Lawsuit Alleges That WhatsApp Has No End-to-End Encryption - Slashdot
it.slashdot.org
Longtime Slashdot reader schwit1 shares a report from PCMag: A lawsuit claims that WhatsApp's end-to-end encryption is a sham, and is demanding damages, but the app's parent company, Meta, calls the claims "false and absurd." The lawsuit was filed in a San Francisco US district court on Friday and c...

As evidence, the lawsuit cites unnamed “courageous whistleblowers” who allege that WhatsApp and Meta employees can request to view a user’s messages through a simple process, thus bypassing the app’s end-to-end encryption. “A worker need only send a ‘task’ (i.e., request via Meta’s internal system) to a Meta engineer with an explanation that they need access to WhatsApp messages for their job,” the lawsuit claims. “The Meta engineering team will then grant access – often without any scrutiny at all – and the worker’s workstation will then have a new window or widget available that can pull up any WhatsApp user’s messages based on the user’s User ID number, which is unique to a user but identical across all Meta products.”

“Once the Meta worker has this access, they can read users’ messages by opening the widget; no separate decryption step is required,” the 51-page complaint adds. “The WhatsApp messages appear in widgets commingled with widgets containing messages from unencrypted sources. Messages appear almost as soon as they are communicated – essentially, in real-time. Moreover, access is unlimited in temporal scope, with Meta workers able to access messages from the time users first activated their accounts, including those messages users believe they have deleted.” The lawsuit does not provide any technical details to back up the rather sensational claims.

  • CeeBee_Eh@lemmy.worldEnglish
    68·
    18 hours ago

    Any claims around E2EE is pointless, since it’s impossible to verify.

    This is objectively false. Reverse engineering is a thing, as is packet inspection.

    • snowboardbumvt@lemmy.worldEnglish
      4·
      17 hours ago

      Reverse engineering is theoretically possible, but often very difficult in practice.

      I’m not enough of an expert in cryptography to know for sure if packet inspection would allow you to tell if a ciphertext could be decrypted by a second “back door” key. My gut says it’s not possible, but I’d be happy to be proven wrong.

      • black0ut@pawb.socialEnglish
        4·
        15 hours ago

        Hell, as far as I know, E2EE would be indistinguishable from client to server encryption, where the server can read everything without the need for a secret “backdoor key”. You can see that the channel is encrypted, but you can’t know who has the other key.

        • herseycokguzelolacak@lemmy.mlEnglish
          1·
          10 hours ago

          The easiest way to break E2EE is to copy your private key to Meta’s servers. It’s very easy to implement, and close to impossible to detect.

    • Sinthesis@lemmy.todayEnglish
      2·
      16 hours ago

      Now you just need Meta to allow you on their networks to inspect packets and reverse engineer their servers because as far as I know, WhatsApp messages are not P2P.

      /edit I betcha $5 that the connection from client to server is TLS(https), good luck decrypting that to see what its payload is.

      • CeeBee_Eh@lemmy.worldEnglish
        21·
        16 hours ago

        It isn’t. Otherwise security research would never happen for proprietary software and services.

        • Dr. Moose@lemmy.worldEnglish
          1·
          6 hours ago

          In the US, CFAA is so draconian that in certain aspects it can be very illegal to reverse engineer code behind explicit ToS which whatsapp make you agree through click-wrap agreement (meaning explicit I agree button press) upon installing the app. So Meta could easily sue you with very good chance of winning. I work in security and reverse engineer a lot of stuff but just because my company has lawyers that will protect me (also I’m not an american) but generally americans are super fucked here and there are many stories of people being sued and even imprisoned for breaking ToS.