Facebook owns what’s app and they can read any message on the service, they’ve also been known to give logs and messages to law enforcement agencies at request without warrants.

Another thing to consider is that the US (and probably most 5 eyes countries) have agencies with a "store now and decrypt later" policy. They theoretically could be capturing certain types of traffic and storing it in the massive NSA fusion centers. If you come under suspicion at some later date and the quantum technology has advanced, you could be hosed. Now what's the legality of storing "precrime material" without a warrant? I wouldn't think it is legal but that doesn't seem to stop the 3 letter agencies these days.

They don't have to attack the encryption, there are far easier ways. Compromising your phone then reading the notification contents for example. If a smallish company can do this (pegasus) imagine what the resources of the US intelligence complex can do.

Everything I've ever heard about government cryptography from people close to me is that the government (FBI, military) is wildly far ahead of what's available publicly. I wouldn't count on anything you do on the Internet to be truly private.

Given enough time anything can be decrypted, so, yes. The actual question is if they would have any interest in doing so given the large investment of time and resources required when they can simply hit you with a wrench until you give them the password to your device or in more enlightened Countries, just buy the data directly form Meta. You don't control the server so there is no assurance of any encryption being secure beyond your chat not being interesting enough to justify the attention.

If you did not enable end-to-end encryption for your WhatsApp backups on Google Drive, the US government could possibly compel Google to hand over your encrypted (but not end-to-end encrypted) backup, and compel Meta to hand over the decryption keys for the backup.

Details about how WhatsApp backup works: The Workings of WhatsApp’s Backups (and Why You Should Enable End-to-End Encrypted Backups).

No. One-to-one chats are E2EE. However, group chats, if forced by government, can be subpoenaed and monitored by WhatsApp admin team temporarily.

However, the best way to break encryption is usually a $5 wrench on someone's head, which is how governments and authorities really do it.

People got arrested for WhatsApp messages in my country so there is a backdoor built in no question

No. They cant decrypt your chats. They can however backdoor your device and see the pre or post delivery message. Its not hard for them to do. Technically or legally.

If they arent currently logging activity on your device then turning on self destruct messaging could mitigate their ability to spy on you. Unfortunately all your chat partners have to do it too.

The code is not open source, so it's hard to verify how good the encryption is or if it has backdoors.

I'm not an expert in cryptography, but from my limited knowledge, the cryptographic keys used are very important. If Meta or the government can somehow know the decryption key to your messages or predict it, then they can see your messages.

But they most likely don't need to decrypt it in transit. One of the vulnerabilities in this system is Google firebase, which delivers notifications to your phone when WhatsApp messages arrive. Ever noticed how those notifications include the message content and the sender? Google has access to this information, despite the encryption.

That's just an example. Google has access to a lot on your phone.

Another thing to consider is message metadata. The content of your message is encrypted, but what about information like the destination of your message, its recipients, time sent and received, and frequency? I'd even argue this is more important than content in many situations. Sometimes, linking person A to person B tells me a lot about person A.

They can just ask Meta for the chats lol, don’t even have to probably already have access.

It's uses the Signal Encryption Protocol as far we know. So they shouldn't be possible too, Signals Encryption Protocol is even quantum resistant.

Open source can make it easier to audit software, but we're long past the point where we can't audit unfree and/or closed source software. Open source is great and important, but the debate around open source regarding trust and security is often a sideshow.

If 1. all participating devices are sufficiently secure and will be sufficiently secure in the future, 2. no participating device backs up your conversations to the cloud or only does so in a sufficiently encrypted manner, and 3. no participating user leaks your information in any other way, then yes, the general expectation is that your WhatsApp chats with people are encrypted. Keep in mind that defaults, nudges, and people work against you in this long list of requirements.

Oh, and... more importantly... metadata. But that's a separate issue. WhatsApp's encryption claim could be entirely true, but still work against user privacy, simply because those conditions are almost never true ...and also, again, meta data.

Users conscientious enough to consistently meet all of these requirements could simply use a platform deemed less hostile to user privacy, such as Matrix or Signal.

yowsup is an Open Source implementation of the WhatsApp protocol. So there is proper end-to-end encryption on the protocol level - that would only leave the possibility of having a backdoor in the "official" WhatsApp client, but none has been found so far. BTW, people do actually (try to) decompile the WhatsApp client (or the WhatsApp Web client which implements the same protocol and functionality) and look what it is doing.

For anyone really curious, it's not too difficult to hook into the WhatsApp Web client with your web browsers Javascript debugger and see what messages are sent.

https://link.springer.com/chapter/10.1007/978-3-031-38551-3_11

Dated August 2023.

The better question is, do you trust meta at all? I'm sure they have a way to read everyone's chats and would gladly hand over yours to the government if they want it.

For all the bogosities and bullshit of Element/Matrix, fact is it's still the only protocol and platform I trust for private comms.

It is impossible to say. If you are that concerned you should use something else

I personally wouldn't touch WhatsApp with a 10foot pole. As it is owned by Facebook, the company who earlier this year paid a company to compromise TAILS OS to find a pedo. Which its not the fact that they threw a pedo in jail. But the fact they compromised anonymity and in no way are a government body!!! So glowies be glowing hard at Facebook.

They also have done other spooky shit. Which is why the only reason I use Facebook is to sell my shit.

We could also talk about the OS and hardware your using to message people for security. If you want to know more read permanent record by Edward snowden. Its a great book and talks alot about PRISM and other spooky stuff

It does not matter how good the encryption is. The app on your device has to be able to decrypt the content to be able to show it to you. If it has access to the decrypted data, it could just send it somewhere. If it has access to your private key, it can leak it. Even if the app is open source, you do not know if the binary on your phone matches that source, unless it uses reproducible builds and you actually verify the binary on your particular device, after each update.