4 ms·

This is not true, unlike Telegram, WhatsApp has a reasonable model for E2EE and it's enabled by default. The UI is lackluster and it really should scream more w

This is not true, unlike Telegram, WhatsApp has a reasonable model for E2EE and it's enabled by default. The UI is lackluster and it really should scream more when contacts' public keys change (to prevent MITM attacks), and it doesn't protect metadata such as your contact list at all, but all of that is still better than Telegram, which offers no encryption for group chats at all.

philliphaydon 5y ago
> This is not true The fact that I recieve advertising in FB for things discussed in a 1:1 chat in whats app, minutes after discussing them, means it's not secure. E2E is end to end, not end to FB to end.
- mercacona 5y ago
  May be the other E has been googling about the thing you discuss. Metadata is an important flaw, they don't need to compromise the E2E communication to track/profile you.
- MikusR 5y ago
  What keyboard are you using?
oblio 5y ago
> but all of that is still better than Telegram, which offers no encryption for group chats at all I think Telegram (group) chats are encrypted, just not end to end.
- latk 5y ago
  Transport encryption is table stakes. It's really no longer something that can be mentioned as if it were something special. When I browse to a random website I don't think “wow HTTPS, so secure”. The channel client <-> service is encrypted, but the service still gets all of the data in plaintext. On a technical level, Telegram is are as secure as Facebook Messenger. Both offer transport encryption and optionally E2EE secret chats. Actually, I might trust Facebook more (on a technical level) because they don't have Telegram's disastrous history with home-brewed crypto protocols.
  - oblio 5y ago
    The thing with E2E encryption, is it really verifiable? Has anyone actually gotten/extracted the WhatsApp secrets and then checked that what goes in one end comes out the other fully encrypted, systematically? After all, everything goes through WhatsApp's proprietary clients and servers, we don't know what voodoo they do along the way. Just because they claim it's E2E encrypted, doesn't really make it so, I'd imagine. Has their E2E encryption been confirmed independently?
    - indigo945 5y ago
      They had Moxie Marlinspike, who is behind Signal, audit their encryption code. Of course, we can't know if the code they let him audit is actually the code that gets deployed, and it's also been a few years since then, but the E2EE has been independently confirmed.

philliphaydon 5y ago

> This is not true The fact that I recieve advertising in FB for things discussed in a 1:1 chat in whats app, minutes after discussing them, means it's not secure. E2E is end to end, not end to FB to end.

mercacona 5y ago
May be the other E has been googling about the thing you discuss. Metadata is an important flaw, they don't need to compromise the E2E communication to track/profile you.
MikusR 5y ago
What keyboard are you using?

oblio 5y ago

> but all of that is still better than Telegram, which offers no encryption for group chats at all I think Telegram (group) chats are encrypted, just not end to end.

latk 5y ago
Transport encryption is table stakes. It's really no longer something that can be mentioned as if it were something special. When I browse to a random website I don't think “wow HTTPS, so secure”. The channel client <-> service is encrypted, but the service still gets all of the data in plaintext. On a technical level, Telegram is are as secure as Facebook Messenger. Both offer transport encryption and optionally E2EE secret chats. Actually, I might trust Facebook more (on a technical level) because they don't have Telegram's disastrous history with home-brewed crypto protocols.
- oblio 5y ago
  The thing with E2E encryption, is it really verifiable? Has anyone actually gotten/extracted the WhatsApp secrets and then checked that what goes in one end comes out the other fully encrypted, systematically? After all, everything goes through WhatsApp's proprietary clients and servers, we don't know what voodoo they do along the way. Just because they claim it's E2E encrypted, doesn't really make it so, I'd imagine. Has their E2E encryption been confirmed independently?
  - indigo945 5y ago
    They had Moxie Marlinspike, who is behind Signal, audit their encryption code. Of course, we can't know if the code they let him audit is actually the code that gets deployed, and it's also been a few years since then, but the E2EE has been independently confirmed.