1y ago

A question about secure chats

Two questions.

My family insist on using Whatsapp for the family chats. I have to keep a copy on a device just so I can communicate with them. I do so under protest, as I was always told it isn't secure. My brother has just said

"oh Whatsapp is encrypted, it's perfectly secure".

First, is it actually as encrypted and safe as my brother claims? That would solve everything.

Second, if it isn't, where can I get some proof that we should switch to Telegram or whatever? Proof which doesn't make me look like a raving loony?

You're viewing a single thread.

105 comments

Cybersec researcher here. The content of your chat is encrypted end to end. Their servers can't read what you write. This is because they use the same protocol as signal, x3dh and double ratchet. However, they can and will collect everything else. Contact info, for example, phone, etc
- Link previews however, are calculated server-side. So, yeah. They see any link posted.
- If you login to another device with WhatsApp, does it show your chat history? If so, then the servers have your key.
  I've never used any FB service, so I don't know., and I don't know anyone who uses WhatsApp.
  
  To "link" other devices you have to scan a qr from your phone, so it's certainly possible that during that process the devices connect and share the key, and the servers don't have it.
  Or the servers could have it. Idk, it's closed source, that's the problem at hand.
  
  Sounds like it transfers the ID Out-of-band, so that's good, does the desktop get the chat history then? (It's possible it pulls chat history from the phone).
  Oh, I agree with the closed source issue. That makes it a no-sale for me.
  
  No, the protocol is sound enough, WhatsApp doesn’t have the key, doesn’t want the key (so they will probably not be responsible for what you are communicating with others), and doesn’t need the key - as others have put so eloquently, the metadata is rich enough for them.
  
  Initially you could only log in from one device, as it created a new private key every time you switched device. Then they implemented Whatsapp Web, which essentially required the primary device to be connected to the internet, the chats would then be transferred from the primary device to the secondary devices (I assume through an encrypted tunnel of some sorts). Then as of late they have implemented a new technology that allows you to share your private key among multiple devices, making them all the "primary device". The chat history and all the messages can be shared from one device to another while encrypted. The weak spot at one point was the chat backup, which was unencrypted and stored in your Google Drive, so technically Google could have had access to all your chats. Today though, you can encrypt the backup through a password.
  In theory Whatsapp has never needed to read your chats to have the functionality it has. That's in theory because it's closed source and we cannot know anything for certain. All this is just what Meta/Whatsapp said or pure speculation.

105 comments