4 ms·

Just saying, but WhatsApp encrypt communications the same way Signal does, it's good enough for me.

by efwfwef 6y ago

im3w1l 6y ago
WhatsApp uses dark patterns to encourage unencrypted cloud backups.
- tgsovlerkhgsel 6y ago
  ... and it doesn't matter if you know how to avoid those unless your friends also do so. BTW, is there an authoritative source whether these cloud backups to Google Drive are unencrypted/encrypted with Google keys, or encrypted with keys held by Facebook? I see no reason not to encrypt them the same as local backups (with a key that is held by Facebook, and provided to your phone once they verify your phone number). The difference between these against the US government filing warrants is just one piece of paper, but against an attacker that compromises your Google account, it does make a significant difference.
not_really 6y ago
It absolutely does not.
- meibo 6y ago
  WhatsApp's encryption scheme was designed by Open Whisper Systems, which is now Signal, and even uses the Signal protocol library: http://www.cdn.whatsapp.net/security/WhatsApp-Security-Whitepaper.pdf http://www.cdn.whatsapp.net/security/WhatsApp-Security-White... Of course you got all the metadata going to FB, but it's still a good messenger feature-wise for now, so I'll keep it as a backup in case my favorite privacy-conscious messenger is down again for 10 hours.
  - orestarod 6y ago
    What good is e2e encryption that is essentially becomes mere in transit encryption, since WhatsApp will filter your messages BEFORE they are sent to see if it needs to take any action? (Which action is of course phoning home, outside the precious Signal Protocol)
    - meibo 6y ago
      How is it in-transit encryption? How does Facebook decrypt it? Do you have any facts other than "it's Facebook, so it must be bad"? There is no evidence that messages ever leak outside of WhatsApp via means other than potential unencrypted backups that you may or may not be using at a cloud provider not connected to Facebook or your IME. If you're targeted by NSO or whatever nation state that would be interested enough in you to compromise you, you got other things to worry about.
    - Spivak 6y ago
      I mean that argument applies equally to Signal since you have to use their client and the services are architected in the same way. WhatsApp does filter messages on the client side but it’s stuff like submitting image hashes to the CP database. If Signal reaches the scale of WhatsApp they will be forced into doing this as well. And nothing in Signal’s architecture prevents this kind of data exfiltration the same as WhatsApp.
    - tgsovlerkhgsel 6y ago
      source?
- efwfwef 6y ago
  Unfortunately do you have anything to back your claim? Because there is a number of official sources pointing out that Whastapp uses the signal protocol to do both 1:1 and group chat

Just saying, but WhatsApp encrypt communications the same way Signal does, it's good enough for me.

im3w1l 6y ago

WhatsApp uses dark patterns to encourage unencrypted cloud backups.

tgsovlerkhgsel 6y ago
... and it doesn't matter if you know how to avoid those unless your friends also do so. BTW, is there an authoritative source whether these cloud backups to Google Drive are unencrypted/encrypted with Google keys, or encrypted with keys held by Facebook? I see no reason not to encrypt them the same as local backups (with a key that is held by Facebook, and provided to your phone once they verify your phone number). The difference between these against the US government filing warrants is just one piece of paper, but against an attacker that compromises your Google account, it does make a significant difference.

not_really 6y ago

It absolutely does not.

meibo 6y ago
WhatsApp's encryption scheme was designed by Open Whisper Systems, which is now Signal, and even uses the Signal protocol library: http://www.cdn.whatsapp.net/security/WhatsApp-Security-Whitepaper.pdf http://www.cdn.whatsapp.net/security/WhatsApp-Security-White... Of course you got all the metadata going to FB, but it's still a good messenger feature-wise for now, so I'll keep it as a backup in case my favorite privacy-conscious messenger is down again for 10 hours.
- orestarod 6y ago
  What good is e2e encryption that is essentially becomes mere in transit encryption, since WhatsApp will filter your messages BEFORE they are sent to see if it needs to take any action? (Which action is of course phoning home, outside the precious Signal Protocol)
  - meibo 6y ago
    How is it in-transit encryption? How does Facebook decrypt it? Do you have any facts other than "it's Facebook, so it must be bad"? There is no evidence that messages ever leak outside of WhatsApp via means other than potential unencrypted backups that you may or may not be using at a cloud provider not connected to Facebook or your IME. If you're targeted by NSO or whatever nation state that would be interested enough in you to compromise you, you got other things to worry about.
  - Spivak 6y ago
    I mean that argument applies equally to Signal since you have to use their client and the services are architected in the same way. WhatsApp does filter messages on the client side but it’s stuff like submitting image hashes to the CP database. If Signal reaches the scale of WhatsApp they will be forced into doing this as well. And nothing in Signal’s architecture prevents this kind of data exfiltration the same as WhatsApp.
  - tgsovlerkhgsel 6y ago
    source?
efwfwef 6y ago
Unfortunately do you have anything to back your claim? Because there is a number of official sources pointing out that Whastapp uses the signal protocol to do both 1:1 and group chat