WhatsApp's "End-to-End Encryption" Is the Biggest Lie in Tech History

Telegram is a much worse messenger when it comes to E2E encryption and default settings.

> Despite its claims, it reads users’ messages and shares them with third parties.

Note this claim. When it goes into its first smoking gun,

> WhatsApp [...] automatically backs up your entire chat history to iCloud or Google Drive

> This is what Durov meant. This is why he said ~95% of messages end up in plain text on Apple/Google servers.

This is the closest the article ever comes to proving the claim at the front. Note that nothing in this claim implies that Meta can or is reading your messages, only that it is "sharing" them with a third party, so we still haven't actually successfully justified this quote.

It then rambles over just about every security controversy WhatsApp has ever had: bugs, design flaws, etc.

Okay. Then it mentions that sometimes when you're talking to a business it's actually Meta servers on the other end of the encryption, I guess. This again seems like it doesn't really prove anything.

I am not saying none of these issues are problems, but this literal dump of AI output into Medium can't even justify its primary claim. It just keeps throwing more shit at you and hopes you've forgotten what the bold claim at the front of the article actually said was, since it isn't really true.

I do not believe Matrix is a scam, but it has almost all of these problems in some form aside from the stupid Cloud Backups issue, only its a bit more complicated. It has CVEs, generates tons of metadata and several places where homeservers could attempt to attack your privacy.

Durov's platform, meanwhile, offers very little in the way of end-to-end encryption and of course generates a ton of unencrypted metadata, so I am not sure who he's fooling. It seems like they continuously brag about Telegram not being able to solve the E2EE key management problem by pointing out that other solutions are imperfect, whereas Telegram just doesn't have one. Congratulations?

- Cloud backups — by default, backups to iCloud/Google Drive contain plaintext messages, and E2EE backup is opt-in. Even if you enable it, a weak password collapses the effective security, and any other person in the chat with an unencrypted backup exposes the conversation.

- Metadata — who you talk to, when, how often, IP, contact graph, etc. This is the "reading your life without reading your messages" argument, and it's the part that's genuinely well-established.

- Pen register / FBI — the claim that WhatsApp uniquely delivers near-real-time metadata (~every 15 min) to law enforcement.

- Group chat membership integrity — a server-level adversary can inject a member into a group; messages stay encrypted but get delivered to the injected party. Endpoint compromise (Pegasus / CVE-2019-3568) — encryption is irrelevant if the device is owned.

- Closed source, Meta AI, business accounts — content can leave the E2EE envelope in those flows.

Nothing really new here, and as everyone else is pointing out Telegram might be worse.

I suspect that smaller teams are, on average, more likely than larger ones to write secure software.