8

According to The Telegraph, a member of the British government is calling on WhatsApp to release the messages sent by the terrorist that committed the attack on London on March 22, 2017.

It's lead me to wonder, does WhatsApp, barring any intentional backdoors, have a way to break its own end-to-end encryption assuming no access to the physical device?

Meaning, if the government were to obtain a court order, would it even be possible for WhatsApp to comply?

Improve this question
9
  • 2
    There may be end-to-end encryption, but the only thing that's keeping WhatsApp from sharing the information outside that communication is their promise of privacy. Given that Facebook owns WhatsApp, I don't have much faith in that promise.
    – S.L. Barth is on codidact.com
    Commented Mar 27, 2017 at 7:25
  • @S.L.Barth no the end-to-end would make it impossible (if implemented correctly) to share the content of the messages as whatsapp does not have the private keys to decrypt the messages.
    – Wealot
    Commented Mar 27, 2017 at 8:05
  • 1
    Because you're constraining the question by saying "no intentional backdoors", but also saying that the end-to-end encryption is properly implemented, you are basically asking us to guess at a potential, unknown, vulnerability.
    – schroeder ♦
    Commented Mar 27, 2017 at 8:32
  • 1
    I think they (whatsapp) could comply to a government request without a backdoor, they can get a copy of the key for the front door. And they probably have something in place to do this already in their code for their 'report abuse' functionality. But also the language 'properly implemented' is hazy, proper for who?
    – daniel
    Commented Mar 27, 2017 at 8:36
  • 1
    @S.L.Barth Ah ok! didn't understand it properly then :D. But yes it all comes back to what Whatsapp says versus what they actually do.... :P
    – Wealot
    Commented Mar 27, 2017 at 8:56

5 Answers 5

Reset to default
6

I think the answer is maybe. They may save the keys at the start, or have functionality to copy the keys from the device, but still sell their messaging service as end to end encrypted. The idea then is that if one of the users reports bad behavior from another user they can step in and decrypt the messages to verify the claim. Also this means whatsapp might get a secret request from some TLA and do it without telling anybody, possibly without access to the users devices since those guys could already have a copy of the encrypted messages.

Also if it is like this then everyone would like to pretend it's not, people would still have to act outraged when something happens in the news that involves the program.

Improve this answer
5
  • 1
    I wrote "Assuming no intentional backdoors on their part"
    – Magisch
    Commented Mar 27, 2017 at 6:59
  • 3
    We have a different idea of what a backdoor is, I think a back door is "only the secret key can decrypt this message, or the super secret backdoor key password123"
    – daniel
    Commented Mar 27, 2017 at 7:22
  • Could those messages then be used as evidence in court? That would give away the "secret" backdoor.
    – Awn
    Commented Mar 27, 2017 at 9:03
  • 2
    @Eclipse That's a classical problem - once you use information gained by cryptanalysis, the enemy will know you've broken their encryption. The usual answer is to find other ways in which the information would be found. They can't use such information directly without exposing themselves. But it may help to find other incriminating evidence that can be used in court.
    – S.L. Barth is on codidact.com
    Commented Mar 27, 2017 at 9:10
  • 2
    Yep, DEA calls it parallel construction, I remember a documentary saying with the enigma Churchill would would fly a reconnaissance plane over where they knew someone to be from the broken encryption .
    – daniel
    Commented Mar 27, 2017 at 9:21
4

Even if Whatsapp fully respects privacy and managed not to be able to access its users private key (*), intelligence services could still be interested in encrypted messages. If they can get a smartphone containing a key but where messages has been cleaned, the key + the encrypted messages allows to immediately decrypt everything.

AFAIK, Whatsapp is a closed source application, so I cannot say whether they store the private keys on their own servers or not.

Improve this answer
3
  • This is SPOT ON and exactly answers the OP's question. WhatsApp of course can hand over the messages sent thru them. Decrypting them is something else.
    – Marcel
    Commented Mar 27, 2017 at 12:11
  • Even though Whatsapp is closed source, people can reverse engineer the binary application to see what it does.
    – paj28
    Commented Mar 27, 2017 at 14:06
  • @paj28 I'm unsure that the license allows reverse engineering, but I'm sure that I won't do. If I want to securely exchange data, I will rely on well known protocols like MIME encrypted mails, and never waste time to try to guess what is in a closed source protocol!
    – Serge Ballesta
    Commented Mar 27, 2017 at 14:30
3

Given that Whatsapp does everything it says it does (so no intentional backdoors in the broad sense of backdoor) that would not be possible.

A device receiving the messages has the private key on the device. Whatsapp says it does not get that private key from the devices (and I believe someone would have noticed if they did...).

Conclusion: No Whatsapp cannot comply with any requests for content of messages if they haven't intentionally build a "backdoor"

Improve this answer
1
  • @SergeBallesta That is what I meant, sorry if that did not come over correctly. I edited the sentence a bit.
    – Wealot
    Commented Mar 27, 2017 at 12:23
2

They can add a backdoor

If the current version does not have a backdoor, they can release an updated version that does. Most mobile devices are configured to automatically update applications.

Improve this answer
5
  • 1
    But would that help them read past conversations?
    – Anders
    Commented Mar 27, 2017 at 8:56
  • 1
    @Anders You can see past conversations in WhatsApp, right? So unless the user has deleted the conversation, the plaintext is still available.
    – S.L. Barth is on codidact.com
    Commented Mar 27, 2017 at 8:58
  • 2
    @S.L.Barth Good point. But one of the participants of that conversation will not turn on his phone to recieve any updates. The other party might very well be smart enough to delete the messages, given that this is in the international news and everything.
    – Anders
    Commented Mar 27, 2017 at 9:02
  • @Anders no, not past conversations (probably). The Signal protocol supports forward secrecy.
    – Awn
    Commented Mar 27, 2017 at 9:04
  • 2
    @Anders - I don't know what state the terrorist's phone is in, but if it's on but locked, it may still get application updates.
    – paj28
    Commented Mar 27, 2017 at 9:09
2

Backdoor or not - that's mainly a question of semantics - I think these are the two relevant points:

  • If WhatsApp has the ability to get decrypted conversations, they have been misleading their customers about what their app does.
  • Wheater or not WhatsApp would mislead their customers is a question of trust that can not be answered objectively here.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .