Hacker News Reader

Comment by srhngpr | Hacker News Reader

Genuine question, and I'm certainly no expert in this - just a curious end-user, aren't the backups that WhatsApp creates and uploads to iCloud/GDrive kind of encrypted? As in, I can't simply download the backup file and access the messages and media?

My understanding is that in order to restore/access said messages and media, you would need the SIM/phone number that created the backup file and would have to register again with WhatsApp to receive a decryption key from WhatsApp servers. So doesn't this mean in effect that even though it's not super secure, the backup file stored on iCloud/GDrive is also protected from Apple and Google's prying eyes?

EDIT: For anyone interested, the backups are indeed encrypted. See: https://security.stackexchange.com/questions/136072/how-can-...

View on HN

My understanding is that WhatsApp backups are plaintext. It's true that Apple/Google can't recover your WhatsApp account with just the plaintext, but I believe they can read the messages.

Thanks for replying! This is concerning if true. Is this documented or proven anywhere? I had heard something similar, but can't seem to find any reliable source that confirms the messages are in plaintext.

https://www.tomshardware.com/news/whatsapp-google-drive-back...

WhatsApp recently announced that users will soon be able to backup all of their data to Google Drive without that storage eating into their allocated Drive storage. What the company ommitted to say at the time was that the data backed-up to Drive will be stored in plaintext, without any encryption.

If WhatsApp has the decryption key, it's not end-to-end encrypted.

If Apple has your decryption key, then iCloud uploads aren't encrypted (and Apple seems to have the decryption key, as they offer "reset password" functionality).

The backups aren't E2E encrypted, WhatsApp even tells you this in the backup settings page in the app. But if they hold the decryption key and the only way to get it is via registering with a WhatsApp server via SMS verification, then doesn't that imply that Apple and Google don't have the key and can't read or restore the messages?

WhatsApp backup is unencrypted on both iOS/iCloud and Android/GDrive.

I keep hearing this, but is there an actual reliable source that confirms it? If it were that easy, then I could technically restore anyone's GDrive backup from WhatsApp on my Android phone simply if I got access to the same Google account, but I believe this is not possible as you have to also verify the phone number via SMS.

They say it themselves

https://faq.whatsapp.com/android/chats/about-google-drive-ba...

"Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive."

That statement is correct. E2E encryption is only in effect between two devices communicating with each other. The moment the messages leave the app in any capacity (e.g., screenshots, backup, forwarded to another convo/contact, etc.) it is not longer protected by E2E encryption.

The backup file itself that is uploaded to iCloud/GDrive is encrypted; see: https://security.stackexchange.com/questions/136072/how-can-...

It used to be encrypted. However, Google and Whatsapp have a deal that states Whatsapp backups dont count towards drive storage quotas. It became plaintext (or at least unencrypted after that)

https://www.tomshardware.com/news/whatsapp-google-drive-back...

From 2018 but also, this is referring to moving away from E2E encryption, which is true. However, the backup file that gets uploaded to Google Drive (Android) or iCloud (iOS) is encrypted (i.e., Google and Apple cannot read its content). See: https://security.stackexchange.com/questions/136072/how-can-...

Reply on news.ycombinator.com