3 ms·
> See, if I have the keypair, then for WhatsApp to subvert my conversation it needs to send the private key to itself -- something it can only do when it's not
by ultramancool 10y ago
> See, if I have the keypair, then for WhatsApp to subvert my conversation it needs to send the private key to itself -- something it can only do when it's not looking.
> This means it would need to let me download the keys before it does any networking. If it absolutely must network before letting me have the keys, then it can allow me to install my own (new) keys. Then, WhatsApp doesn't know when I'm not looking.
Look up signed Diffie-Hellman. Have fun trying to capture that with Wireshark. You'd need a custom MITM tool. That or you're suggesting the developer gives up forward secrecy and passive attack resistance.