually cares about such things, but I know that if you or I were to do this, we’d quickly find ourselves broke and possibly in prison.
I’m just here to satisfy my confirmation bias, but my question all along has been this: how does Meta simultaneously satisfy their claims of both E2EE and content moderation on WhatsApp? I can’t say that I’ve done anything even close to a deep dive on the topic, but those two things seem mutually exclusive.
You can actually report a message to WhatsApp within the app. If you report the message it then the full text gets sent to WhatsApp.
That’s a little disingenuous…
When you send a message, no E2EE scheme can prevent your recipient from forwarding the decrypted message to a third party.
It’s really important for people to understand that E2EE cannot protect the message portions that aren’t between the ends themselves. The best encryption in the world can’t help you if the person you’re talking to is an undercover cop, because that “end” can do with the plaintext whatever they want, including record/store/forward the plaintext of any messages they then encrypt and send, or any messages they receive and then decrypt.
That’s not a flaw of the E2EE protocol itself, but is a limit to the scope of protection that E2EE provides.
Well, yeah, you can’t control other people. Even if you use a walkie-talkie, they can still record your voice with a device. Ideally you should only be talking about safely publishable content, or with mature-enough individuals. We ultimately must settle for good-enough…
So… anyone with access to the report API can read any message they want?
Any reported message ? Back when I was doing anti spam at my ISP we could read reported spam from our customers. Obviously not all mails from / to the customers. That would be way disproportionate.
If this is true:
That means there’s a software switch that dumps a plaintext copy of a supposedly encrypted message when flipped.
Therefore, all you need to read any WhatsApp message is the ability to flag the message as “reported”, and access to wherever the plaintext copies get sent.
Considering how often security is an afterthought for corporations, the access part is probably easy.
Kinda, sorta, but no, not really. What’s happening is that the recipient is decrypting the message. When you report the message, you include a cleartext copy with your report.
The “switch” you are talking about is in the same app that is doing the decryption. For the bad actor to toggle that “switch”, they would have to control the app.
Are you talking about physical control? Regardless, it’s closed-source… There is nothing that says they can’t also generate the keys on the other end that they had your devices generate. Outside of open source code that’s buildable from source, they can claim whatever they want about lack of access to switches.
Technically true.
However, doing so would be perpetrating a fraud. If they denied the capability you’re talking about in response to a warrant or subpoena, someone would be in contempt.
I don’t know if any corpo actually cares about such things, but I know that if you or I were to do this, we’d quickly find ourselves broke and possibly in prison.
But my point is that Meta is committing fraud against the public for advertising WhatsApp as E2EE when it’s not, as per this entire post…