Ex-Whatsapp Cybersecurity Head Says Meta Endangered Billions of Users

You're still just blindly trusting this is the case. You can't verify the encryption or any of the code.

It would be trivial to actually encrypt the message and send it out and then store an unecrypted version locally and quietly exfiltrate it later.

They have to already be storing an unecrypted version locally, because you can see the messages. So unless your analyzing packets on the scale of months or years, you cannot possibly know that it isn't being exfiltrate at some point.

Take it a step further: put the extiltration behind a flag, and then when the NSA asks, turn on the flag for that person. Security researchers will never find it.

USA is special because it is the (only?) country where iPhone has more users than Android.

Russia: Telegram

Taiwan: Line

Japan: Line

By contrast, WhatsApp is best known to me for being used in Europe, Australia, and India.

Or the PR team undermines their own credibility with a stock and specious fact-free non-response.

I think the point of these is to dodge the even guiltier look of “no comment”. And signal there won’t be any potentially costly cooperative engagement from their side to their shareholders.

They don’t expect to be believed.

It was bought as a power play, consolidation of tech power. Why would I trust them to do the right thing?

I'm guessing there will be some tricky legal wording in their T&C that wouldn't rule them out from being an intermediate entity that can see messages.

1) leave quietly and tell no one: con - no one on HN gets to talk about it. The next person needing money does it anyway.

2) leave loudly when you're still poor: con - you get blacklisted from tech and die from a preventable disease working at a gas station without insurance. The company implements the policy anyway.

3) leave loudly when your rich: con - people accuse you of selling out the users.

Well with WhatsApp they most definitely can, but it has never been a secret. WhatsApp always had access to the metadata (whereas Signal makes a lot of effort to reduce the metadata they have access to). In ~2016 WhatsApp integrated the Signal protocol to add end-to-end encryption, but did nothing about the metadata.

Again: if you care about privacy, use Signal.

If an app sends the message content in clear through the notifications, then it is badly designed, period.

≥ Company refused to allocate more than around 10 engineers to the Security team at any point

If true, this tells the story here with security culture at WhatsApp. Assuming a backlog of known weaknesses (as any established code base will have), and the velocity that 100 PMs and 1200 SWEs implies, how would you do anything as a security team besides stick your fingers in the figurative holes in the dike? The ensuing conflict between Baig and his superiors about not fixing stuff is surely going to result in an assessment of "poor performance" but is likely just Baig giving a f** about user data.

Even if nothing changes (the regulatory action is optional), he's happy to contribute (he insists, in fact). Even among people who don't want him there.

> he will be happy to negotiate a payment instead.

This, indeed, sounds way more normal than wanting to keep working for the evil company, and in a toxic environment.

It hasn't occurred to me that one can change their mind and choose a different compensation after the court decision like that.

https://www.cnbc.com/amp/2022/11/17/meta-disciplined-or-fire...

A related scheme is the existence of brokers who will, for a fee, recover banned or locked accounts. User pays the broker $X, broker pays their contact at Meta $Y, and using internal tooling suddenly a ban or suspension that would normally put someone in an endless loop of automated vague bullshit responses gets restored.

From people at Facebook circa 2018, I know that end user privacy was addressed at multiple checkpoints -- onboarding, the UI of all systems that could theoretically access PII, war stories about senior people being fired due to them marginally misunderstanding the policy, etc.

Note that these friends did not belong to WhatsApp, which was at that time a rather separate suborg.

Your comment talks about incentives, but you haven’t actually made a rational argument tying actual incentives to behaviour.

I haven’t touched a lot of these cyber security parts of industry: especially policies for awhile…

… but I do recall that auditing was a stronger motivator than preventing. There were policies around checking the audit logs, not being able to alter audit logs and ensuring that nobody really knew exactly what was audited. (Except for a handful of individuals of course.)

I could be wrong, but “observe and report” felt like it was the strongest possible security guarantee available inside the policies we followed (PCI-DSS Tier 1). and that prevention was a nice to have on top.