Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Let's be fair.

WhatsApp is NOT any different. They may have Signal's encryption algo, but they still store effectively unencrypted messages in their servers. Because that is the only way to sync between devices when adding a new device. And also the only way for FB to data mine.

So... Yeah bad reporting.



That is not correct. WhatsApp syncs messages between devices (mobile client must be connected to the internet to use WhatsApp web on the desktop).

They store undelivered, encrypted messages on the server.


Correct, this is part of the Signal protocol[1]. Specifically, this part is called Sesame[2]:

> This document describes the Sesame algorithm for managing message encryption sessions in an asynchronous and multi-device setting.

[1] https://www.signal.org/docs/

[2] https://www.signal.org/docs/specifications/sesame/


If you are in private chat mode, this works well, because all devices have an encryption key.

But if you are doing regular messages between people, those messages are certainly readable by the server and because adding a new device decrypts all previous messages, the server has decryption knowledge.

Note: At each point in their sesame algorithm the user has a non-empty set of devices. So if you want to sync another device acts as a p2p syncer.

What happens when you remove your last device and add another new one. Hence why whatsapp has a non-privacy mode. Or am I misunderstanding?


WhatsApp has no private chat mode. Every message is e2e encrypted.

If you switch devices, other clients will use the old keys until they have received the new one (and then they will silently re-encrypt and resend undelivered messages, something WhatsApp was heavily criticized for).


Gotcha!


This is not the only way to sync encrypted messages between devices with different keys. Matrix and XMPP+MAM+OMEMO both allow for message synchronization between devices, while having different keys on each device.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: