WhatsApp will now encrypt your backups, along with the existing end-to-end encryption it uses for sending messages. This means that there’s no way to access your messages without physical access to your device. The encryption applies to the backups stored on Apple’s or Google’s servers, which means that your iCloud backup is safe, for example, even if Apple is compelled to hand over your otherwise unencrypted backups to the police. So, does this make WhatsApp the safest messaging service? “WhatsApp’s chats and now backups are now fully secure from third parties, even when these backups are on Apple and Google servers,” Eric McGee, senior network engineer at TRGDatacenters, told Lifewire via email. “WhatsApp, unlike Apple, does not keep the encryption key, which means that it cannot be compelled to give [it to] third parties such as law enforcement.”
Virtual Safety Deposit Box
WhatsApp messages already are end-to-end encrypted; the message is encrypted on your device, sent, and is decrypted by the recipient. It’s like sending a message in code—if it’s intercepted, nobody can decipher it. Now, Facebook does something similar for your backups. The backups, themselves, are encrypted and stored in your Google or Apple backup. But the key to decrypt them is stored in a “hardware security module” (HSM)—a physical device controlled by Facebook. If you need access to your backups, you can unlock the key in the HSM by entering a password on your phone. Why not just store the key that unlocks your backup on your phone? Facebook says that the HSM means you can have a simple, easy-to-remember password on your phone while having a complex, hard-to-crack key in the HSM. It also means you can recover the key—and access your backup, even if your device is lost or stolen—as long as you remember your password. In an associated white paper, Facebook details the setup. Users can opt to use a 64-digit key and store it themselves. In this case, the key is not stored in Facebook’s HSM, so if you lose the key, you lose your backups. Facebook has zero access to your messages. That’s great, but only a small part of the story.
Facebook Surveillance Machine
Your messages consist of two things—the contents of the messages and their metadata. Even if the former is locked up, the latter remains valuable, and Facebook has free access. Metadata shows who you send messages to, when, and where you are when you send them. Likewise, it shows who reads those messages and when. Anyone with access to this metadata can detect patterns. For example, it’s fair to assume that a person who calls a food supplier, a locksmith, a printer, and a kitchen equipment supplier is probably setting up a restaurant of some kind. And if you think about Facebook’s surveillance apparatus, which is designed to tease out your most intimate details from your social graph, this metadata is as valuable as the contents of your messages.
The Alternatives
Apple’s iMessages are also end-to-end encrypted, but the backups are not. Or rather, those backups are encrypted, but Apple holds the key to unlock them, which renders that encryption useless. So even if you use the Messages in iCloud syncing option, any messages stored on your device are contained in iCloud backups and can therefore be accessed by Apple. The only way around this is to disable iCloud Backup and back up instead to your own computer. Likewise, your messages are not saved in your backups, so that’s safe too. You can, however, transfer your account message history to a new device, but that’s done by transferring directly, and the old device is disabled. In summary, if you want privacy, use Signal. But if you’re using WhatsApp, enjoy those new safeguards, but remember that Facebook is still collecting everything but the contents of your messages.
