How secure is WhatsApp E2EE?

You may not have meant to. but, at least from my perspective, by responding directly to and quoting a comment specifically about the flagging system, you gave the impression your argument was a response to it:

This is what I initially objected to, and what made me feel you probably you hadn’t read the article at that point at least.

In any case, I think we’ve more or less reached a point of mutual understanding (or at least run out of energy :smiley: ), the rest is water under the bridge. Time for me to go make something to eat. I hope you have a nice rest of your day or night.

As to this:

that’s still not change the fact regarding how E2EE should protect the users’ messages from non-intended recipients.

I agree that should be the goal to the extent possible.
But I also think that this is just a fundamental limitation of 2 party (or multiparty) conversations. E2EE is not a defense against all threats. The technology can’t adequately protect you if the person on the other end of the conversation exposes your communications (intentionally, or unintentionally/through ignorance). OR in the case of Whatsapp, even the most perfect system of E2EE in the world couldn’t make me trust Whatsapp because because even then, it is still just ‘perfect’ e2ee between two untrusted endpoints (the closed source apps).

Signal does waaay better with respect to metadata, and many other things, but even Signal can’t eliminate the risk related to the other participants in the conversation sharing or leaking your messages.

3 Likes

Since the article itself explicitly said that they didn’t know exactly what metadata was present, I believe the metadata argument is pointless. It’s not out of the realm of possibility that the metadata that was sent, might include even the sender’s encryption key for further investigation, the replica of the entire messages in the chat room, or whether the thing was sent only when requested, etc. We just don’t know, no one knows. I wouldn’t be surprised.

My point is, we should not derail from the concept of the proper E2EE implementation, especially when there are so many things that we don’t know yet.

On this, we definitely agree :+1:

1 Like

poison this data with disinformation.