4

You may see this question as a logical successor of this post.

With the new Whatsapp Web update it is now usable without keeping the smartphone online. I can't imagine how this is compatible with End-to-End-encryption since the private key for decrypting messages has to be shared with the linked device through Whatsapps servers. In the FAQ for this feature Whatsapp just says "Your personal messages, media, and calls are end-to-end encrypted." but doesn't elaborate. The Encryption Whitepaper hasn't (yet) been adapted.

Does anyone know how this feature is (or could be) implemented and if this is still compatible with E2E-encryption?

Improve this question
3
  • 1
    Other examples of messengers with multi-device E2EE include Signal and Matrix/Element. The different devices can create an E2EE channel between each other and use that to share the private keys and chat histories. But given that WhatsApp is closed source, it's difficult to verify any E2EE claims.
    – amon
    Commented Mar 23, 2022 at 7:37
  • 3
    For anyone interested, I found this Blog post by Facebook that covers the technical details. (If you choose to trust Facebook on this.)
    – etw0
    Commented May 24, 2022 at 14:08
  • The "Five Eyes Nations" are demanding a backdoor into WhatsApp: theguardian.com/uk-news/2019/jul/30/…. I mention this as it will break any idea of end to end encryption if the request is granted.
    – user2677034
    Commented Dec 25, 2022 at 19:48

1 Answer 1

Reset to default
5

That's pure speculation, but a unique message can be encrypted multiple times to different recipients, one time for a phone and another time for a web app. The recipients are the apps, not the users.

Also, a private key can be shared among devices of the same user, without needing to disclose it to a server. The private key just needs to be encrypted (and authenticated) with a key derived by a secret known only from the user. This secret could be a passphrase, or a QR code generated on one device and scanned of the other.

I do not know how this particular service does it, but there are not technical issues here.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .