Lawsuit Alleges That WhatsApp Has No End-to-End Encryption - Slashdot
it.slashdot.org
Longtime Slashdot reader schwit1 shares a report from PCMag: A lawsuit claims that WhatsApp's end-to-end encryption is a sham, and is demanding damages, but the app's parent company, Meta, calls the claims "false and absurd." The lawsuit was filed in a San Francisco US district court on Friday and c...

As evidence, the lawsuit cites unnamed “courageous whistleblowers” who allege that WhatsApp and Meta employees can request to view a user’s messages through a simple process, thus bypassing the app’s end-to-end encryption. “A worker need only send a ‘task’ (i.e., request via Meta’s internal system) to a Meta engineer with an explanation that they need access to WhatsApp messages for their job,” the lawsuit claims. “The Meta engineering team will then grant access – often without any scrutiny at all – and the worker’s workstation will then have a new window or widget available that can pull up any WhatsApp user’s messages based on the user’s User ID number, which is unique to a user but identical across all Meta products.”

“Once the Meta worker has this access, they can read users’ messages by opening the widget; no separate decryption step is required,” the 51-page complaint adds. “The WhatsApp messages appear in widgets commingled with widgets containing messages from unencrypted sources. Messages appear almost as soon as they are communicated – essentially, in real-time. Moreover, access is unlimited in temporal scope, with Meta workers able to access messages from the time users first activated their accounts, including those messages users believe they have deleted.” The lawsuit does not provide any technical details to back up the rather sensational claims.

    • sexy_peach@feddit.orgEnglish
      0·
      1 month ago

      No if this is proven it would be a real scandal and would bring a lot of users to better alternatives.

      If it’s false that’s good too, since then WA has e2e encryption

      • MrSoup@lemmy.zipEnglish
        0·
        1 month ago

        would bring a lot of users to better alternatives.

        Most users of whatsapp don’t care about e2e. They hardly even know what it is.

  • Rusty@lemmy.caEnglish
    0·
    1 month ago

    If I am not adding my own private key to the app, like in Tox, I don’t trust their encryption.

    • wallabra@lemmy.eco.brEnglish
      0·
      1 month ago

      Tox also isn’t that great security wise. It’s hard to beat Signal when it comes to security messengers. And Signal is open source so, if it did anything weird with private keys, everyone would know

      • Tanoh@lemmy.worldEnglish
        0·
        1 month ago

        And Signal is open source so, if it did anything weird with private keys, everyone would know

        Well, no. At least not by default as you are running a compiled version of it. Someone could inject code you don’t know anything about before compilation that for example leaked your keys.

        One way to be more confident no one has, would be to have predictable builds that you can recreate and then compare the file fingerprints. But I do not think that is possible, at least on android, as google holds they signature keys to apps.

        • wallabra@lemmy.eco.brEnglish
          1·
          19 hours ago

          Being prebuilt isn’t the same as open source! By that metric Linux is closed source because 99.9% of Linux users don’t build their own kernels (and those that do ought to shower anyway).