72

Since today I have noticed whatsapp is using end to end encryption. However web.whatsapp.com is also still working. Does whatsapp establish a connection with my phone to keep things secure?

Improve this question
1

1 Answer 1

Reset to default
52

Correct: The Web-Client is establishing a secure connection to the phone. The messages you send through WhatsApp Web are encrypted by the WebClient, decrypted by the phone, then re-encrypted to fit the end-to-end scheme and then sent to the recipient. Same thing the other way around.

I dont know details about the protocol, but this is what i suspect (or how i would implement it):

  • When first opening WhatsApp Web a key pair for asymmetric encryption/signing is generated (and stored in the local storage of the browser. Probably RSA or ECC.
  • Scanning the QR code exchanges the fingerprint of the said keypairs public key. This establishes trust between phone and browser installation: the fact that the user scanned the QR code implies that the user trusts the browser.
  • When WhatsApp Web is to be used, a TLS connection to the phone is established (probably proxied by WhatsApp to overcome Firewall and NAT issues). WhatsApp Web authenticates towards the phone using the initially generated keypair (thus relying on the trust established earlier).
    • The connection between the Browser and the phone is fully qualified TLS: Authentication and PFS included.
Improve this answer
14
  • localstorage is not a secure location to store private keys as far as I know
    – bashmohandes
    Apr 6, 2016 at 17:30
  • 7
    It is as secure as the browser can get. WhatsApp Web works without password entry after the initial trust exchange. That means that the private key is available to any code running on the machine.
    – marstato
    Apr 6, 2016 at 22:56
  • 1
    On why your phone needed to download the image: i might have not guessed correctly: it is possible that the WhatsApp web client can send messages directly (not redirecting them though the phone). WhatsApp maybe stores all encrypted messages on their server and they get downloaded to your phone as soon as you open WhatsApp. Again, just guesses.
    – marstato
    Oct 20, 2016 at 9:28
  • 1
    @MTCoster see the answer, it's in there. An RSA modulus would not fit into the QR code, I suspect. But if they are using elliptic curves, the QR code maybe contains the entire public key.
    – marstato
    Jan 19, 2018 at 6:32
  • 3
    @craq I havent investigated whether it is all traffic, but most of it certainly. If your phone doesn't have a network connection (or runs out of battery), WhatsApp Web doesn't work.
    – marstato
    Aug 4, 2020 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .