7 ms·

There's no way for you to check the claims though, you have to trust Zuck/FB.

by Dma54rhs 6y ago

fshbbdssbbgdd 6y ago
WhatsApp’s E2E encryption occurs on your device, in binaries that you can decompile.
- 0xy 6y ago
  Except the key is backed up to the cloud by default, subject to court orders. You may have declined to do this, but have your contacts?
  - pgalvin 6y ago
    You’re definitely, definitely wrong. This is not true. WhatsApp messages have E2E encryption by default, you can not opt out, and the keys (each message has a different one) are never sent to WhatsApp or anybody else. Users may OPTIONALLY enable a cloud backup, which puts an encrypted backup on iCloud or Google Drive. WhatsApp (Facebook) holds the key for this, but not the data, and law enforcement would need the cooperation of Facebook and Google/Apple to access the messages. But that is all completely opt-in. By default, messages are not backed up, contrary to what you said. Full disclosure: I use WhatsApp but am eager to switch away from it a soon as Signal implements a local backup on iOS.
    - ffpip 6y ago
      > WhatsApp (Facebook) holds the key for this, but not the data, and law enforcement would need the cooperation of Facebook and Google/Apple to access the messages. It is a plaintext backup to Google Drive, whatsapp does not encrypt it before uploading it to Drive or iCloud. https://news.ycombinator.com/item?id=26458102 https://news.ycombinator.com/item?id=26458102 > But that is all completely opt-in You cannot control your contacts backup settings. Every contact I have (100+) has enabled the backup option, meaning all my 'e2ee' chats are uploaded in plaintext to Google servers. With Telegram, I can be sure e2ee/secret chats with my contacts are not going anywhere other than the device they were delivered to.
  - lrem 6y ago
    It does not back up keys. In case of a key loss, a new one is generated and all your contacts get a warning that your key changed.
vbezhenar 6y ago
You can reverse-engineer an App and check its logic and protocol. Whatsapp is popupar enough, so I'm sure that many people do that and if E2E were fake, they would let everyone know.
- paulryanrogers 6y ago
  Yet WA defaults to not notifying contacts when keys change. So silent interception is more likely to go unnoticed. And any app could send an automatic update with a backdoor at any moment. Disassembly and analysis is also harder with binaries than original sources and an open, reproducible build process.
  - foepys 6y ago
    Did they change this? I distinctly remember that after WhatsApp introduced e2e encryption I got a message every time somebody got a new phone. Haven't seen one in a while, though.
- simlevesque 6y ago
  That is a fallacy. It's like saying that something is unhackable because it has not been hacked.

There's no way for you to check the claims though, you have to trust Zuck/FB.

fshbbdssbbgdd 6y ago

WhatsApp’s E2E encryption occurs on your device, in binaries that you can decompile.

0xy 6y ago
Except the key is backed up to the cloud by default, subject to court orders. You may have declined to do this, but have your contacts?
- pgalvin 6y ago
  You’re definitely, definitely wrong. This is not true. WhatsApp messages have E2E encryption by default, you can not opt out, and the keys (each message has a different one) are never sent to WhatsApp or anybody else. Users may OPTIONALLY enable a cloud backup, which puts an encrypted backup on iCloud or Google Drive. WhatsApp (Facebook) holds the key for this, but not the data, and law enforcement would need the cooperation of Facebook and Google/Apple to access the messages. But that is all completely opt-in. By default, messages are not backed up, contrary to what you said. Full disclosure: I use WhatsApp but am eager to switch away from it a soon as Signal implements a local backup on iOS.
  - ffpip 6y ago
    > WhatsApp (Facebook) holds the key for this, but not the data, and law enforcement would need the cooperation of Facebook and Google/Apple to access the messages. It is a plaintext backup to Google Drive, whatsapp does not encrypt it before uploading it to Drive or iCloud. https://news.ycombinator.com/item?id=26458102 https://news.ycombinator.com/item?id=26458102 > But that is all completely opt-in You cannot control your contacts backup settings. Every contact I have (100+) has enabled the backup option, meaning all my 'e2ee' chats are uploaded in plaintext to Google servers. With Telegram, I can be sure e2ee/secret chats with my contacts are not going anywhere other than the device they were delivered to.
- lrem 6y ago
  It does not back up keys. In case of a key loss, a new one is generated and all your contacts get a warning that your key changed.

vbezhenar 6y ago

You can reverse-engineer an App and check its logic and protocol. Whatsapp is popupar enough, so I'm sure that many people do that and if E2E were fake, they would let everyone know.

paulryanrogers 6y ago
Yet WA defaults to not notifying contacts when keys change. So silent interception is more likely to go unnoticed. And any app could send an automatic update with a backdoor at any moment. Disassembly and analysis is also harder with binaries than original sources and an open, reproducible build process.
- foepys 6y ago
  Did they change this? I distinctly remember that after WhatsApp introduced e2e encryption I got a message every time somebody got a new phone. Haven't seen one in a while, though.
simlevesque 6y ago
That is a fallacy. It's like saying that something is unhackable because it has not been hacked.