> If we don't care about being secure against an attacker who controls Facebook then what was the point of end-to-end encryption in the first place? As a user

> If we don't care about being secure against an attacker who controls Facebook then what was the point of end-to-end encryption in the first place? As a user of WhatsApp, I'd prefer if it was fully robustly end-to-end encrypted, in an auditable App, if it was still usable enough I could talk to my family with it. I think all the more privacy conscious folk on HN could agree with that ideal. But I don't think we (yet) know how to achieve that ideal. [The hard part being getting family/friends on it reliably]. What is on offer is: End-to-end encryption which has some usability tradeoffs, that leaves it vulnerable to[0]: - A code backdoor of some form in the App - [As in this issue] an attack where the server MITMs it in limited circumstances by switching recipient keys for undelivered messages. First off, this secures against mass passive monitoring on the wire, or even in the internal data center infrastructure, which the non-e2e transport encryption you mention does not. Second, exploiting either of these issues en masse would run the risk of FB/WhatsApp getting caught. Maybe through a black-box audit of the App, or someone detects mass MITM'ing because they have key change notifications turned on. [Lets leave out the scenario of someone internal leaking what's happening.] So my best judgement, as a user, is that these attacks are not likely to be happening en masse, because they would result in a large business risk to WhatsApp. > If you're going to "compromise" that far you might as well just use any number of centralised messengers with transport encryption. In that case [without e2e] the server would see all the messages in the clear. Absent a leak, there's no way they would be caught supporting a mass-monitoring program. They could allow their infrastructure to be passively monitored, giving plausible deniability while cooperating. That's clearly a different threat model. I don't see why WhatsApp would have introduced this feature, and then compromised it in a way that risks getting caught. That would be a huge business risk for dubious benefit. I could see they could be forced to do an attack on a limited number of individuals, risking getting caught. Again, I'm hoping that is an expensive enough business risk that it doesn't happen often, if ever. But in this model, 1B peoples messages will be secure the vast majority of the time against pervasive monitoring. [0] based on my understanding of these issues; obviously as a spectator I don't claim to have an exhaustive list of vulnerabilities/issues.