Facebook owns what’s app and they can read any message on the service, they’ve also been known to give logs and messages to law enforcement agencies at request without warrants.

You bet your ass they can. Since when has Facebook taken anybody's privacy seriously? And you remember all the Snowden leaks? Like how AT&T has been a government apparatus for spying for decades? Or how about the way that the USA taps under sea cables to monitor data, causing China to build totally parallel backbone infrastructure

The better question is whether Signal, despite being open source, is actually secure. It's very plausible that the govt has backdoors somewhere, for either encryption, the OS, the programming language, the app store, or some random dependency lib

The answer is yes, the US government spies on everything, and has a complete profile of everyone

Probably not, but it's impossible to verify. There's a strong argument for open source when security really matters.

Another thing to consider is that the US (and probably most 5 eyes countries) have agencies with a "store now and decrypt later" policy. They theoretically could be capturing certain types of traffic and storing it in the massive NSA fusion centers. If you come under suspicion at some later date and the quantum technology has advanced, you could be hosed. Now what's the legality of storing "precrime material" without a warrant? I wouldn't think it is legal but that doesn't seem to stop the 3 letter agencies these days.

They don't have to attack the encryption, there are far easier ways. Compromising your phone then reading the notification contents for example. If a smallish company can do this (pegasus) imagine what the resources of the US intelligence complex can do.

Given enough time anything can be decrypted, so, yes. The actual question is if they would have any interest in doing so given the large investment of time and resources required when they can simply hit you with a wrench until you give them the password to your device or in more enlightened Countries, just buy the data directly form Meta. You don't control the server so there is no assurance of any encryption being secure beyond your chat not being interesting enough to justify the attention.

Everything I've ever heard about government cryptography from people close to me is that the government (FBI, military) is wildly far ahead of what's available publicly. I wouldn't count on anything you do on the Internet to be truly private.

People got arrested for WhatsApp messages in my country so there is a backdoor built in no question

The code is not open source, so it's hard to verify how good the encryption is or if it has backdoors.

I'm not an expert in cryptography, but from my limited knowledge, the cryptographic keys used are very important. If Meta or the government can somehow know the decryption key to your messages or predict it, then they can see your messages.

But they most likely don't need to decrypt it in transit. One of the vulnerabilities in this system is Google firebase, which delivers notifications to your phone when WhatsApp messages arrive. Ever noticed how those notifications include the message content and the sender? Google has access to this information, despite the encryption.

That's just an example. Google has access to a lot on your phone.

Another thing to consider is message metadata. The content of your message is encrypted, but what about information like the destination of your message, its recipients, time sent and received, and frequency? I'd even argue this is more important than content in many situations. Sometimes, linking person A to person B tells me a lot about person A.

If you did not enable end-to-end encryption for your WhatsApp backups on Google Drive, the US government could possibly compel Google to hand over your encrypted (but not end-to-end encrypted) backup, and compel Meta to hand over the decryption keys for the backup.

Details about how WhatsApp backup works: The Workings of WhatsApp’s Backups (and Why You Should Enable End-to-End Encrypted Backups).

https://link.springer.com/chapter/10.1007/978-3-031-38551-3_11

Dated August 2023.

They can just ask Meta for the chats lol, don’t even have to probably already have access.

Governments, if they want, can decrypt any chat, not just Whatscrap. But it makes a difference if a chat, especially this Zuckerbot shit, directly opens a Backdoor to governments, to give them access, or if they have to bother hacking the chats themselves, which due to its cost and time, is only done with a court order.

this post has some good information.

tldr - you cant fully verify

https://security.stackexchange.com/a/79090

The better question is, do you trust meta at all? I'm sure they have a way to read everyone's chats and would gladly hand over yours to the government if they want it.

Strongly depends on which government.

I personally wouldn't touch WhatsApp with a 10foot pole. As it is owned by Facebook, the company who earlier this year paid a company to compromise TAILS OS to find a pedo. Which its not the fact that they threw a pedo in jail. But the fact they compromised anonymity and in no way are a government body!!! So glowies be glowing hard at Facebook.

They also have done other spooky shit. Which is why the only reason I use Facebook is to sell my shit.

We could also talk about the OS and hardware your using to message people for security. If you want to know more read permanent record by Edward snowden. Its a great book and talks alot about PRISM and other spooky stuff

yowsup is an Open Source implementation of the WhatsApp protocol. So there is proper end-to-end encryption on the protocol level - that would only leave the possibility of having a backdoor in the "official" WhatsApp client, but none has been found so far. BTW, people do actually (try to) decompile the WhatsApp client (or the WhatsApp Web client which implements the same protocol and functionality) and look what it is doing.

For anyone really curious, it's not too difficult to hook into the WhatsApp Web client with your web browsers Javascript debugger and see what messages are sent.

It is impossible to say. If you are that concerned you should use something else