Facebook doesn't have access to WhatsApp messages. WhatsApp uses the same end-to-end encryption protocol as Signal. We know this is true because the app has been extensively reverse engineered to create these third party clients among other reasons.
WhatsApp is closed source, so you have no idea what it's doing. And they can push an update doing whatever they wish to you at any moment. You have to rely on Facebook pinky-swearing that it is what they say it is. And I promise you it isn't what they say it is.
Being open source isn't necessary or sufficient to be able to audit a piece of software. Software can be audited even if it's closed source (for example by reverse engineering, although it's more difficult), and even if it's open source it might still be impractically difficult for non-experts to audit.
WhatsApp client is made by Facebook. It must see plaintext so it can put it on the screen. If it doesn’t send it anywhere yet, good - but it’s borrowed time.
Yes, they very publicly state that they do not have access and I have yet to see a reason to not believe them in that regard.
All big Facebook data leaks and hacks have just exploited not very well known APIs or badly set privacy settings. But nothing that was secret.
Q: Why would Iran block Signal but not WhatsApp if they actually use the exact same protocol?
A: Because Facebook has cut a deal with the regime to give them access to things they could not get access to with Signal
I suppose it could be that blocking WhatsApp would cause too much disruption, so the Iranian regime tolerates it for now, but I put much more weight on Facebook just rolling over.
There are other instances of WhatsApp being allowed and other allegedly as-secure platforms being banned. It could be chance or network effects, but my guess is that Facebook has built in tools to comply with those regimes' spying demands. Perhaps they even push locale-specific versions of the app.
Law enforcement has access to a list of people who forwarded particular links or media.
This indicates that e2e has some bypasses or exceptions. It would be pretty much impossible to unearth the details though.
