4 ms·

What happens when I log on to WhatsApp Web? How they send my private key from my phone to my web browser?

by darkhorn 11y ago

nickik 11y ago
They do not. They create a e2e connection between your phone and your browser. Everything goes threw the phone.
- osweiller 11y ago
  To post a follow-up comment, what happens when you lose your phone, or simply move to a new phone? Presumably you've lost all of your private keys (I mean...obviously they must not upload them or this would all be farce), message history, etc, right?
  - nickik 11y ago
    Well, the phone number is the identifier. What would happen is that you get a new phone, idenftify via phone number. It would generate new keys but your contacts are still around. You contacts all the notifications (if they have turned them on) that you have new keys. I am not sure about chat history, you think its moved to the cloud if you have that activated. Im not 100% on any of this, but I think that is how it works. If you want something that is not bound to your phone, Threema is pretty nice. If you lose your phone and you have no backup, its gone.
  - pfg 11y ago
    WhatsApp allows you to (optionally) backup your chat history to iCloud or Google Drive. Moving to a new device involves restoring that backup. Your contacts will also have to re-verify your fingerprint. This, of course, is also a way for adversaries to get to your chat history. The backups are not encrypted using a key under your control, so law enforcement could force WhatsApp, Google or Apple to hand over any backups.
  - tinus_hn 11y ago
    Your message history is lost unless you back it up yourself. Your contacts receive a message stating you changed the key once you send them a message or they send you one. I'd presume any messages that were sent before you activated the new key, but not received yet, cannot be decrypted any more. I do not know how this works with push messages though; it used to be such that these can only be sent as-is so the server would need the key.
- venomsnake 11y ago
  That is not extremely secure.
  - tinus_hn 11y ago
    It cannot be secure because the webpage has access to the chat contents and is running code that came from Whatsapp. Whatsapp could change the code so it logs the contents from your phone back to them and you would have no way to know unless you log and check the javascript that comes with the page every time you open it. Similarly you have no way of knowing that the client is not sending your keys to the Whatsapp servers though. You just have to trust them.
    - trimbo 11y ago
      Plus, for many users, a number of Chrome extensions have access to the data on that web page.

What happens when I log on to WhatsApp Web? How they send my private key from my phone to my web browser?

nickik 11y ago

They do not. They create a e2e connection between your phone and your browser. Everything goes threw the phone.

osweiller 11y ago
To post a follow-up comment, what happens when you lose your phone, or simply move to a new phone? Presumably you've lost all of your private keys (I mean...obviously they must not upload them or this would all be farce), message history, etc, right?
- nickik 11y ago
  Well, the phone number is the identifier. What would happen is that you get a new phone, idenftify via phone number. It would generate new keys but your contacts are still around. You contacts all the notifications (if they have turned them on) that you have new keys. I am not sure about chat history, you think its moved to the cloud if you have that activated. Im not 100% on any of this, but I think that is how it works. If you want something that is not bound to your phone, Threema is pretty nice. If you lose your phone and you have no backup, its gone.
- pfg 11y ago
  WhatsApp allows you to (optionally) backup your chat history to iCloud or Google Drive. Moving to a new device involves restoring that backup. Your contacts will also have to re-verify your fingerprint. This, of course, is also a way for adversaries to get to your chat history. The backups are not encrypted using a key under your control, so law enforcement could force WhatsApp, Google or Apple to hand over any backups.
- tinus_hn 11y ago
  Your message history is lost unless you back it up yourself. Your contacts receive a message stating you changed the key once you send them a message or they send you one. I'd presume any messages that were sent before you activated the new key, but not received yet, cannot be decrypted any more. I do not know how this works with push messages though; it used to be such that these can only be sent as-is so the server would need the key.
venomsnake 11y ago
That is not extremely secure.
- tinus_hn 11y ago
  It cannot be secure because the webpage has access to the chat contents and is running code that came from Whatsapp. Whatsapp could change the code so it logs the contents from your phone back to them and you would have no way to know unless you log and check the javascript that comes with the page every time you open it. Similarly you have no way of knowing that the client is not sending your keys to the Whatsapp servers though. You just have to trust them.
  - trimbo 11y ago
    Plus, for many users, a number of Chrome extensions have access to the data on that web page.