>To add insult to injury, WhatsApp permits rekeying to take place without any indication to the conversation's participants [in the default settings]. Agreed.

>To add insult to injury, WhatsApp permits rekeying to take place without any indication to the conversation's participants [in the default settings]. Agreed. A nice Twitter thread [0] by Mustafa Al-Bassam back at the end of November on how that might be exploited by GCHQ: >Ian Levy of GCHQ has released an essay on how law enforcement should get access to end-to-end encrypted communications. Here is the critical bit to pay attention to. They're proposing to exploit the fact that users don't verify each other's public keys, and inject bad keys. Then this [1] later in the same thread by Twitter @inag_fc: >This is a coordinated attack by 5 eyes. They slipped it through AU parliament in the week, presumably as some horse trading because there was practically no debate nor warning, beyond the normal straw man proposals. [0] https://twitter.com/musalbas/status/1068179464197156864 https://twitter.com/musalbas/status/1068179464197156864 [1] https://twitter.com/iang_fc/status/1071373264646225920 https://twitter.com/iang_fc/status/1071373264646225920