Slashdot Mirror
WhatsApp Enables End-To-End Encryption For All Forms of Communications By Default
Popular instant messaging app WhatsApp, on Tuesday, announced that it is turning on end-to-end encryption for all its users by default. The company says that every call a user makes, every text message they send, all photos and videos they share will now be more secure. Furthermore, the encryption status of any chat is visible under the chat's preferences screen. The announcement comes a little over a year after the Facebook-owned company partnered with Open Whisper Systems, a nonprofit software group that develops collaborative open source projects with a mission to "make private communication simple." The end-to-end encryption feature is available on the latest version of the app. In a blog post, Open Whisper Systems further explains the feature: Once a client recognizes a contact as being fully e2e capable, it will not permit transmitting plaintext to that contact, even if that contact were to downgrade to a version of the software that is not fully e2e capable. This prevents the server or a network attacker from being able to perform a downgrade attack. In a blog post, WhatsApp writes: While WhatsApp is among the few communication platforms to build full end-to-end encryption that is on by default for everything you do, we expect that it will ultimately represent the future of personal communication. WhatsApp has also made available the technical details about how the two companies implemented this feature (PDF). For those of you who haven't heard of WhatsApp, it's an instant messaging and voice calling app. The free service, which is available across all popular platforms, is used by more than a billion people worldwide every month. A report on Wired says that a team of only 15 engineers enabled this security feature for over a billion users. Privacy researcher and activist Christopher Soghoian rightfully adds, "Google has no excuse."
Nice, as it prevents dragnet surveillance. Still I don't want to use what's app just like signal as it doesn't work without GCM, with google/apple knowing my ip address all the time.
The companies build their encryption so that only the data they are interested in and will monetize reaches them. But they still monetize your data. And for every encrypted messaging app that pops up, the moment you use a whatsapp bot or siri or google maps or whatever, they know your location.
Honest questions: Does the user control the public/private keys that WhatsApp uses for this end-to-end encryption? How do they manage public key exchange, revocation, etc.?
... in your living room will also be encrypted so only Facebook can data mine and sell it.
I apologize for the lack of a signature.
Perhaps they really are implementing secure end-to-end but from their previous actions this announcement makes me suspect that something else which is actually secure is becoming so popular that an "approved" "secure" (but not really) needs to be pushed out to the ignorant masses.
Show me the source code and I will consider trusting that this is secure. I am not going to just take their word for it because they have proved that it means nothing time and time again.
9/11: Never forget it was a false-flag operation
Fuck off for both of your "paragraphs".
How do they make money if they cannot sift through your data?
(except for all your data and metadata backdoor copied to the hivemind of Facebook). Why do you think they bought WhatsApp? To ensure they could NOT sell the product (users) to the customers (advertisers and TLAs)? Please. I wouldn't trust Zuckerburg farther than I could throw his precious snowflake (who is doomed to grow up to be an abject nightmare).
Nope, in this case it really does look like the other "end" is the other party and not WhatsApp's servers. So, unless they are lying about it, it really does seem like user-to-user encryption (and hence, as you point out, no data mining for facebook).
because Line is so much more usable, I really don't care if it has encryption or not, whatsapp just doesn't get a lookin any more
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
The message content is opaque to them, but the meta-data of who talks to who, when, for how long and how often is not. Last I checked you still need a real phone number to sign up, so they can tie nearly all of their users to their real world identities. Considering that they are owned by facebook, all that meta-data gets fed in to facebook's behemoth databases of personal info.
So it seems likely that even full-blown e2e is still revenue positive for them.
That said, going full e2e, even with all the facebookian compromises is still an improvement in the baseline. This is a war of inches, so every inch matters, even when there is still a long road ahead.
Straight from the horses mouth:
https://blog.whatsapp.com/615/Making-WhatsApp-free-and-more-useful
Tell me more about this business model you know so much about.
Meanwhile, in the land of the XMPP protocol, we've been end to end encrypted for over a decade.
Seriously, why is it 2016 and this is NOT a standard feature of a chat protocol?
Mod me down with all of your hatred and your journey towards the dark side will be complete!
Who were quickly put to death after the encryption security was put in place so that no one can ever divulge their secrets!
Now Pharaoh level security is available to everyone!
Funny, I haven't been billed yet.
Seven puppies were harmed during the making of this post.
Ireland, obviously. True Capitalists don't bother with Panama.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
The user's device generates the private key, but only under the control of WhatsApp's closed-source app.
The key exchange is done through WhatsApp's server, much like message exchange. There is no revokation, though I imagine a user who loses his private key could generate and register a new one. There are no certificates except for the connection to the server.
An attacker would have to take control of WhatsApp's server, but once that is done, they could run classic MiTM attacks on all WhatsApp users.
This is intellectually dishonest. Whatsapp allows you to verify the key signature either via barcode or via hash comparison.
The few people with whom I exchange messages on whatsapp use so much shortcuts and abbreviations that conversations are very garbled, and I found myself unable to decode its meaning just after a few days. I don't see the need for adding further encryption here...
https://www.eff.org/secure-messaging-scorecard
You mean the metadata, as stated by various others.
The original AC is mostly right though. If you received a degree in Software Engineering from an accredited university then by all means, you're a Software Engineer. However if you're just a hipster code monkey copy-pasting from stack exchange then you have no business calling yourself an "engineer".
Same thing as garbagemen calling themselves "sanitation engineers".
For once, I'll agree here. A Systems Engineer is not a "programmer" either, and juxtaposing with hipster code monkies is used to distinguish there as well, except in the latter case it's chef recipes, #devops, and declarative config files because shell scripts and the unix command line scare them.
Hire a Linux system administrator, systems engineer,
How does this work with web.whatsapp.com ?
From https://blog.whatsapp.com/10000618/end-to-end-encryption/:
But my browser connects to web.whatsapp.com ? Are the messages decrypted in the browser ? Is there a key in the cookies ?
The first thing you do to connect is scan a QR code. I just tried scanning one with a generic app (not whatsapp), it's a couple of base64 string 42 bytes and 16 bytes long. That could work as a key (symmetric). I cant't seem to chromium-inspect the content that's feeding my web.whatsapp.
Anyone with data on this ?