Linus Tech Tips Discussion

 Meta sued for Privacy Violations (again) as WhatsApp isn't truly E2EE Lawsuit alleges Summary Meta in a shock that will surprise absolutely no one is being sued for Privacy Violations over WhatsApp this time. Meta advertises and even states in the WhatsApp help documents that "No one outside of the chat, not even WhatsApp, can read, listen to, or share them. This is because with end-to-end encryption, your messages are secured with a lock, and only the recipient and you have the special key needed to unlock and read them." This lawsuit alleges that    Quotes Quote As the whistleblowers here have explained, WhatsApp and Meta store and have unlimited access to WhatsApp encrypted communications, and the process for Meta workers to obtain that access is quite simple. A worker need only send a “task” i.e., request via Meta’s internal system) to a Meta engineer with an explanation that they need access to WhatsApp messages or their job. The Meta engineering team will then grant access—often without any scrutiny at all—and the worker’s workstation will then have a new window or widget available that can pull up any WhatsApp user’s messages based on the user’s User ID number, which is unique to a user but identical across all Meta products.   Once the Meta worker has this access, they can read users’ messages by opening the widget; no separate decryption step is required. The WhatsApp messages appear in widgets commingled with widgets containing messages from unencrypted sources. Messages appear almost as soon as they are communicated—essentially, in real-time. Moreover, access is unlimited in temporal scope, with Meta workers able to access messages from the time users first activated their accounts, including those messages users believe they have deleted.   Some users—such as certain celebrities, politicians, and Meta employees—are afforded special handling by Meta such that access to their encrypted messages is more closely tracked within Meta and WhatsApp. Meta workers still have access to these users’ messages, but their access of the accounts flags the worker for investigation. Even as to these privileged few WhatsApp users, however, Meta and WhatsApp are still misleading them and violating their privacy by storing their supposedly private, end-to-end encrypted, messages.        My thoughts It's another day and Meta is being sued yet again for Privacy Violations. Are we shocked, I don't think so one iota. That being said since Meta loves to tout the inclusion of the Signal Protocol, I am very interested to see what Signal Technology Foundation has to say about this. Outside of that, not much to add because we all know how Meta is about Privacy.    Sources Bloomberg (Paywalled): https://www.