Re: Whatsapp 39;s End-to-end Encryption Is Used When You Chat With Another Person Using Whatsapp Messenger

0 views

Skip to first unread message

Message has been deleted

Kathryn Garivay

unread,

Jul 10, 2024, 2:30:07 PM7/10/24

to travsedischam

Your chats and media on WhatsApp are safe and private. However, other metadata like your Last Seen, phone hardware details, and general location (based on your IP address) may be visible to WhatsApp and its owner, Meta/Facebook.

WhatsApp is easily the single most used chat app in the world, handily surpassing rivals like Messenger, Signal, and Telegram. Given how much sensitive data we tend to share in online conversations, is the app safe to use? Moreover, should you be worried about potential hacks or data leaks, even with the encryption WhatsApp claims to offer?

whatsapp 39;s end-to-end encryption is used when you chat with another person using whatsapp messenger

DESCARGAR https://pimlm.com/2yOADg

Yes, WhatsApp is safe and better than texting as all chats are automatically encrypted. This means your messages cannot be read or eavesdropped by anyone, including WhatsApp and its parent company Meta. Keep reading to learn more about how the app's end-to-end encryption works and what you can do to secure your WhatsApp chats further.

Most of this information seems harmless on the surface. However, WhatsApp is only one of many Meta platforms. So even basic data can go a long way toward identifying you as an individual when combined with your Facebook and Instagram profiles. For example, Meta can use phone numbers to recommend new friends on Facebook based on frequent WhatsApp conversations. Sure, it cannot see the contents of your messages, but it still knows that some communication took place.

Another well-publicized potential attack vector involves cloud backups to Google Drive and iCloud. By default, WhatsApp will back up your chats to these services without any encryption whatsoever. This means that if an attacker somehow gains access to your cloud storage account, they could also theoretically get their hands on your WhatsApp data.

Luckily, WhatsApp has already rolled out the ability to encrypt chat backups with a password or encryption key. The latter is a randomly generated 64-digit key. You can store it in a password manager for maximum security. This is an opt-in feature, so make sure that you enable it under Settings > Chats > Chat backup within the WhatsApp app on Android.

On March 7th, a new EU law, the Digital Markets Act (DMA), comes into force. One of its requirements is that designated messaging services must let third-party messaging services become interoperable, provided the third-party meets a series of eligibility, including technical and security requirements.

While Meta must be ready to enable interoperability with other services within three months of receiving a request, it may take longer before the functionality is ready for public use. We wanted to take this opportunity to set out the technical infrastructure and thinking that sits behind our interop solution.

The approach we have taken in terms of implementing interoperability is the best way of meeting DMA requirements, whilst also creating a viable approach for the third-party providers interested in becoming interoperable with Meta and maximizing user security and privacy.

First, we need to protect the underlying security that keeps communication on Meta E2EE messaging apps secure: the encryption protocol. WhatsApp and Messenger both use the tried and tested Signal Protocol as a foundational piece for their encryption.

Messenger is still rolling out E2EE by default for personal communication, but on WhatsApp, this default has been the case since 2016. In both cases, we are using the Signal Protocol as the foundation for these E2EE communications, as it represents the current gold standard for E2EE chats.

In order to maximize user security, we would prefer third-party providers to use the Signal Protocol. Since this has to work for everyone however, we will allow third-party providers to use a compatible protocol if they are able to demonstrate it offers the same security guarantees as Signal.

To send messages, the third-party providers have to construct message protobuf structures which are then encrypted using the Signal Protocol and then packaged into message stanzas in eXtensible Markup Language (XML).

Meta servers push messages to connected clients over a persistent connection. Third-party servers are responsible for hosting any media files their client applications send to Meta clients (such as image or video files). After receiving a media message, Meta clients will subsequently download the encrypted media from the third-party messaging servers using a Meta proxy service.

While we have built a secure solution for interop that uses the Signal Protocol encryption to protect messages in transit, without ownership of both clients (endpoints) we cannot guarantee what a third-party provider does with sent or received messages, and we therefore cannot make the same promise.

WhatsApp exposes an Enlistment API that third-party clients must execute when opting in to the WhatsApp network. When a third-party user registers on WhatsApp or Messenger, they keep their existing user-visible identifier, and are also assigned a unique, WhatsApp-internal identifier that is used at the infrastructure level (for protocols, data storage, etc.)

The challenge here is that WhatsApp would no longer have direct connection to both clients and, as a result, would lose connection level signals that are important for keeping users safe from spam and scams such as TCP fingerprints. We would therefore anticipate implementing additional requirements for third-party providers who take up this option under our Reference Offer. This approach also exposes all the chat metadata to the proxy server, which increases the likelihood that this data could be accidentally or intentionally leaked.

As is hopefully clear from this post, preserving privacy and security in an interoperable system is a shared responsibility, and not something that Meta is able to do on its own. We will therefore need to continue collaborating with third-party providers in order to provide the safest and best experience for our users.

To help personalize content, tailor and measure ads and provide a safer experience, we use cookies. By clicking or navigating the site, you agree to allow our collection of information on and off Facebook through cookies. Learn more, including about available controls: Cookie Policy

"WhatsApp's end-to-end encryption is used when you chat with another person using WhatsApp Messenger. End-to-end encryption ensures only you and the person you're communicating with can read or listen to what is sent, and nobody in between, not even WhatsApp"

For blocking messaging, you'd likely have to block Whatsapp itself. I have had some success with blocking uploads to Whatsapp in the past but I would have to test again.

Doesn't their end-to-end encryption just mean that the datagram submitted as part of the https transaction is encrypted separately prior to being sent? Netskope should still be able to see the https action unless the webapp is cert-pinned and has to have a SSL decryption exception. But being able to act on upload/download doesn't sound like that is the case.

My case is simple. I have two policies that enforce controls on the "Chat, IM, & other communication" category, then an app policy above to permit the corporate chat app. We'll start at the bottom of the policy and work our way up.

If you haven't already registered, now is a good time to do so. After you register, you can post to the community, receive email notifications, and lots more. It's quick and it's free! Create an account

What is end-to-end encryption? By definition, end-to-end encryption means that your data is encrypted starting on your device. It then travels through the internet, encrypted, until it reaches the other party and their device decrypts it. All of this happens within milliseconds and is entirely invisible to the user. E2EE works on voice calls, text messages, video calls, and sharing information.

End-to-end encryption is the process of converting text or data into ciphertext (unreadable gibberish) to keep it safe from prying eyes and ears. Only authorized parties can use the data because each device shares the key that unlocks it.

WhatsApp end-to-end encryption keeps all your voice, text, and other data secure by converting it to ciphertext and back again instantly. During transport, no one else can access it except the two (or more) parties sharing it.

Historically, end-to-end encryption was extraordinarily complex and difficult to use, even for highly skilled technicians. Modern technology makes it effortless for the end user, and dozens of apps come with E2EE built in.

The application you are using creates a secret key when you initiate a connection with someone. The app then scrambles all your data so no one outside your private conversation can understand it. The person on the other end shares that same key, which unlocks the data so they can communicate with you over a private connection. This is how all your personal messages are end-to-end encrypted.

Keeping your online communications safe is essential to protecting your private information from identity theft. Hackers are always looking for ways to steal your personally identifiable information (PII), bank information, or credit card numbers.

Another way end-to-end encryption keeps you safe is by thwarting the government and technology companies from mining your personal information and tracking you. Marketers also harvest information for targeted advertising, but E2EE can help protect you against that, too.

Encryption in transit means that data is only encrypted during one leg of its journey and may be vulnerable at the other end or during transit somewhere over the network. End-to-end encryption is when data is encrypted the entire time it is online. It is never exposed to outsiders and, therefore, is much more secure.