3 ms·

Firstly, by default WhatsApp backs up your encryption keys to the cloud making your messages totally accessible and not E2E encrypted at all. Secondly, Telegra

by 0xy 6y ago

Firstly, by default WhatsApp backs up your encryption keys to the cloud making your messages totally accessible and not E2E encrypted at all. Secondly, Telegram secret messages have been repeatedly proven to be E2E encrypted, including by independent researchers, so "Pavel can read all your messages!" is just misinformation. As for the alternatives, well Signal is very likely compromised given their server repo is abandoned and they refuse to address why (they maintain a closed source version). Why else would an "open source project" act that way, if not gagged?

pgalvin 6y ago
This is NOT true. Message keys are never sent to the cloud in WhatsApp, no matter what. You’re referring to the optional backup that requires users to opt-in. This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key (but not the data) to that. Both companies would need to cooperate to read your messages, and this is OPT-IN by default. This isn’t E2EE, but it’s opt-in by default. It also has nothing to do with the key exchange for E2EE messages. You’re comparing WhatsApp, with all messages end-to-end encrypted and where the only way to compromise that is an opt-in cloud backup, to Telegram, where the vast majority of people (anyone using cloud chats) do not use Telegram’s encryption. Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.
- ffpip 6y ago
  > This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key It is a plain text backup to Google Drive. There is no key Whatsapp holds. Google can read it all, and has revealed the chats to help the Govt in multiple high profile cases here in India. You can extract it yourself, with the credentials of your Google account- https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithread https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre... > You’re referring to the optional backup that requires users to opt-in. With telegram, if you enable secret chats, it is never backed up to the cloud. It is a guarantee, unlike Whatsapp where you do not know whether your contact has enabled cloud backups Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.
Marsymars 6y ago
> Signal is very likely compromised given their server repo is abandoned Signal has client-side E2E encryption.
- 0xy 6y ago
  I don't understand this argument, it's okay for an "open source project" to abandon their server repo with no explanation and if it's compromised and leaking metadata to third parties it's fine? People are killed over metadata.
  - BelenusMordred 6y ago
    > it's okay for an "open source project" to abandon their server repo with no explanation Show me how you can prove what they publish on github is running on Signal servers and I'll agree here. Otherwise this point is moot. They could publish cute cat pics on the repo instead for all I care, it's the same level of trust involved.

by 0xy 6y ago

pgalvin 6y ago

This is NOT true. Message keys are never sent to the cloud in WhatsApp, no matter what. You’re referring to the optional backup that requires users to opt-in. This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key (but not the data) to that. Both companies would need to cooperate to read your messages, and this is OPT-IN by default. This isn’t E2EE, but it’s opt-in by default. It also has nothing to do with the key exchange for E2EE messages. You’re comparing WhatsApp, with all messages end-to-end encrypted and where the only way to compromise that is an opt-in cloud backup, to Telegram, where the vast majority of people (anyone using cloud chats) do not use Telegram’s encryption. Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.

ffpip 6y ago
> This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key It is a plain text backup to Google Drive. There is no key Whatsapp holds. Google can read it all, and has revealed the chats to help the Govt in multiple high profile cases here in India. You can extract it yourself, with the credentials of your Google account- https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithread https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre... > You’re referring to the optional backup that requires users to opt-in. With telegram, if you enable secret chats, it is never backed up to the cloud. It is a guarantee, unlike Whatsapp where you do not know whether your contact has enabled cloud backups Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.

Marsymars 6y ago

> Signal is very likely compromised given their server repo is abandoned Signal has client-side E2E encryption.

0xy 6y ago
I don't understand this argument, it's okay for an "open source project" to abandon their server repo with no explanation and if it's compromised and leaking metadata to third parties it's fine? People are killed over metadata.
- BelenusMordred 6y ago
  > it's okay for an "open source project" to abandon their server repo with no explanation Show me how you can prove what they publish on github is running on Signal servers and I'll agree here. Otherwise this point is moot. They could publish cute cat pics on the repo instead for all I care, it's the same level of trust involved.