Hacker News Reader

Comment by adamjb | Hacker News Reader

> 141. Google also has violated users’ privacy in other egregious ways when doing so is convenient for Google. For instance, shortly after Facebook acquired WhatsApp, in 2015, Facebook signed an exclusive agreement with Google, granting Google access to millions of Americans’ end-to-end encrypted WhatsApp messages, photos, videos, and audio files. As Google discussed internally, WhatsApp [redacted]. They did not know that Google [redacted]. As internal documents reveal, upon signing the agreement, Facebook and Google started [redacted], without letting users know. Rather than being concerned about this fundamental breach of privacy, Google internally was [redacted]. In an internal document discussing the deal, Google discussed [redacted] In other words, Google is more concerned about bad publicity than about users’ privacy

Oh my.

View on HN

So glad this isn't going unnoticed. Does anyone remember that random email Google sent years ago (I suppose 2015 from this), informing us that WhatsApp backups no longer count towards your Drive quota limit?

No press releases, no fanfare about it, nothing. There was a small discussion of the intent of this, but the media didn't seem to care.

Wow wild. That is one of those details that slip by most of us with chronic inbox fatigue. So they not only were gathering the data, they actually made a business exception to their API quotas to ensure the data didn't have to be copied twice?!

The real intention behind this move is even worse: It completely negates the purpose of end-to-end encryption, since unencrypted backups can be easily accessed by governments or Google anytime.

The quota exception was so that people wouldn't be discouraged from backing up to Drive since it would no longer "cost" them any storage to do so.

Fun fact: Apple has effectively done an equivalent loophole by storing iCloud backups of your phone (including Messages) WITH the encryption key on their servers. So they have everything they need to read all your data.

I legitimately can't parse what this is saying between the outrageous redactions.

> granting Google access to millions of Americans’ end-to-end encrypted WhatsApp messages

This doesn't imply that Google (or WhatsApp, for that matter) can read these e2e encrypted messages, right? I am wondering what information they actually get from this.

From whatsapp faq : "Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive."

Wait, is that whole complaint that Facebook and Google signed an agreement about allowing users to back up their data in Google Drive? Like a user clicks a "connect with Google to backup your data" button? It reads like Google's slurping things in behind the scenes and has access to encryption keys, but it doesn't actually say that.

Is the only contentious part that Google might have done [redacted] with the chats and photos?

AFAIK it does so by default, and it doesn't even help if I disable it as my chats will be uploaded by everyone else anyway.

It most certainly does not do so by default. It will occasionally prompt you to set up backups and you have to choose the frequency and method.

Ok, thanks for pointing out!

I recognize that in that case I have been wrong and loud at the same time.

I'm sorry for that.

No, you misunderstand antitrust laws. Signing an exclusive deal with your direct competitor who is as much of a monopoly as you are is cartel behaviour. Google then seemingly abused this exclusive privilege.

Google Drive backups option for Whatsapp only applies to Androids with Google Play Services, and for IPhones Whatsapp's only cloud backup option is ICloud. This does not seem close to nefarious at all. NOTE, this is only about cloud backups through the app. If you want you can backup only to your phone and then upload those backups to whatever service you want.

The complaint about this is simply ridiculous, and in fact kind of shows the misleading nature of it's framing. Not that I expect more of that AG.

Yeah, framed like this, backing up in your phone's default cloud, seems a lot more reasonable. If Facebook turned down Dropbox or Google added that to the contract, there might be an issue, or if Google did sketchy things with the backup. Maybe they did, for the framing was disingenuous.

It very much implies that Google can read it, yes.

I've been quite vocal about it but have taken a lot of flak for it because WhatsApp is E2E-encrypted with the newest and best encryption scheme recommended by everyones favorite crytographer so it must be infallible (even if it backs up everything to a third party unencrypted, by default).

As someone who has been pointing out for a long time that there is more to security than E2E-encryption it feels great to see first that people have stopped recommending WhatsApp over the alternatives and now also this :-)

Is this about the fact that people can backup their Whatsapp messages using Google Drive?

Reply on news.ycombinator.com