WhatsApp adds encrypted backups

WhatsApp will allow its more than 2 billion users to fully encrypt their message backups, the Facebook-owned app said on Friday.

The plan, which WhatsApp details in a white paper before rolling out to users on iOS and Android in the coming weeks, aims to secure the backups that WhatsApp users already send to Google Drive or Apple’s iCloud, making them unreadable without an encryption key. . WhatsApp users who opt for encrypted backups will be prompted to either register a 64-digit encryption key or create a password linked to the key.

“WhatsApp is the first global messaging service of this scale to offer end-to-end encrypted messaging and backups, and achieving this was a very difficult technical challenge that required an entirely new framework for key storage and cloud storage. on all operating systems, ”Facebook CEO Mark Zuckerberg said in a statement.

Image: WhatsApp

If someone creates a password linked to their account’s encryption key, WhatsApp will store the associated key in a physical hardware security module, or HSM, which is maintained by Facebook and unlocked only when the correct password is entered WhatsApp. An HSM acts as a safe for the encryption and decryption of digital keys.

Once unlocked with its associated password in WhatsApp, the HSM provides the encryption key which in turn decrypts the account backup which is stored on Apple or Google servers. A key stored in one of WhatsApp’s HSM vaults will become permanently inaccessible if repeated password attempts are made. The hardware itself is located in Facebook-owned data centers around the world to protect against internet outages.

The system is designed to ensure that no one other than an account owner can access a backup, said WhatsApp manager Will Cathcart. The edge. He said the goal of allowing people to create simpler passwords is to make encrypted backups more accessible. WhatsApp will only know that a key exists in an HSM, not the key itself or the associated password to unlock it.

WhatsApp’s move comes as governments around the world like India – WhatsApp’s largest market – threaten to break how encryption works. “We expect to be criticized by some for this,” Cathcart said. “This is nothing new to us … I firmly believe that governments should push us to have more security and not do the opposite.”

WhatsApp’s announcement means the app goes further than Apple, which encrypts iMessages but still holds the keys to encrypted backups; this means that Apple can help with the recovery, but also that it may be forced to hand over the keys to law enforcement. Cathcart said WhatsApp has been working to make encrypted backups a reality over the past two years, and that while they do agree to start, he hopes, over time, “that it works for everyone.”