57

Since today I have noticed whatsapp is using end to end encryption. However web.whatsapp.com is also still working. Does whatsapp establish a connection with my phone to keep things secure?

43

Correct: The Web-Client is establishing a secure connection to the phone. The messages you send through WhatsApp Web are encrypted by the WebClient, decrypted by the phone, then re-encrypted to fit the end-to-end scheme and then sent to the recipient. Same thing the other way around.

I dont know details about the protocol, but this is what i suspect (or how i would implement it):

  • When first opening WhatsApp Web a key pair for asymmetric encryption/signing is generated (and stored in the local storage of the browser. Probably RSA or ECC.
  • Scanning the QR code exchanges the fingerprint of the said keypairs public key. This establishes trust between phone and browser installation: the fact that the user scanned the QR code implies that the user trusts the browser.
  • When WhatsApp Web is to be used, a TLS connection to the phone is established (probably proxied by WhatsApp to overcome Firewall and NAT issues). WhatsApp Web authenticates towards the phone using the initially generated keypair (thus relying on the trust established earlier).
    • The connection between the Browser and the phone is fully qualified TLS: Authentication and PFS included.
  • localstorage is not a secure location to store private keys as far as I know – bashmohandes Apr 6 '16 at 17:30
  • 4
    It is as secure as the browser can get. WhatsApp Web works without password entry after the initial trust exchange. That means that the private key is available to any code running on the machine. – marstato Apr 6 '16 at 22:56
  • Could you provide a source where I can read how the protocol for the web client works? – JKAbrams Jul 18 '16 at 16:54
  • 1
    On why your phone needed to download the image: i might have not guessed correctly: it is possible that the WhatsApp web client can send messages directly (not redirecting them though the phone). WhatsApp maybe stores all encrypted messages on their server and they get downloaded to your phone as soon as you open WhatsApp. Again, just guesses. – marstato Oct 20 '16 at 9:28
  • 1
    @MTCoster see the answer, it's in there. An RSA modulus would not fit into the QR code, I suspect. But if they are using elliptic curves, the QR code maybe contains the entire public key. – marstato Jan 19 '18 at 6:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.