2

Ok So I posted this question by mistake on StackOverFlow, and I was suggested that I should re-post it on Information Security.

I am pretty sure I am asking a very stupid question. I am a developer but don't know anything about the latest encryption technologies. I've read on many websites that it took WhatsApp many years to come up with this 'technology' and that our messages and everything is now safe.

I have a few questions that really puzzle me all the time.

If there is an encryption Key that is needed to decrypt the messages, how is that Key transferred to the receiving party? Using WhatsApp servers of course? How do we know they haven't kept it to decrypt the chats? Just because we trust them? If a message was encrypted on my phone, the receiver needs to know that encryption key to be able to decrypt it, how do they get that key? Using WhatsApp servers? Why would it be considered so difficult for WhatsApp to not keep that key?

If I send a video to one of my friends, it takes sometime to upload, it shows a progress bar while uploading.. if I forward the same video to a few other friends of mine, it gets sent within a second, immediately. How? was it not encrypted? How come it got sent if it didn't encrypt again?

Finally how does WhatsApp web still work? If WhatsApp's website can show me all of my messages (regardless of how I login) why can the server guys not see it? How is it that they cannot emulate my login and be able to see everything I am doing? I just sent an image to a friend of mine using WhatsApp web, it got sent, he saw it.. everything was fine. I turned off my WiFi before opening WhatsApp and the image hasn't even downloaded!! Its not even in my phone.. how did WhatsApp web use my 'phone' to send that image when it doesn't even exist in my phone? (Note: My settings don't allow immediate downloading of images). Clearly WhatsApp wasn't talking to my phone it just sent it because its on the server..

Can someone please help me understand this?

Improve this question
10
  • 2
    I think this requirement: "Scan the QR Code on your computer screen from your phone" means that your phone must be on and online. So your phone shares decryption keys and allows the web client to decrypt the conversation. Does it mean that whatsapp (the company) see the cleartext of the conversation if you opened it on the web client? I think yes.
    – Z.T.
    Oct 20, 2016 at 7:03
  • re: the upload. The file is uploaded to a server hosted by whatsapp. The file is encrypted before upload. Only the uploader has the decryption key. Each time the uploader shares the attachment/upload with a contact, what is sent to the contact is a link to the file and the decryption key. The message sent to the contact is end-to-end encrypted, but is short.
    – Z.T.
    Oct 20, 2016 at 7:04
  • if the decryption key is sent with the message, why can anyone else not decrypt it then? Whats the whole point if the decryption key is attached with the message itself.
    – Muhammad bin Yusrat
    Oct 20, 2016 at 7:33
  • 6
    Possible duplicate of How does end to end encryption work with whatsapp web? for your last question, and security.stackexchange.com/questions/119636/… for your first question. Consider narrowing your question.
    – Michael
    Oct 20, 2016 at 8:27
  • 2
    Do you understand public key crypto? The key to decrypt the file is itself encrypted using the recipient's public key. That is sent to the recipient. Only the recipient has their private key. As long as you believe the WhatsApp client does not leak the private key it generates locally on the phone, WhatsApp can't decrypt the file they host.
    – Z.T.
    Oct 20, 2016 at 9:12

0

Reset to default

Browse other questions tagged or ask your own question.