I wonder whether the Whatsapp messages are sufficiently encrypted so that the ISP/MSP ( mobile service provider) cannot read what is inside?

I will be travelling to some of the most oppressive regimes in the world, and I fear that my Whatsapp chats might be monitored because the messages will be passing through local ISPs or MSPs.


Short answer: NO, if you are sure you are using end to end encryption, and MOST LIKELY NO, if you aren't using end to end encryption.

Whatsapp uses encryption two ways: first it has an "outer layer" built by TLS, which has ben analyzed thoroughly by the security company Praetorian in February 2014, with almost all issues pointed out being fixed within a day. The page only says that Whatsapp promised to include certificate pinning, but I assume they did in the meantime. If there is no certificate pinning, then ISPs/Governments with control over certificate authorities can indeed mount a successful MITM attack (and we know that china did this).

The second, inner layer, is more secure, when active. It uses the encryption used by Textsecure, and, if you have verified the keys of the the parties you communicate (e.g. by meeting them in person and comparing hashes), is quite secure (using modern standards, etc, but without a professional review), once you know its activated. The activation part is the problem: you never actually know.

Also, according to this answer, textsecure wasn't encrypted over 3G in the past.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.