481
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 30 Apr 2026
481 points (100.0% liked)
Technology
84222 readers
3581 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
I never assumed that this presumed "end to end encryption" was secure in any way. The key exchange either runs over Meta servers, and they just log them, or the client software simply surrenders the key (maybe always, maybe on demand) together with the data stream that still runs over Meta servers.
I also never assumed it was fully secure either. Like sure it could be secure to hackers since they would still need the keys, but if anyone ever thought Meta was somehow not going to allow themselves access is just crazy and I am shocked anyone thought differently. On top of this they absolutely share all data with the government, im just not sure if it's by request or full access anytime.
Sadly, everyone i know still uses it so im kind of forced to but at the same time the chats are all dumb anyway so whatever and enjoy reading them Meta employees.
They can log anything they want and have nothing useful, if the encryption protocol is sound.
Have a look at how TLS is designed, if you want to know more.
I know my way around cryptography, therefor I am skeptical. If push comes to shove, they can simply command the Whatsapp App to silently surrender the keys. Nobody would know, it is a closed source app and protocol, and they can hide what they are doing inside the (probably) TLS encrypted stream.
You can have the soundest encryption in the world but if they have access to the keys it doesn’t matter, they can see everything.
But the key exchange is not the issue then.
Access to private keys is.
If the host system, on which the key exchange runs, is compromised, you're toast.
Where's the private key? I can get a new phone, log with WhatsApp and download all the historical messages without intruducing any additional password or key.
I assume they have all the required data too.
@Railcar8095 @zergtoshi actually is not my exlerience with whatsapp, since I have the backups disable, everytime I change phones I lost all my conversations. But since whatsapp is closed source, the app can indeed use encryption to comunicate p2p, but I will allways assume that the key is logged by meta, "just in case"
Sounds like a compromised phone in the sense that it doesn't protect (and instead transmit) the private key.
That's not the phones fault, but how WhatsApp works
How is a phone not compromised if it hosts apps that play into the hands of evil actors?
I undersrstand my threat model and how to limit exposure.