Facebook owns what’s app and they can read any message on the service, they’ve also been known to give logs and messages to law enforcement agencies at request without warrants.

Probably not, but it's impossible to verify. There's a strong argument for open source when security really matters.

You bet your ass they can. Since when has Facebook taken anybody's privacy seriously? And you remember all the Snowden leaks? Like how AT&T has been a government apparatus for spying for decades? Or how about the way that the USA taps under sea cables to monitor data, causing China to build totally parallel backbone infrastructure

The better question is whether Signal, despite being open source, is actually secure. It's very plausible that the govt has backdoors somewhere, for either encryption, the OS, the programming language, the app store, or some random dependency lib

The answer is yes, the US government spies on everything, and has a complete profile of everyone

Another thing to consider is that the US (and probably most 5 eyes countries) have agencies with a "store now and decrypt later" policy. They theoretically could be capturing certain types of traffic and storing it in the massive NSA fusion centers. If you come under suspicion at some later date and the quantum technology has advanced, you could be hosed. Now what's the legality of storing "precrime material" without a warrant? I wouldn't think it is legal but that doesn't seem to stop the 3 letter agencies these days.

They don't have to attack the encryption, there are far easier ways. Compromising your phone then reading the notification contents for example. If a smallish company can do this (pegasus) imagine what the resources of the US intelligence complex can do.

Everything I've ever heard about government cryptography from people close to me is that the government (FBI, military) is wildly far ahead of what's available publicly. I wouldn't count on anything you do on the Internet to be truly private.

Given enough time anything can be decrypted, so, yes. The actual question is if they would have any interest in doing so given the large investment of time and resources required when they can simply hit you with a wrench until you give them the password to your device or in more enlightened Countries, just buy the data directly form Meta. You don't control the server so there is no assurance of any encryption being secure beyond your chat not being interesting enough to justify the attention.

If you did not enable end-to-end encryption for your WhatsApp backups on Google Drive, the US government could possibly compel Google to hand over your encrypted (but not end-to-end encrypted) backup, and compel Meta to hand over the decryption keys for the backup.

Details about how WhatsApp backup works: The Workings of WhatsApp’s Backups (and Why You Should Enable End-to-End Encrypted Backups).

https://link.springer.com/chapter/10.1007/978-3-031-38551-3_11

Dated August 2023.

No. They cant decrypt your chats. They can however backdoor your device and see the pre or post delivery message. Its not hard for them to do. Technically or legally.

If they arent currently logging activity on your device then turning on self destruct messaging could mitigate their ability to spy on you. Unfortunately all your chat partners have to do it too.

People got arrested for WhatsApp messages in my country so there is a backdoor built in no question

this post has some good information.

tldr - you cant fully verify

https://security.stackexchange.com/a/79090

Open source can make it easier to audit software, but we're long past the point where we can't audit unfree and/or closed source software. Open source is great and important, but the debate around open source regarding trust and security is often a sideshow.

If 1. all participating devices are sufficiently secure and will be sufficiently secure in the future, 2. no participating device backs up your conversations to the cloud or only does so in a sufficiently encrypted manner, and 3. no participating user leaks your information in any other way, then yes, the general expectation is that your WhatsApp chats with people are encrypted. Keep in mind that defaults, nudges, and people work against you in this long list of requirements.

Oh, and... more importantly... metadata. But that's a separate issue. WhatsApp's encryption claim could be entirely true, but still work against user privacy, simply because those conditions are almost never true ...and also, again, meta data.

Users conscientious enough to consistently meet all of these requirements could simply use a platform deemed less hostile to user privacy, such as Matrix or Signal.

The code is not open source, so it's hard to verify how good the encryption is or if it has backdoors.

I'm not an expert in cryptography, but from my limited knowledge, the cryptographic keys used are very important. If Meta or the government can somehow know the decryption key to your messages or predict it, then they can see your messages.

But they most likely don't need to decrypt it in transit. One of the vulnerabilities in this system is Google firebase, which delivers notifications to your phone when WhatsApp messages arrive. Ever noticed how those notifications include the message content and the sender? Google has access to this information, despite the encryption.

That's just an example. Google has access to a lot on your phone.

Another thing to consider is message metadata. The content of your message is encrypted, but what about information like the destination of your message, its recipients, time sent and received, and frequency? I'd even argue this is more important than content in many situations. Sometimes, linking person A to person B tells me a lot about person A.

yowsup is an Open Source implementation of the WhatsApp protocol. So there is proper end-to-end encryption on the protocol level - that would only leave the possibility of having a backdoor in the "official" WhatsApp client, but none has been found so far. BTW, people do actually (try to) decompile the WhatsApp client (or the WhatsApp Web client which implements the same protocol and functionality) and look what it is doing.

For anyone really curious, it's not too difficult to hook into the WhatsApp Web client with your web browsers Javascript debugger and see what messages are sent.

Strongly depends on which government.

They can just ask Meta for the chats lol, don’t even have to probably already have access.

The better question is, do you trust meta at all? I'm sure they have a way to read everyone's chats and would gladly hand over yours to the government if they want it.