WhatsApp - Can they read messages?

Scatterbrain

I have long believed WhatsApp (Meta) can READ message content, for messages via WA. I was told (by other GrapheneOS users) that’s why they paid 20Billion for WA in the first place, as the ad revenue from knowing what people are talking about is potentially huge.

But I asked AI and it is adamant that Meta do not and CAN NOT actually read message content. Only metadata which, when correlated with most people’s FB account activity (i dont have a FB account) and their browsing habits, can be almost as good as actually reading message content.

Is it true that, if I were to start using WA (for work, someone asked me to install it and I hate the prospect of that but may have no choice soon) - Only the metadata is collected, and the actual content of messages is not and can not be read or therefore collect/stored?

Thanks

gristle-cause

WhatsApp was just sued this week by a whistleblower alleging the company had violated their privacy policy & could indeed read messages.

The class action complaint includes detailed allegations, but no evidence yet. This likely won't be disclosed until the case goes to trial

We will have to wait until this whistleblower makes their evidence public to learn the truth. As of now, there is no public evidence that WhatsApp can/does read your messages, though I wouldn't be surprised to learn they do

Scatterbrain ...But I asked AI...

Do not 'consult AI' and bring it's 'findings' to a public forum. Youve now contributed to the growing dead internet - one for bots & AI content, not humans

Watermelon

Scatterbrain I wrote a post about WhatsApp including some of its major issues here, along with tips:
https://discuss.grapheneos.org/d/29977-privacy-in-the-messenger/23
I didn't mention all of WhatsApp's issues. For example, some of the posts above mentioned the reporting function inside WhatsApp, which is another privacy-violating function, that I believe is way worse design-wise than the ability to copy and forward messages.

(other8026 I tend to think of WhatsApp's major issues as “backdoors” because they're major intentional security/privacy issues, even though they're not hidden. I don't remember calling them “backdoors” here previously, but I might call them that in the future, because I believe it falls under the definition as I said. The good thing is that no conspiracy theories are needed, the security design of WhatsApp is publicly known, and they don't need a secret “backdoor” with all of these major issues existing already.)

Winston

I think you'll be okay to download and use WhatsApp without worrying too much.

Keep your threat model in mind; as of now, you probably aren't someone who's life or freedom would be compromised by using whatsapp (also considering the way you plan to use it (privacy-conscious)). However just keep your concerns in the back of your mind so if that changes, then use a more secure app that is better suited for the purpose. Remember you can use permission Scopes. Another way to look at it is: this is your normie persona using whatsapp.

Regarding the 20 billion acquisition, that couldve just been meta overpaying in order to control a potentially very 'dangerous' future competitor, plus they could use it for other future things of their own without developing and marketing startup costs etc. (Aka, all the reasons AI gave you are probably legit).

My thoughts: I personally doubt whatsapp is reading your messages, would be a huge PR risk which threatens their $$ which is the ultimate sin, but act as if they can to a degree (messages stored, backdoor, etc) without being paranoid to the point of it hurting your life (this is your normie persona).

Scatterbrain

Appreciate your reply but I am just looking for a definitive answer (or as close to that as possible) on whether they do/can read messages. Or is it true that as it uses the signal protocol they actually CAN NOT do so. If so, I just have to consider metadata, THEN I can think about threat model and apply whatever measures to mitigate the metadata aspect. but if I feel its extremely likely they can/do actually read messages (humans or AI/algorithm), then I will reconsider any use of WA.

xxx

Scatterbrain Or is it true that as it uses the signal protocol they actually CAN NOT do so.

It is all about the keys.
They can read the messages if they have the private keys too.
And i think the backup is not encrypted (or they backup the keys too).

Personally I don' t trust meta at all.

Winston

Scatterbrain well you're not going to get a definitive answer. Any answer you get will take you to threat model, so your THEN is NOW.

secrec

Scatterbrain Appreciate your reply but I am just looking for a definitive answer (or as close to that as possible) on whether they do/can read messages. Or is it true that as it uses the signal protocol they actually CAN NOT do so. If so, I just have to consider metadata, THEN I can think about threat model and apply whatever measures to mitigate the metadata aspect. but if I feel its extremely likely they can/do actually read messages (humans or AI/algorithm), then I will reconsider any use of WA.

So the first question: DO they read messages? Can't answer that, insufficient data available to determine.

Second question: CAN they read messages? Most definitely YES THEY CAN. It doesn't even matter how perfect the encryption is between THEIR APPLICATION (on your device) and THEIR APPLICATION (on somebody else's device). The fact is that the encryption is applied by THEIR APPLICATION, so if they want to read unencrypted messages, they just need to hook into the messages prior to applying the encryption or decryption.

Side to the second question: CAN they read messages ELSEWHERE beside from the application installed on your or your contact's devices? Do you trust that they don't have a copy of the cryptographic keys? Those keys are generated by THEIR APPLICATION, so they might even share those keys with THEIR SERVERS, in which case, they'd be able to decrypt ANYTHING that is passed through their servers. Using "signal protocol" means/changes nothing. He who has the keys can read the messages. Unless they've compromised the encryption, in which case maybe they can even read the messages withOUT the keys.

Now in considering my answer to question 2 or side-2...... keep the answer to question 1 in mind. Just because something CAN be done doesn't mean that it IS being done. The rest comes down to how much you trust them.

xxx

hnn8 By default they are unencrypted in the Google/Apple Clouds.

xxx And i think the backup is not encrypted (or they backup the keys too).

So the data leaks there.

Scatterbrain

Winston

That's your opinion. Thanks for it, you may well be right. But I was hoping I MAY actually get a definitive answer. Someone may know of an admission, proof, study, research which shows definitively that they can/have/do read messages somehow. I know of many people who use it and say they see ads on their facebook feed after discussing that subject via WA, but that's not definitive by any means, although it does warrant concern.

I thought I'd ask in case someone can give me that answer. if they can't, I agree, I just have to makek a decision at that point based on threat model. I don't feel certain I am at that point just yet.

VehicularClatter298

Scatterbrain
I'll try answering.
The main discussion points on whether WhatsApp can or can't read your messages, which haven't been mentioned yet, are that:

they claim to use the Signal protocol to encrypt the messages end-to-end (more on this below).
the app is closed source.

The latter means that you won't know much about what the app is actually doing. The main concern is, it might have a backdoor: that is, it might as well be sending the encryption keys to Meta's servers.
Open source apps like Signal, in turn, release their source code, and it can thus be verified - by looking at the code - that the encryption keys are stored locally and never sent anywhere.

About the Signal protocol: released in 2013, it was adopted by WhatsApp in 2016 (check out this post on the Signal website). Also, their implementation of the protocol likely isn't quantum-resistant yet (Signal upgraded the X3DH specification in 2023 to be quantum resistant; it's now called PQXDH - see this post).

Scatterbrain

gristle-cause

And just on cue...

Thank you, that is a very useful post.

AI - Steady on. I DETEST AI. And I am SO sick of people saying 'just ask AI', or worse, quoting AI as if it's their own answer. I didn't quote anything, I merely mentioned that I had used it (partly to avoid the idiots who suggest asking AI!). I have done as much proper research as I could in a few hours, and FINALLY asked AI by giving it my position (which is basically yours above) and asking for it to find any evidence of my suspicion that they can/do read messages for marketing purposes (at least). The 'findings' I 'brought' were identical to opinions of people I have asked before, so I couild have just said 'my buddy thinks...'. AI is, in my view, the end of the effing world. But not because of this comment on WhatsApp, because of how people use/rely on it and trust it. Note I didn't trust it, nor quote it, nor believe it out of hand. :). In fact I distrusted it and came to ask humans instead, if there is a proper use of AI, that would be it in my opinion. Not to say I think there is a proper use of AI, I wish it would disappear yesterday.

I personally believe (mainly due to automatic distrust which is evidence-based) that they can read messages. For example, if the 'feds' came along with some 'terrorism' suspect, I struggle to believe they CAN NOT access message content. It's possible, but I struggle to believe it. I hoped there would be some evidence to either change my opinion, or support it. I know Meta is practically the intelligence arm of many western governments now (I said I 'know', that was a carefully-chosen word). I struggle to believe they can do what (I know) they can do (intelligence wise) through just metadata, but maybe they can.

Thanks again. I will keep an eye on that thread and maybe some progress will happen before I am forced to make a decision either way.

gristle-cause

Scatterbrain

On AI: Reasonable. I largely dont have a problem using it as a search engine, but discussion like this needs evidence. Include a few links to the sources you found in your research, otherwise it does sound as though AI was your singular source

On WhatsApp: also reasonable. I largely share your beliefs. Until we find evidence to back that up, we are both conspiracy theorists. I generally avoid big tech on a basis of trust, but do regularly try to compare my threat model against the body of evidence to ensure my mitigations are reasonable

VehicularClatter298

VehicularClatter298
Also - it must be noted - even if the app were to store the keys only locally, two main risk profiles remain (both mentioned in this ArsTechnica article):

detailed metadata, tied to the user, is available to Meta
in Whatsapp's "end-to-end", either "end" can be a new beginning: moderation mechanisms are already in place that allow the recipients to flag messages, which are then sent to Meta and analyzed.

From here on, we can only make guesses. Moderation mechanisms wouldn't be hard to extend; and Meta has such a bad record when it comes to privacy and collaborating with the US government, that it would make sense to start shifting the burden of proof onto Meta to prove their app is trustworthy (as an user was pointing out here).

Now you can threat model.

secrec

VehicularClatter298 Open source apps like Signal, in turn, release their source code, and it can thus be verified - by looking at the code - that the encryption keys are stored locally and never sent anywhere.

Be careful about that. You can only verify the SOURCE CODE. Its not trivial to analyze someone's precompiled binaries, so the application someone may have installed from play store, even if its open source and very well audited, might not be only what you expect it to be. It could have hidden things added to it.

This is where services like F-Droid come in to offer you the upper hand; F-Droid is a 3rd party that takes the source code and compiles it themselves instead of relying on precompiled binaries supplied by the application developers, and includes source code archives matching the exact compiled binary that they supply. This provides you with a level of trust that the binary you are running is ACTUALLY the source code that has been audited without any extra surprises baked in.

Now if I remember correctly, Signal is not actually fully open source and contains some binary components that are closed source and needed actually for connecting with their servers.

Blastoidea

If you are in doubt, don’t use it.

xxx

Follow up:
https://www.heise.de/en/news/Class-action-lawsuit-WhatsApp-encryption-allegedly-ineffective-11156940.html
German:
https://www.heise.de/news/Sammelklage-WhatsApp-Verschluesselung-angeblich-unwirksam-11156854.html

Scatterbrain

secrec Excellently put thanks

Titan_M2

secrec CAN they read messages? Most definitely YES THEY CAN. It doesn't even matter how perfect the encryption is between THEIR APPLICATION (on your device) and THEIR APPLICATION (on somebody else's device).

This is a plain obvious statement that isn't helpful at all, Signal or any other app could do the same in principle, brain-to-brain encryption doesn't exist.

secrec Do you trust that they don't have a copy of the cryptographic keys? Those keys are generated by THEIR APPLICATION, so they might even share those keys with THEIR SERVERS, in which case, they'd be able to decrypt ANYTHING that is passed through their servers.

So where is proof that they share private keys with the server? It's been almost 10 years since the integration of the Signal Protocol, so far there has been zero evidence whatsoever that this is happening.

It's fine to be suspicious but claims must have a technical backing.

fph

secrec Signal already supports reproducible builds: https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds/README.md

VehicularClatter298

secrec

This is a bit off-topic, but may be useful for the sake of understanding the trust chain of open source Android software.

secrec the binary you are running is ACTUALLY the source code that has been audited

This involves trusting F-droid, of course, as the builds are mostly signed with their own keys.
To fully trust the binary to match the source you'd need reproducible builds. For example, Izzy's repo does a great work in that it ships APKs signed by the developers, while also checking for reproducibility.

secrec Signal is not actually fully open source and contains some binary components

As for Signal, you're right: anti-spam features are closed-source; and the Play store version includes proprietary blobs (Google Maps & Firebase cloud messaging, for maps and notifications). Forks like Molly ship without these.

That said: having to trust the proprietary blobs, versus having to trust an entire Meta app, is still a huge difference.

PS: I'd be glad to know more about the lawsuit that was mentioned.

Scatterbrain

CGG Interesting about the hacking/zeroday type risks. To be honest my only concern here (as in this thread) is whether Meta can/do read/store message content rather than just metadata. But it's certainly interesting to know it's unsecure in other ways.