Ok So I posted this question by mistake on StackOverFlow, and I was suggested that I should re-post it on Information Security.
I am pretty sure I am asking a very stupid question. I am a developer but don't know anything about the latest encryption technologies. I've read on many websites that it took WhatsApp many years to come up with this 'technology' and that our messages and everything is now safe.
I have a few questions that really puzzle me all the time.
If there is an encryption Key that is needed to decrypt the messages, how is that Key transferred to the receiving party? Using WhatsApp servers of course? How do we know they haven't kept it to decrypt the chats? Just because we trust them? If a message was encrypted on my phone, the receiver needs to know that encryption key to be able to decrypt it, how do they get that key? Using WhatsApp servers? Why would it be considered so difficult for WhatsApp to not keep that key?
If I send a video to one of my friends, it takes sometime to upload, it shows a progress bar while uploading.. if I forward the same video to a few other friends of mine, it gets sent within a second, immediately. How? was it not encrypted? How come it got sent if it didn't encrypt again?
Finally how does WhatsApp web still work? If WhatsApp's website can show me all of my messages (regardless of how I login) why can the server guys not see it? How is it that they cannot emulate my login and be able to see everything I am doing? I just sent an image to a friend of mine using WhatsApp web, it got sent, he saw it.. everything was fine. I turned off my WiFi before opening WhatsApp and the image hasn't even downloaded!! Its not even in my phone.. how did WhatsApp web use my 'phone' to send that image when it doesn't even exist in my phone? (Note: My settings don't allow immediate downloading of images). Clearly WhatsApp wasn't talking to my phone it just sent it because its on the server..
Can someone please help me understand this?