186
Meta Is Being Sued Over Whether WhatsApp Really Encrypts Your Messages (lifehacker.com)
submitted 9 months ago by to c/privacy@programming.dev
21 comments fedilink hide all child comments
 

An international group of plaintiffs is suing Meta, alleging that WhatsApp's end-to-end encryption isn't actually private. Lawyers are asking the court to certify a class-action.

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 9 months ago* (3 children)

if they can read the messages then its not strictly speaking e2ee

Yes, it can absolutely still be E2EE: the message is encrypted and the central server does not have the key. The issue is that the clients (i.e. the "E"s) are controlled by the same entity as the central server, and we don't know exactly what the client (app) is doing. So the fact that it's E2EE is somewhat moot.

This is exhibit #1 in the case for open-source software.

PS: you obviously get this, I'm just trying to make it clearer for anyone who doesn't.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 6 points 9 months ago* (2 children)

    can read the messages

    Its about their ability to read the message, not the encryption. If anyone else other than the intended recipient, be it Meta or Google or the government, can read the message, then its not "end to end" anymore.

    Also even if it were about the keys, it still wouldnt be e2ee, because the app is a black box controlled by Meta so the key is in Metas hands by definition. Any piece of software that they have sole control over is "their hands" and when exfiltrating the messages from your phone they are using that key to decrypt the messages and send them to their servers.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 7 points 9 months ago

    Yeah sure, I understand all that, indeed it's pretty much exactly what I wrote. You are simply taking an expansive definition of E2EE where I am using a narrow one. As far as we know, Meta is indeed sending its messages in an encrypted state, end to end, so technically it makes the grade as E2EE. That debate is kinda boring, I was simply trying to point out that this case study illustrates the importance of FOSS. And since you are downvoting me, that's all I have to say here.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 9 months ago

    If anyone else other than the intended recipient, be it Meta or Google or the government, can read the message, then its not "end to end" anymore.

    I don't think that's necessarily true. So long as all data is encrypted in transmission such that only the end points can read it, I'm pretty sure that qualifies as end-to-end encryption.

    The problem is that the end points are not truly autonomous; they are subject to the whims and demands of the company that writes the software, sometimes acting under complete secrecy. If WhatsApp decides to siphon data from the end points, that can be very difficult to determine and prove. End-to-end encryption is only valuable if you can trust the end points not to snitch, but you can't fully trust closed source software for this very reason, among others.

  • permalink
  • fedilink
  • source
  • parent