I think the past few days of back-and-forth about this issue have made a few things clear: 1) The double-check was not widely understood as an indicator of any

I think the past few days of back-and-forth about this issue have made a few things clear: 1) The double-check was not widely understood as an indicator of any particular security state prior to the attention this has gotten. 2) Is it fairly easy to imagine a scenario in which the behavior of WhatsApp can be readily exploited - think of a journalist on the ground in Tahrir Square using WhatsApp to report on conditions, neither expecting nor receiving replies or confirmations, perhaps for hours at a time. 3) The matter of whether this is a "backdoor" or not is contentious, but also not terribly important to the stakeholders. 4) Moxie wholesale approves of the WhatsApp implementation. 5) WhatsApp does in fact provide substantial security for a common and important use case. So, where do we go from here? I think that those of us that care about freedom in the information age well-advised to remember that Moxie has done incredible, substantial, and landscape-shifting work in this space. Nevertheless, I also think that Moxie can provide a few more details and thoughts that will be hugely helpful to the community in thinking through the coming years of IM security. Specifically, I will quote the comment I made in the other article, addressing Moxie directly: Moxie, I think it's fair to say that you are the world thought leader on these matters right now. One thing that the rest of us are wondering right now is: > (Quoting Moxie, in response to my comment) I've been impressed with the level of care that WhatsApp has given to that requirement. To what degree do you really know that? Is there a place where we can read about your interactions with Facebook, the level of access they've given you, and the degree to which they have allowed your recommendations to shape the contours of their implementation? Nothing less than the strength of dissent lies in the balance of questions like these. > I think we should all remain open to ideas about how we can improve this UX within the limits a mass market product has to operate within, but that's very different from labeling this a "backdoor." I agree that the jump to scary terminology is dangerous. However, at the end of the day, I think that many of us have been trying to make a simple point that shows that there is a sort of crossing of that line: WhatsApp claimed that they were simply unable to intercept communications, and now we find out that, without any user interaction or approval, messages which haven't received the "double check" are re-transmitted when a new key is generated. So look: nobody here is trying to diminish your tireless work and your accomplishments in bringing freedom into the information age. But there are nuances here that are important, and fleshing them out is a big part of what this community is about.