8 ms·

"WhatsApp had used Signal's open-source protocol to encrypt all WhatsApp communications end-to-end by default" Allegedly*. Since Whatsapp is proprietary, it c

• joshuaissac 7y ago
  It should be sufficient to inspect the client because end-to-end encryption prevents the server from seeing the message plaintexts. The worst it could do is send the wrong encryption keys to the clients (i.e., attempt a MITM attack, or add unauthorised participants to a group chat), but this can be checked out of band (e.g. QR code in person), and the client provides a message when a contact's public key changes. If the client implements the Signal protocol correctly, and the key pair is generated securely, private key not transmitted to the servers, etc., then the server should not be able to do anything nefarious without the client noticing.
  • mtgx 7y ago
    WhatsApp lacks authentication by default. Also, WhatsApp sometimes doe use a server key to encrypt your messages instead of e2e encryption, which basically means that if FB wanted to they could listen in on some communications at will (such as at request of law enforcement, etc): https://www.theguardian.com/technology/2017/jan/13/whatsapp-design-feature-encrypted-messages https://www.theguardian.com/technology/2017/jan/13/whatsapp-...
• UncleMeat 7y ago
  You can audit the app. Bytecode isn’t hard to read. Pentesters aren’t idiots.