2

You may see this question as a logical successor of this post.

With the new Whatsapp Web update it is now usable without keeping the smartphone online. I can't imagine how this is compatible with End-to-End-encryption since the private key for decrypting messages has to be shared with the linked device through Whatsapps servers. In the FAQ for this feature Whatsapp just says "Your personal messages, media, and calls are end-to-end encrypted." but doesn't elaborate. The Encryption Whitepaper hasn't (yet) been adapted.

Does anyone know how this feature is (or could be) implemented and if this is still compatible with E2E-encryption?

2
  • 1
    Other examples of messengers with multi-device E2EE include Signal and Matrix/Element. The different devices can create an E2EE channel between each other and use that to share the private keys and chat histories. But given that WhatsApp is closed source, it's difficult to verify any E2EE claims.
    – amon
    Mar 23 at 7:37
  • 1
    For anyone interested, I found this Blog post by Facebook that covers the technical details. (If you choose to trust Facebook on this.)
    – etw0
    May 24 at 14:08

1 Answer 1

3

That's pure speculation, but a unique message can be encrypted multiple times to different recipients, one time for a phone and another time for a web app. The recipients are the apps, not the users.

Also, a private key can be shared among devices of the same user, without needing to disclose it to a server. The private key just needs to be encrypted (and authenticated) with a key derived by a secret known only from the user. This secret could be a passphrase, or a QR code generated on one device and scanned of the other.

I do not know how this particular service does it, but there are not technical issues here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.