I presume the hardest part would be avoiding detection via decompilation and other reverse engineering techniques. Not familiar with that space (can anyone here shed some light?), but it seems likely that an entity with Meta’s resources would be able to figure that out.
E2EE probably protects well against bulk data collection (traffic analysis would sniff out sending 2x volume of data pretty quickly). But something more subtle and targeted, smuggled out in various fields of various protocols, would be hard to detect.
The only risk would be the reputational damage. And as far as their bottom line is concerned, the impact of that would be negligible—how many of WhatsApp’s billion(?) users know that it’s supposed to be E2EE, let alone are under the illusion that Meta doesn’t have access to their data?
So e.g. opening a link to an Amazon product that a friend sent makes you a target for ads in that category.
It's a suspicion, they'd probably argue their EULA allows this. The typical "we have to monitor links for dangerous content" is always the standard bullshit.
This is even further away from the reality where people have breakdowns because their app icon moved location and is not in the usual spot.
The average person is optimizing towards energy use minimization by default because life is already hard enough with plans, kids, etc.
Use incentives and we will arrive at closer truths than by claims and expressions.
- Meta data of your messages is not encrypted so meta can make a graph of who you talk to and when
- backups are not encrypted by default so plaintext of your private chats can be obtained
- even if you enable encryption for backups all it takes is for the other person in your private convo (or a person in a group chat) to not enable it for your messages to be available in plaintext
Yes, but importantly not by Meta themselves.
> - Meta data of your messages is not encrypted so meta can make a graph of who you talk to and when
Fair enough and worth mentioning. I'm personally fine with it.
> - even if you enable encryption for backups all it takes is for the other person in your private convo (or a person in a group chat) to not enable it for your messages to be available in plaintext
Yes, but how would you prevent that even in principle? I can't control what the people I'm messaging do with their copy of my messages. As long as there isn't unnecessary non-repudiation (e.g. by the sender cryptographically signing all outbound messages, which the Signal protocol intentionally avoids), I think this is fair as well.
I do agree that e.g. vanishing chats with a short timeout/"view only once" images should probably not be included in backups, though; last time I checked, I think they were.
Don’t they save backups to Meta? Even if not, they can read whatever’s (unencrypted) on your phone if they really want to.
So now Android strips location info when sharing an image to an app. A filter layer between filesystem and app, to add complexity to the whole system...
Most security researchers lack Meta's history:
- Testing emotional manipulation features on thousands of users non-consensually
- Adding spyware on underage users
- Intercept a rival app's traffic
- Allowing harm to teen mental health
And most importantly, most security researchers lack the money and power to fend off the legal consequences of these acts.
Why would you assume that security researchers don't know about these? If anything, wouldn't all the bad press and scandals make WhatsApp a more likely target of scrutiny?
> And most importantly, most security researchers lack the money and power to fend off the legal consequences of these acts.
Yes, security research is generally expensive, but do you have any evidence for Meta taking legal steps against it and making it actively harder? I remember e.g. the controversy around WhatsApp re-encrypting unconfirmed outbound messages to a new key; this was revealed by security researchers and widely discussed. (Not that they're making it easier by providing source code for WhatsApp's cryptography or a debug interface to validate what's actually going on in the client, but neither does e.g. iMessage.)
In fact, there's a relatively absurd lawsuit against Meta on WhatsApp encryption going on right now, and these claims are widely being repeated all over social media.