5

I see this EFF tool guide, proposing WhatsApp as one of "our pick of the best, most secure applications" source.

How can WhatsApp be trusted as a secure application when it is not open-source (according to Wikipedia: "license: freeware"), in contrast to Signal (according to Wikipedia: "All Signal software are free and open-source")?

I know that WhatsApp uses the Signal Protocol library for implementing the Signal Protocol, but is this enough to consider it a trusted secure application, and place it at the same level of trust as the Signal opensource client?

  • As you can see in the following page, WhatsApp claims to have Signal implemented (that is an open-source secure protocol): en.wikipedia.org/wiki/Signal_Protocol. Crypto researchers can confirm that WhatsApp is indeed using Signal. – Filipe dos Santos Sep 9 '19 at 13:31
  • @Filipe dos Santos The fact that is implementing Signal is not an indicator that it does not contain vulnerable or malicious code, or that the implementation is correct. – Marinos An Sep 9 '19 at 15:14
  • You need to have some evidences to make such claims. The research so far has no evidences of such malicious code or vulnerabilities for WhatsApp. Without access to the application server and the production code, one can make such claims for any piece of software, and this is not productive for the argument, nor it’s how research is done. – Filipe dos Santos Sep 9 '19 at 15:17
  • 3
    This looks like a question trying to drum up support for a position. EFF's decisions are theirs, and you need to ask them about their criteria. Also, the EFF explains their reservations about WhatsApp quite clearly. – schroeder Sep 9 '19 at 16:15
  • 1
    "Could such a choice, question EFF credibility regarding privacy software proposals?" is entirely an opinion-based question and off-topic. So, you have a question that needs to be asked of the source (EFF) and an opinion-based question. Both make this off-topic here. – schroeder Sep 9 '19 at 16:16
5

They do have reservations:

WhatsApp does still provide end-to-end encryption, which ensures that a message is turned into a secret message by its original sender, and decoded only by its final recipient. We take no issue with the way this encryption is performed. In fact, we hope that the encryption protocol WhatsApp uses, the Signal Protocol, becomes more widespread in the future. Instead, we are concerned about WhatsApp’s security despite the best efforts of the Signal Protocol.

My emphasis. They provide a guide for making WhatsApp better privacy and security-wise. They do note that they see problems with it.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.