Hacker News Reader

Comment by JumpCrisscross | Hacker News Reader

> Facebook’s attempts to use its personal data and weaken its encryption

What’s this about weakening WhatsApp’s encryption?

Yeah, the article is super-vague about that:

> In 2016, WhatsApp added end-to-end encryption, a security feature that scrambles people’s messages so that outsiders, including WhatsApp’s owners, can’t read them. Facebook executives wanted to make it easier for businesses to use its tools, and WhatsApp executives believed that doing so would require some weakening of its encryption.

Not sure what this means. "Weaken" is kind of a confusing term, FB either has access to the message content to feed in to adsense's gaping maw or they don't.

> FB either has access to the message content to feed in to adsense's gaping maw or they don't

There is a lot of grey area in between. How metadata is treated, whether encryption is turned on by default, what about the messages are encrypted, how they're encrypted, et cetera.

I don't understand why allowing businesses to use WhatsApp would require weakening its encryption. Can anyone parse the meaning of this, or speculate about why that would be necessary? It makes no sense to me.

Are they perhaps implying some kind of central analysis of sent messages for targeting purposes?

My guess is that Facebook wanted to build in some kind of MITM attack so that businesses could see a log of their employee messages.

If I were to speculate, and it would definitely be speculation, I would say it was adding some sort of key escrow for encrypted chats in the Enterprise. It's not uncommon for escrow to be a requirement in Enterprise encryption products.

This is my experience as well.

Later in the article, the context for this is provided: that business applications of WhatsApp may have needed features Koum perceived as weakening encryption. Which rings true, because pretty much every enterprise messaging application allows admins to override privacy.

Reply on news.ycombinator.com