Hacker News new | ask | show | jobs
by keyme 1984 days ago
I've posted this here before.

> It is encrypted with a per user key known to WhatsApp.

This is no longer true! For a few years now. The backup is stored on Google Drive in plain text.

https://faq.whatsapp.com/android/chats/about-google-drive-ba...
2 comments
FiloSottile 1984 days ago
That page doesn't say that, and "tied to the phone number" sounds like they will only give you the key if you can authenticate via SMS.

Do you have a better cite or did you check directly recently?

link
keyme 1984 days ago
You can extract it yourself.

https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre...

I do not vouch for this repo, but it gets the job done.

The only creds required are your Google account creds. No per-user whatsapp keys necessary.

link
FiloSottile 1984 days ago
That's disappointing, thank you for the link.
link
beagle3 1984 days ago
https://github.com/B16f00t/whapa (among other tools) appears to download it from Google without requiring any key from facebook or a rooted device.

I haven't tried this specific tool yet (or others recently) but it was definitely possible in the past without requiring any key from FB/WA.

link
londons_explore 1984 days ago
> authenticate via SMS

It's now "authenticate via SMS and pin (if enabled), or authenticate via SMS and wait 7 days (if pin enabled)"

link
Dumbdo 1984 days ago
I'm sorry, but where did you get that information from? The FAQ only states:

> Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive.

That makes sense, why would you re-encrypt the messages with the end-to-end-key which is individual for each chat, if you could simply use a symmetric encryption for backups?

So the statement

> It is encrypted with a per user key known to WhatsApp.

could still hold true, there's no information contrary to that in the FAQ (but no information indicating another kind of encryption either).

link