Cloud Hosting

WhatsApp said on Friday it will give its two billion users the option to encrypt their chat backups to the cloud, taking a significant step to put a lid on one of the tricky ways private communication between individuals on the app can be compromised.

The Facebook-owned service has end-to-end encrypted chats between users for more than a decade. But users have had no option but to store their chat backup to their cloud iCloud on iPhones and Google Drive on Android in an unencrypted format.

Tapping these unencrypted WhatsApp chat backups on Google and Apple servers is one of the widely known ways law enforcement agencies across the globe have for years been able to access WhatsApp chats of suspect individuals.

Now WhatsApp says it is patching this weak link in the system.

WhatsApp is the first global messaging service at this scale to offer end-to-end encrypted messaging and backups, and getting there was a really hard technical challenge that required an entirely new framework for key storage and cloud storage across operating systems, said Facebooks chief executive Mark Zuckerberg in a post announcing the new feature.

The company said it has devised a system to enable WhatsApp users on Android and iOS to lock their chat backups with encryption keys. WhatsApp says it will offer users two ways to encrypt their cloud backups, and the feature is optional.

In the coming weeks, users on WhatsApp will see an option to generate a 64-digit encryption key to lock their chat backups in the cloud. Users can store the encryption key offline or in a password manager of their choice, or they can create a password that backs up their encryption key in a cloud-based backup key vault that WhatsApp has developed. The cloud-stored encryption key cant be used without the users password, which isnt known by WhatsApp.

Image Credits: WhatsApp/supplied

We know that some will prefer the 64-digit encryption key whereas others want something they can easily remember, so we will be including both options. Once a user sets their backup password, it is not known to us. They can reset it on their original device if they forget it, WhatsApp said.

For the 64-digit key, we will notify users multiple times when they sign up for end-to-end encrypted backups that if they lose their 64-digit key, we will not be able to restore their backup and that they should write it down. Before the setup is complete, well ask users to affirm that theyve saved their password or 64-digit encryption key.

A WhatsApp spokesperson told TechCrunch that once an encrypted backup is created, previous copies of the backup will be deleted. This will happen automatically and there is no action that a user will need to take, the spokesperson added.

The move to introduce this added layer of privacy is significant and one that could have far-reaching implications.

End-to-end encryption remains a thorny topic of discussion as governments continue to lobby for backdoors. Apple was reportedly pressured to not add encryption to iCloud Backups after the FBI complained, and while Google has offered users the ability to encrypt their data stored in Google Drive, the company allegedly didnt tell governments before it rolled out the feature.

When asked by TechCrunch whether WhatsApp, or its parent firm Facebook, had consulted with government bodies or if it had received their support during the development process of this feature, the company declined to discuss any such conversations.

Peoples messages are deeply personal and as we live more of our lives online, we believe companies should enhance the security they provide their users. By releasing this feature, we are providing our users with the option to add this additional layer of security for their backups if theyd like to, and were excited to give our users a meaningful advancement in the safety of their personal messages, the company told TechCrunch.

WhatsApp also confirmed that it will be rolling out this optional feature in every market where its app is operational. Its not uncommon for companies to withhold privacy features for legal and regulatory reasons. Apples upcoming encrypted browsing feature, for instance,wont be made available to users in certain authoritarian regimes, such as China, Belarus, Egypt, Kazakhstan, Saudi Arabia, Turkmenistan, Uganda and the Philippines.

At any rate, Fridays announcement comes days after ProPublica reported that private end-to-end encrypted conversations between two users can be read by human contractors when messages are reported by users.

Making backups fully encrypted is really hard and its particularly hard to make it reliable and simple enough for people to use. No other messaging service at this scale has done this and provided this level of security for peoples messages, Uzma Barlaskar, product lead for privacy at WhatsApp, told TechCrunch.

Weve been working on this problem for many years, and to build this, we had to develop an entirely new framework for key storage and cloud storage that can be used across the worlds largest operating systems and that took time.

More here:
WhatsApp will finally let users encrypt their chat backups in the cloud - TechCrunch