Live data from Hacker News

WhatsApp Just Switched on Encryption for a Billion People

wired.com

11–20 of 65 posts

Re: WhatsApp Just Switched on Encryption for a Billion People

#11
The article says: "With end-to-end encryption in place, not even WhatsApp’s employees can read the data that’s sent across its network."

But according to the diagram: http://www.wired.com/wp-content/uploads/2016/04/Whatsapp_Enc...

... A's message is encrypted with Whatsapp's public key, which means that Whatsapp's private key can (and has to) decrypt it on the server side to encrypt it in turn with B's public key.

If the diagram is truthful, the claims the article makes are incorrect.

Re: WhatsApp Just Switched on Encryption for a Billion People

#12
post #11

The article says: "With end-to-end encryption in place, not even WhatsApp’s employees can read the data that’s sent across its network." But according to the diagram: http://www.wired.com/wp-content/uploads/2016/04/Whatsapp_Enc... ... A's message is encrypted with Whatsapp's public key, which means that Whatsapp's private key can (and has to) decrypt it on the server side to encrypt it in turn with B's public key. If…

The message is encrypted with the public key belonging to user B.

Re: WhatsApp Just Switched on Encryption for a Billion People

#13
post #11

The article says: "With end-to-end encryption in place, not even WhatsApp’s employees can read the data that’s sent across its network." But according to the diagram: http://www.wired.com/wp-content/uploads/2016/04/Whatsapp_Enc... ... A's message is encrypted with Whatsapp's public key, which means that Whatsapp's private key can (and has to) decrypt it on the server side to encrypt it in turn with B's public key. If…

What in the diagram gives you the impression the public key belongs to WhatsApp? Presumably WhatsApp is handling PKI.

Re: WhatsApp Just Switched on Encryption for a Billion People

#14
post #11

The article says: "With end-to-end encryption in place, not even WhatsApp’s employees can read the data that’s sent across its network." But according to the diagram: http://www.wired.com/wp-content/uploads/2016/04/Whatsapp_Enc... ... A's message is encrypted with Whatsapp's public key, which means that Whatsapp's private key can (and has to) decrypt it on the server side to encrypt it in turn with B's public key. If…

It's the user's public key, not WhatsApp's.

Re: WhatsApp Just Switched on Encryption for a Billion People

#16
WhatsApp have published further details for users[1], as well as a technical whitepaper[2] explaining the implementation. There's also a blog post[3].

[1]: https://www.whatsapp.com/security/

[2]: https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...

[3]: https://blog.whatsapp.com/10000618/End-to-end-encryption

Re: WhatsApp Just Switched on Encryption for a Billion People

#18
post #11

The article says: "With end-to-end encryption in place, not even WhatsApp’s employees can read the data that’s sent across its network." But according to the diagram: http://www.wired.com/wp-content/uploads/2016/04/Whatsapp_Enc... ... A's message is encrypted with Whatsapp's public key, which means that Whatsapp's private key can (and has to) decrypt it on the server side to encrypt it in turn with B's public key. If…

it use the public key of the other user, not whatsapp. in effect, whatsapp is just acting as a key server. now they could have that users private key, but that's another matter

Re: WhatsApp Just Switched on Encryption for a Billion People

#19
>“The encryption genie is out of the bottle” ... > There was a middle period where the government had a broad ability to surveil, but if you look at human history in total, people evolved and civilizations evolved with private conversations and private speech. If anything, we’re bringing that back to individuals.

I think on the contrary, the surveillance demon is out of the bottle. It's impossible to hide metadata (ip addresses) in communications, we depend on auto-updated operating systems that might be backdoored in the future or are already backdoored and even if we have an "untraceable" system, we can't possibly use our old accounts were we logged in with our real name, or which can be traced to our IP address.

Re: WhatsApp Just Switched on Encryption for a Billion People

#20
> The encryption genie is out of the bottle

> There was a middle period where the government had a broad ability to surveil, but if you look at human history in total, people evolved and civilizations evolved with private conversations and private speech. If anything, we’re bringing that back to individuals.

I think on the contrary, the surveillance demon is out of the bottle. It's too hard to hide metadata such as ip addresses in communications; in many places Tor is blocked, browsers can be fingerprinted, typing style and writing style can be identified by statistical methods; we depend on auto-updated operating systems that might be backdoored in the future or are already backdoored and even if we have an "untraceable" system, we can't possibly use our old accounts were we logged in with our real name, or using our real IP address in the past. So, anonymous web use is not as social as plain web use. Besides, we already leak too much data through our GSM phones, at least to the carrier and the state agencies that log the user data.

Post reply on HN