Ask HN: How can I verify that WhatsApp uses E2E encryption?

How can I (developer, no security knowledge) verify that does encryption properly?

Several people have already raised the very good point that ultimately, we need the source code to be certain.

However, can we really be sure when we have the source? I don't think so. The codebase is likely to be large, especially when you start looking at dependencies such as the crypto libraries they may be using (unless you want to assume they are safe themselves), and it has been shown that humans are actually quite bad at finding vulnerabilities in code that is written to obscure its real purpose.

The Underhanded C Contest is a yearly contest that puts this to the test. Participants are given a spec for a small piece of software, and must write a program in C that appears on code review to work correctly, but in fact subverts the requirements in some way. This has been remarkably successful.

Sure, having the code is better than not having the code, but I think that gives us less security than many assume it does.

As to "Use Free Software": the OTR protocol currently stands the test against various agencys and holds strong. I suggest to use software that makes use of it, e.g. ChatSecure. Also, If you wan't someone who's not a random person on the internet telling you this: go watch the talk of Jacob Appelbaum and Laura Poitras from the 31C3.

The Problem with closed source software is an will always be, that we can never be certain of it's security (at least not without reverse engineering every version and fully understanding it).

It the source were available, I could compile it into a binary myself and calculate a file checksum and compare it against the binary downloaded from the App Store. Obviously not the case here, but i don't think you'd need to "performs the steps above" to verify.

This is why I think reverse-engineering needs to be far more common knowledge; maybe to the extent of being required in a CS curriculum just like going in the other direction (from source code to low-level CPU operation) often is. There is far too much blind trust in things at the "lower level", like compilers and libraries, and while it's much harder for the average person to reverse-engineer hardware and verify its operation (requires specialised hardware too), with software it is relatively easy and should be something that every programmer should know at least a little of.

Of course there's the legal aspects of RE, which often dissuade people from even thinking about or discussing it, but I think that just telling people they could if they really wanted to discover exactly what their software was really doing is already sufficiently empowering. No doubt there would be plenty of opposition to this... which would primarily be from the proponents of DRM and the like, who very strongly want software (and hardware) to be treated as "black boxes". But it is, at least with general-purpose computers, relatively difficult to stop people from examining them, and even more difficult to tell if they did --- which is why I think this knowledge of RE is truly liberating.

Stallman's story is also worth mentioning here: https://www.gnu.org/philosophy/right-to-read.html