4 ms·
How do you know it has E2E? The app itself is closed source. As far as anyone is concerned, it's all claims. How do they handle the private keys, for example? A
by sonicggg 6y ago
How do you know it has E2E? The app itself is closed source. As far as anyone is concerned, it's all claims. How do they handle the private keys, for example? Any backdoor?
- jeroenhd 6y agoWhatsApp reverse engineering happens all the time. There's news channels out there with people dedicated to being the first to announce references to upcoming features every update. The same can be said of Signal or any other chat application distributed through Google Play. How do you know the binary corresponds to the source? Good luck getting reproducible builds on Android or iOS. If you want to be sure your chat app is secure, you need to review and compile the code every time. And, of course, you need the knowledge and skills of a good cryptographer to determine hidden backdoors in the algorithms. Whatsapp is reasonably secure, as long as you don't upload your unencrypted chats to Google Drive (the backup functionality). Telegram, with E2E enabled, hasn't been proven insecure enough despite its weird custom crypto scheme. However, WhatsApp brings E2E to group chats where Telegram needs manual configuration in private chats to do so. If we want to bring E2E to the masses, WhatsApp is the best option for now. I'm hoping Matrix will change this or Telegram will implement proper crypto, but until then, WhatsApp is probably the best option we have.
- ryanlol 6y agoReproducible builds are a red herring, they do nothing to defend against bugdoors.
- jolux 6y agoIt uses the Signal Protocol/Axolotl Ratchet and Open Whisper Systems helped them integrate it, which is a big reputational stake from very trustworthy people.
- ryanlol 6y agoOpen sourcing whatsapp would solve precisely zero of these problems. There’s no way to know if a bugdoor is a backdoor or just a mistake.