3 ms·

Your reasoning basically reduces to: I trust Telegram and I don't trust Meta. Security-wise WhatsApp is way more secure than Telegram because it uses the open-s

• lloeki 4y ago
  Ultimately it always ends up being about trust at various levels, and how one can validate that trust, hence why I linked to "Reflections on trusting trust" by Ken Thompson. That said, WhatsApp using the E2E Signal protocol is immaterial if they exfilter the locally stored private keys out to their servers, which is what the redaction of that line in the whitepaper we both linked (you directly, me via that Twitter link highlighting the diff) alludes to: > At no time does the WhatsApp server has access to any of the client's private key. Unless one checks every update of the client's code and the matching published reproducible binary output one can't be sure that keys (or any other data for that matter, since it has full access to anything decrypted) are not exfiltrated. Now, that line deletion could be a subtle canary because law enforcement/state actor, or that could be Meta being nefarious following the cofounders departure, or anything in between. Either way I find it a worrisome signal that this specific line has been removed.
  • lima 4y ago
    > That said, WhatsApp using the E2E Signal protocol is immaterial if they exfilter the locally stored private keys out to their servers They don't do that. Biggest issue with WA is the backup mechanism. You can encrypt it with a passphrase nowadays but AFAIK that's off by default, rendering E2E moot if either party backs it up to their Google Drive.