1

I read a lot of reports from corporate media complaining that you can't censor "fake news" sent via WhatsApp. Mainstream media claims that because of "fake news" the wrong person got elected in Brazil.

At the moment Facebook WhatsApp is E2E encrypted and censorship is not possible. Can Facebook break the WhatsApp E2E encryption without the customers noticing and add censorship? Does an independent security researcher notice if Facebook can read the communications?

3

Facebook controls everything inside the WhatsApp environment, i.e. the applications on the phones, the web access and the transport of the messages. Because of this it could also make any changes which would decrease the security in a way that the end-user will not notice. It might also make the changes in a way that security experts will not notice unless they really know where to look.

The only kind of guarantee that WhatsApp does not do this is that it markets the E2E security as one essential feature and that WhatsApp will loose a lot of trust (and customers) if it gets public that it knowingly decreased the security. And given that someone has to actually make the necessary changes inside WhatsApp and that these changes will also have side effects of leaking information (because that's the main point they were added) it will likely only be a question of time that it will be known that such kind of backdoors are in the product.

1

Facebook (or any other organization) can only break Whatsapp E2E encryption if they have the private/public keys of users. And since they own the product, they can introduce a backdoor to leak those keys somehow.

Will researchers notice that?
Probably yes, since it is not very hard to reverse engineer the APK file of android version of Whatsapp and analyze it. Plus, researchers can also analyze incoming and ongoing packets to/from Whatsapp for any weird behavior.

Can Facebook take the risk though?
Probably not! Reputation is what companies are leaning on. There are so many dependent and independent security research institutions that works so hard to make a name of themselves by taking down one of those big names, and don't forget that press and media loves chewing on that.

-edit-
I can only think of one thing Facebook can use to censor Whatsapp without anyone knowing. When a media file (probably also a long text) gets viral on Whatsapp, Facebook can check who downloaded that specific media file and of course who uploaded it in the first place. The media file resides at Whatsapp servers encrypted, and people only share a link to that encrypted file and the symmetric key used to decrypt it (they share it using E2E encryption), but since it is viral Facebook can easily get a copy of that link and symmetric key when one of the employees receives that media file is his/her phone. They take the link and check who downloaded that link and who uploaded it in the first place!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.