I realize WhatsApp has end-to-end encryption.
But, can WhatsApp see certain metadata, such as the following?
- With whom I send & receive messages
- How many messages I send & receive
- When I send & receive messages
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
AFAIK, WhatsApp is closed source. And the data passes through their servers. And they have control on the keys used for encryption (because it is closed source). So on a security point of view, you should assume that they can read the content of the messages.
Whether they do it or no is a different question, but if privacy is important, you should not rely on WhatsApp.
Now to answer your precise questions:
can WhatsApp see with whom I send & receive messages
Of course they can. How could the know where to forward the messages?
can WhatsApp see how many messages I send & receive
Of course they can. I assume they have technical logs that should contain sender and recipient for each message. Such logs are required for the administration of a platform
can WhatsApp see when I send & receive messages
Of course they can, for the very same reason as for your first question
Sending a message via a routing service always requires some routing data to be readable by that service. To send a message on WhatsApp, you send it to their servers, which places your message in a queue for the recipient to fetch - which requires you to tell the servers which queue/inbox to use.
There are techniques to conceal routing information and traffic patterns, mainly based around mix networks. However, the protections of such networks rely on having multiple layers of routing which are not co-operating with each other (so no single organisation can meaningfully operate one of these on their own). Networks such as Tor rely on helpful people running their own servers to join in, because as long as your route through the mix network crosses one non-cooperating server you should be OK.
While Whatsapp itself can naturally see to who you write messages to (because you send it over their server) and keep track about your social contacts, I understand your question more like:
"could one generally see my message partners and texts"
The answer is: YES THEY CAN
If you have, for example, a managed code rootkit on your phone, the person controlling it can see your display for example, or read your keys, and with this ability, they can see who you are texting.
Managed code rootkits will become more and more important in the days where a whole operating system like Android is written completely in Java, and such a rootkit would hook into the runtime environment, to speak clear the sandbox. I realise this is a bit off-topic, but the technology to do so is surprisingly straightforward and not so much what I would call "Black magic"
With such a technique there is no need for any encryption since information is gathered BEFORE it is encrypted.