It is encrypted with a per user key known to WhatsApp.
That means for a third party to access the chats, they need Google to hand over the data, and Facebook to hand over the key.
The logical next step to add would be for Google to additionally encrypt the data with the users logon password or something derived from it. Google won't do this anytime soon for business reasons.
> It is encrypted with a per user key known to WhatsApp.
This is no longer true! For a few years now. The backup is stored on Google Drive in plain text.
https://faq.whatsapp.com/android/chats/about-google-drive-ba...
Do you have a better cite or did you check directly recently?
It's now "authenticate via SMS and pin (if enabled), or authenticate via SMS and wait 7 days (if pin enabled)"
I haven't tried this specific tool yet (or others recently) but it was definitely possible in the past without requiring any key from FB/WA.
https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre...
I do not vouch for this repo, but it gets the job done.
The only creds required are your Google account creds. No per-user whatsapp keys necessary.
> Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive.
That makes sense, why would you re-encrypt the messages with the end-to-end-key which is individual for each chat, if you could simply use a symmetric encryption for backups?
So the statement
> It is encrypted with a per user key known to WhatsApp.
could still hold true, there's no information contrary to that in the FAQ (but no information indicating another kind of encryption either).
1) The backup can only be made to Google drive, you cannot create a manual backup to a location of your chosing
2) The backup is created in a secret folder that cannot be accessed by the user
3) The backup is deleted if you delete your account. (not much of a backup, eh?)
4) You can only create per-channel exports, but this won't export the entire chat, it will export up to ~12MB of recent media, and ignore the rest, silently. WhatsApp would only share the last 40 messages of a 4-year-old chat because the last few messages contained a few images.
This leads to inability to restore a backup if you forget your password and need to reset it.
That's going to lead to screams/tears from a lot of folks who don't realise those implications.
National intelligence agencies (plural) would already have both.
There are two beneficiaries of this change:
1) Intelligence and law enforcement agencies, which now have direct access to WhatsApp history for everyone who uses cloud backup (99.9% of users, if not 100%), without the need to 0day any specific phones, risk detection, or even have those phones on except occasionally.
2) Google, who can now mine your private conversations, metadata, etc.
(At a tiny storage cost for Google, for which they are likely compensated by the NSA)