WhatsApp Warns Free Google Drive Backups Are Not End-To-End Encrypted (zdnet.com) 38
On November 12th, WhatsApp users on Android will be able to back up their messages to Google Drive for free and it won't count towards Google Drive storage quotas. But, as WhatsApp warns, those messages will no longer be protected by end-to-end encryption. ZDNet reports: While Apple iOS users may elect to use iCloud backup storage options, Android users store theirs through Google Drive -- but alongside the changes, WhatsApp has reminded users that once communication, chat, and media is transferred away from the app, end-to-end encryption is no longer in place.
Some users may think that backup services will have the same level of protection as the app. However, this is not the case and the reminder is important for those interested in protecting their privacy. In WhatsApp support documents, this separation is now explicitly mentioned. "Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive," WhatsApp says.
Some users may think that backup services will have the same level of protection as the app. However, this is not the case and the reminder is important for those interested in protecting their privacy. In WhatsApp support documents, this separation is now explicitly mentioned. "Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive," WhatsApp says.
Re:What would you expect? (Score:4, Interesting)
More like What would you expect? Your backup is there if you lose your data on your phone, including the encryption key.
If you've lost the encryption key, an encrypted backup is completely useless.
Spyware: Google Android competes with MS Win 10. (Score:2)
Windows 10 is possibly the worst spyware ever made. [networkworld.com] "Buried in the service agreement is permission to poke through everything on your PC." (August 4, 2015) Microsoft and Microsoft employees have full access to everything on every computer?
Re: (Score:2)
Seriously? "Malicious apps", "Wi-Fi tracking", "Lack of antivirus software", "Lack of security patches" (sweeping statement).
Give me a break. Please go and find a better boogeyman than totally crazy complains like "lower adoption rates of antivirus software on a smartphone compared to full-fledged PCs".
Why? Just to harm their users? (Score:3)
I often back up encrypted files to Google Drive. Why would WhatsApp bother to decrypt, backup, restore, reencrypt?
Perhaps this is an export/import capability, not a backup, and they've named it wrong? They are two completely different things. Backup is intended for restoration to the same system and can use the system's encryption. Export is just that, exporting from the system for the purpose of allowing other apps to utilize the data.
Re: (Score:2)
Because WhatsApp doesn't hold the key. The private key is only stored on your phone. You can't restore a backup if you've lost your key.
Storing the messages encrypted would render the backup useless if you lost your phone or factory reset it..
Re: (Score:2)
Ahhh. That is not a reasonable backup. No user should be required to compromise security to use their own backup.
At the least they should provide a means of choosing to backup with encryption in place and a separate means to back up the private key. I would want to put the key in my key vault which is also backed up.
Re: (Score:2)
The data would simply be transferred already encrypted and I would assume the private key would be separately encrypted before transfer. As another responder suggested, this would require a backup password to be created.
Or they could just provide a means of copying the private key to the copy buffer on the device. I'd have no trouble pasting it into my password vault interface. The vault itself is on google drive and thus backed up.
Re: (Score:2)
If you don't like how they've implemented it, you can just not use the feature as it's entirely optional.
You obviously don't trust Google with unencrypted data, yet you're willing to copy your private keys to the system clipboard on your Android device.
That's going to give all apps on your phone access to your private keys. Clipboard monitoring is a permission all apps are given.
I have a download manager on my phone, it monitors the clipboard for URLs. There is nothing in the list of permissions to disable
Re: (Score:2)
It's not really that I don't trust Google per se. The problem is that most of these organizations that hold your data will just turn your account over to someone who knows enough about you to answer all of the right questions or can compromise your 2FA - plus they must answer subpoenas and that doesn't require the police.
About 12 years ago, I created a subpoena for ISP information that enabled me to prove that someone with a protection order against them was violating it and stalking his victim. I am neithe
Re: (Score:2)
Yes, any application that is running (background or foreground) with the clipboard permission in their manafest will have access to its contents. There's probably some intent they can register too, to be notified of clipboard events.
Re: (Score:2)
WhatsApp only does end-to-end encryption of the messages being transferred. Once a message reaches your phone it is decrypted and stored in plaintext. There are some OS level protections to stop other apps reading them, but not at the file level.
It appears they are just copying the file to Google Drive. They should add an extra layer of encryption, but they aren't really interested in that. They prioritise ease of use, which means easily restoring your messages years later when you will have long since forg
Once? (Score:2)
Or maybe one's!
Mueller probe (Score:1)
Michael Cohen flipped in part because his WhatsApp communications were stored in the cloud unencrypted. I'm surprised the article didn't mention it.
Re: (Score:2)
If you don't want your messages in the open, you should destroy them soon after sending/receiving.
It's been like this forever (Score:5, Informative)
Just to be clear, the ONLY part that is new is "won't count towards Google Drive storage quotas".
Nothing changes, you could (since probably before Whatsapp was really popular) store the un-encrypted backups on GDrive and it's off by default and you are warned that they aren't encrypted. Local backups aren't encrypted too by the way, unless you have some kind of device encryption.
The end-to-end encryption is only on-the-fly. You start saving shit you need to trust the place you save it to. It's just like ssh, there is encryption for the connection and there is even an ephemeral symmetrical key agreed upon on the spot but you need to take care what to do with the stuff once you start logging or redirecting to files, etc.
Most people don't care anyway. Many of the services aren't end-to-end encrypted (Email, SMS, Yahoo Messanger - rest in peace-, Google Talk or whatever they call it nowadays, Facebook Messenger unless you're using secret conversation or something and so on).
Sure, they could encrypt the backups but the user would have to manage (think store safely) the keys. Do you really expect most users to be able to get the key they set/saved years ago when the old phone breaks (or is lost) and they need to restore the backup to a new phone? Especially if is a key with enough entropy (think a complicated passphrase) that they aren't supposed to be using anywhere else?
Re: (Score:2)
There are a number of cloud encryption solutions. Boxcryptor works fairly well, and Cryptomater is similar.
The most iron clad is VeraCrypt, especially if you use keyfiles (and store the keyfiles on physically secure media.)
As for device cloud backups with encryption, with iOS, you pretty much have to have a machine that you can back up to at home. iPhone device backups are free game, so if concerned, back up your iWhatzit on a local PC with solid encryption, and set a password on the backup.
Android, you h
The title is misleading. (Score:1)
uhh.. (Score:2)
Re: (Score:1)
They are. So is the message store on your phone. The problem is the key to encrypt the message store is generated during registration, and given during any re-registration. If you control the phone or phone number, and the backup, you can get the key and decrypt the message store easily.
Media is not encrypted at rest on your phone or backup by WhatsApp.
WhatsApp should add a salt or pin or something to the backup encryption to make it safer at rest. That would be straightforward and "solve" this "issue."
Re: (Score:2)
If WhatsApp wanted true end to end security, they would have done a number of things:
1: They would have stored messages encrypted on the device. Signal and TextSecure do this, where you can have all messages they store be stored with encryption independent from the OS. For maximum security, the app could print out a recovery key on setup for the user to write down and save somewhere, then use a composite key derived from a PIN/password and a key stored in the KeyChain or Android's KeyStore. That way, th
To Hell with 'The Cloud' (Score:2)