WhatsApp Quietly Extends Encryption to iCloud Backups of Chat Logs

[MacRumors]

WhatsApp has bolstered the security of the iCloud backup feature in its messaging platform, in an attempt to protect archived chat logs from being accessed in a readable form (via TechCrunch).

WhatsApp has offered end-to-end encryption on its messaging service for some time, but that encryption did not previously extend to iCloud backups of messages. Given that Apple holds the encryption keys for iCloud, a subpoena of Apple or an unauthorized iCloud hack could potentially allow access to WhatsApp messages backed up there.

However, WhatsApp has moved to prevent that possibility by also pre-encrypting the backup files. "When a user backs up their chats through WhatsApp to iCloud, the backup files are sent encrypted," a WhatsApp spokesperson told Forbes, confirming the change.

WhatsApp quietly added the encryption to WhatsApp iCloud backups late last year, however the change only came to light last week when professional hackers claimed to be able to circumvent the security measure.

According to Russian-based Oxygen Forensics, third-party hacking tools are able to download the encrypted WhatsApp data backed up to iCloud and then generate an encryption key to decrypt the data using the associated SIM card. The tools could potentially be used by police with access to a phone where the WhatsApp account has been deactivated but the encrypted messages are still stored in iCloud. WhatsApp has yet to comment on the claims.

The encryption debate has been reignited in recent weeks on both sides of the Atlantic. FBI director James Comey revealed earlier this month that his agency had been unable to access the data on more than 3,000 mobile devices in the first half of the fiscal year, despite having legal authority to avail themselves of the contents.

A recent statement by U.S. senator Dianne Feinstein also appeared to confirm that the government had used $900,000 of public money to pay for the third-party tools to unlock the iPhone used by the San Bernardino terrorist. No information of relevance was found on the device, the FBI later revealed.

Meanwhile in the U.K., government home secretary Amber Rudd recently claimed that it is "completely unacceptable" that authorities cannot gain access to messages stored on mobile applications protected by end-to-end encryption, such as WhatsApp. Rudd said she would be discussing the situation with technology companies in the near future.

Since that time, a draft technical paper prepared by the U.K. government has been leaked that contains proposals related to the removal of encryption from private communications. The paper reveals that companies would be required to provide the raw data "in an intelligible form" without "electronic protection" within one working day. Discussions about the feasibility of the proposals are said to be ongoing.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Article Link: WhatsApp Quietly Extends Encryption to iCloud Backups of Chat Logs

 

[OldSchoolMacGuy]

Nice.

 

[kyleh22]

This is awesome. I love me some encryption

 

[Gutwrench]

1. Good for privacy
2. I use WhatsApp sparingly
3. I don't back up conversations, no need

 

[Keane16]

Since that time, a draft technical paper prepared by the U.K. government has been leaked that contains proposals related to the removal of encryption from private communications. The paper reveals that companies would be required to provide the raw data "in an intelligible form" without "electronic protection" within one working day.

As a Brit, I was so annoyed with this tech paper. Some politicians just don't get it.
[doublepost=1494335527][/doublepost]

3. I don't back up conversations, no need

I had a close friend pass away recently. Never had I been so glad that I keep all my messages and back them up (iMessage, Whatsapp, Telegram etc.).

 

[miknos]

80% of whatsapp users use the backup feature. So in essence "only" Apple, Google, governments with subpoenas and hackers can get access since that encryption is not that strong.

Use Signal instead. Whatsapp is a false sense of privacy.

 

[thisisnotmyname]

I'd like the option from Apple to encrypt iCloud backups with my own key. I'm ok with the fact that if I lose my key my backup will be lost forever. Until then I'll continue using only local encrypted backups.

edit: I have my issues with Comey but I at least appreciate his pragmatic approach that if lawmakers won't force access to encrypted devices we'll just need to change expectations about evidence gathering but law enforcement will go on. I realize he has undertones of FUD to that statement but at least he's being honest that it's not the end of law enforcement, there will just be some information inaccessible to them.

 

[Abazigal]

Nice. Can I also have a native Apple Watch app for whatsapp?

 

[Sasparilla]

Nice, although I think your active contact information (who you talked to with the application and when) is still open and available upon request. Facebook owns them I think.

 

[Gutwrench]

I had a close friend pass away recently. Never had I been so glad that I keep all my messages and back them up (iMessage, Whatsapp, Telegram etc.).

Im so sorry. Yes I'll rethink my comment. Thank you.

 

[JosephAW]

My friend's problem with WhatsApp is that he has a tremor and can't type so he used the record audio button, except the button is so small that he keeps sliding off his finger and has to press it again to continue recording.
I talked to WhatsApp support but they didn't see a need to increase the button size or fix the problem.
We were using HeyTell and they have a huge button but their service is limited to so many recordings per person.

 

[b0nd18t]

So the only reason we know it exists, is because it's already hacked/broken?

 

[sudo1996]

80% of whatsapp users use the backup feature. So in essence "only" Apple, Google, governments with subpoenas and hackers can get access since that encryption is not that strong.

Use Signal instead. Whatsapp is a false sense of privacy.

Signal is also a false sense of privacy. How do you know you're getting the right public keys?

 

[miknos]

Signal is also a false sense of privacy. How do you know you're getting the right public keys?

It's open source.

You can check them: click a contact, click on its name, verify safety numbers.

 

[sudo1996]

It's open source.

You can check them: click a contact, click on its name, verify safety numbers.

OK, as long as you do that for all your contacts. Otherwise, it's worthless. And I know people out there are just using these things and pretending like public keys are magically known.