3 ms·

Remember the fast-cheap-secure triangle of product development? Now guess which one they skipped

• tim333 5y ago
  I'm not sure the development was super fast. They also kept it fairly simple.
• southerntofu 5y ago
  The client is another story, but for the server they forked ejabberd which is a reliable, established XMPP server. So they probably had "fast-cheap-secure" on the server-side, because 6 years had been spent ironing out ejabberd bugs before the first version of Whatsapp came out. My understanding is that vulns in Whatsapp so far were client-side, but i'm interested if i missed some on the server side.
  • Zash 5y ago
    They had some homebrew encryption and authentication before, see eg https://blog.thijsalkema.de/blog/2013/10/08/piercing-through-whatsapp-s-encryption/ https://blog.thijsalkema.de/blog/2013/10/08/piercing-through... https://blog.thijsalkema.de/blog/2013/10/08/piercing-through-whatsapps-encryption-2/ https://blog.thijsalkema.de/blog/2013/10/08/piercing-through...
    • southerntofu 5y ago
      > homebrew encryption What could possibly go wrong? :) Thanks for the links!