It’s been a while since I looked it up, and I don’t use WhatsApp, but I believe it’s E2E encrypted but the mechanism they use allows their servers to also hold the keys to decrypt.

Presumably they hold a master key that all other keys are derived from.

Oh yeah they definitely aren’t to be seen as the “good guy” and they absolutely could make it impossible to hand over.

They are deciding to favour data/profits over people’s privacy.

BUT the distinction should still be made that they could be made to do it, regardless whether they want to.

Then there’s the whole other conversation around back doors (like the government asked Apple to do in their iPhones).

You’re straw manning. I didn’t say they act in good faith, but it’s important to make a distinction between them handing over the information and being made to.

For all I known they do hand it over willingly. I don’t know.

If they enabled it they wouldn’t have access to all of that information they can profit off of.

Technologically they could do it, they just don’t want to.

There’s a difference between willingly handing over information and being required to by law, though, right?

I’m no Meta fan, but presumably if they were served a warrant they can’t just say no?

That’s one of the benefits of E2E encryption, where nobody but the users have the keys. The company can say no, because they simply don’t have access to see them.

On a serious note, when I do make a mistake, I make sure everybody knows it.

It ensures those more junior know it’s ok to fuck up. But I will also write up a short summary/post mortem so everybody can learn from my mistake.

Seeing how teams handle mistakes is a good indicator of culture.

I’m aware I’m turning a joke into a serious discussion, so I’ll just shut up now.

As a developer with over a decades experience, I can assure you I contribute my fair share of fuck ups.

Nobody is immune to mistakes, regardless of level.

!remindMe 60 years.

Oh wait, no, we don’t that that here, do we.

I don’t have enough desire to check, but I’d assume they are encrypted AND salted so it’s not as easy as the top comment makes out.

If an instance was hacked, the hackers would get a hash and a salt. They’d still have to figure out what plaintext password + salt = hash.

use unique passwords with every account, everywhere.

This is the way.