As a follow up to Whatsapp encryption keys discussion and from WhatsApp security whitepaper, it seems that most of the components to a fully secure end-to-end encryption are already there but what seems to be lacking is a fully trusted open-source client that does not secretly transmit private keys to the server.

Not claiming WhatsApp client does it, but we would never know unless the client is open source.

I'm wondering if it's possible, with the current information that's available from WhatsApp or are there still any proprietary missing piece that is stopping us from building that?

closed as off-topic by Neil Smithline, Tobi Nary, Matthew, M'vy, LvB Apr 8 '16 at 7:51

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Neil Smithline, Tobi Nary, Matthew, M'vy, LvB
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    There's a reason why competitors with more openness around their protocol have been created. Telegram, for instance, is open source, has an openly available API and runs contests in which you can win large amounts of money ($300,000 in the most recent contest) if you can break their encryption. Rather than trying to make WhatsApp something it's not against the wishes of its owners (transparent and open), I recommend switching to an alternative that is, if those are things you value. – Alex Apr 8 '16 at 9:38

The last position that I heard from WhatsApp is that they won't be offering a public API.


Until they do, that's a huge sticking point. Unless of course they open sourced their own client...

  • The security whitepaper seems to have described a lot of the protocols, just wondering if it's technically possible for any 3rd parties to create a 3rd-party client? – uzyn Apr 8 '16 at 8:03
  • 1
    Probably fairly impossible to do it without WhatsApp noticing - if you mean effectively reverse-engineering their private api. If they don't want someone to do that, they can then easily break the 3rd party client while keeping their client working (it's a private API, so obviously it's their right to change it as they see fit) So, unless WhatsApp gives you their blessing, you're never going to have a client that's as reliable as the real thing. – Nathan Apr 8 '16 at 8:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.