7 ms·

> The WhatsApp server maintains a mapping between each person’s account and all their device identities. When someone wants to send a message, they get their de

• alfongj 5y ago
  What's your concern?
  • ev1 5y ago
    > they get their device list keys from the server Which means the server can just substitute keys in.
    • alfongj 5y ago
      Right, but that doesn't compromise the security of the service necessarily. Users can catch a malicious server injecting incorrect keys by looking at security notifications and comparing security codes. This is part of the Signal protocol. This may be tedious but only needs to be done in the event of phone keys getting reset (a once in a year event?), as all companion device keys are automatically verified with signatures provided from an account owner's primary (phone) device Source: https://www.whatsapp.com/security/WhatsApp_Security_Whitepaper_v4_Preview.pdf https://www.whatsapp.com/security/WhatsApp_Security_Whitepap...