> WhatsApp is end-to-end encrypted,

- Meta data of your messages is not encrypted so meta can make a graph of who you talk to and when

- backups are not encrypted by default so plaintext of your private chats can be obtained

- even if you enable encryption for backups all it takes is for the other person in your private convo (or a person in a group chat) to not enable it for your messages to be available in plaintext

▲

netsharc 2 hours ago | parent | next [-]

I've read that if you give FB/IG/WA access to all files/photos, and you have GPS metadata for photos (I do, hey it's useful to know where I took a pic), it can trawl that data to see where you've been and when...

So now Android strips location info when sharing an image to an app. A filter layer between filesystem and app, to add complexity to the whole system...

▲

lxgr 5 hours ago | parent | prev | next [-]

> - backups are not encrypted by default so plaintext of your private chats can be obtained

Yes, but importantly not by Meta themselves.

> - Meta data of your messages is not encrypted so meta can make a graph of who you talk to and when

Fair enough and worth mentioning. I'm personally fine with it.

> - even if you enable encryption for backups all it takes is for the other person in your private convo (or a person in a group chat) to not enable it for your messages to be available in plaintext

Yes, but how would you prevent that even in principle? I can't control what the people I'm messaging do with their copy of my messages. As long as there isn't unnecessary non-repudiation (e.g. by the sender cryptographically signing all outbound messages, which the Signal protocol intentionally avoids), I think this is fair as well.

I do agree that e.g. vanishing chats with a short timeout/"view only once" images should probably not be included in backups, though; last time I checked, I think they were.

▲

cobbzilla 4 hours ago | parent [-]

> Yes, but importantly not by Meta themselves.

Don’t they save backups to Meta? Even if not, they can read whatever’s (unencrypted) on your phone if they really want to.

	▲	lxgr 3 hours ago \| parent [-]
		They currently go on iCloud on iOS and Google Drive on Android. There are rumors about a first-party backup service, which would obviously change that calculus, but nothing concrete yet.

▲

addandsubtract 4 hours ago | parent | prev [-]

WhatsApp / Meta is also on both sides of the E2EE.

▲

lxgr 3 hours ago | parent [-]

Sure, but so is every security researcher in the world if they want to be, and they only need to get caught shipping exfiltration logic once.

	▲	bossyTeacher 3 hours ago \| parent [-]
		> so is every security researcher in the world if they want to be Most security researchers lack Meta's history: - Testing emotional manipulation features on thousands of users non-consensually - Adding spyware on underage users - Intercept a rival app's traffic - Allowing harm to teen mental health And most importantly, most security researchers lack the money and power to fend off the legal consequences of these acts.