66
votes
Accepted
Is Signal still more secure than WhatsApp?
There are still a couple of security functions, which may matter to you, which Signal does better than WhatsApp.
Client-Side Fanout
When you use a group chat in WhatsApp, you send your message to the ...
- 9,820
61
votes
Accepted
More secure to use e.g. Whatsapp Web in Franz than in browser?
But I was wondering, is it actually more secure to use for example Whatsapp Web in Franz instead of the browser?
No, Franz is not inherently more secure than a regular browser.
Under the hood, ...
- 45.1k
48
votes
Can I use WhatsApp to securely send public key, symmetric key and private key?
E2EE doesn't protect data at rest. Unlike Signal, WhatsApp doesn't encrypt internal message database. A forensic analysis can decrypt deleted messages if Data Encryption Keys which encrypt user's and ...
- 6,971
25
votes
Can I use WhatsApp to securely send public key, symmetric key and private key?
No, No, No!
Don't base your security on a program that is a crippled version of the Signal protocol.
public key
It is public and normally one publishes it on the net and verify it with other channels ...
- 5,589
22
votes
Is Signal still more secure than WhatsApp?
Disclaimer: this is a non-technical contribution (an addition to the already-given answer). Some content may be subjective, possibly speculative.
I believe that when evaluating/comparing information ...
- 341
21
votes
How does Jami (formerly Ring.cx) really work, and how secure is it?
As a Jami (formerly Ring) developer I will try to answer this. Of course this answer is inevitably biased and incomplete, but it might answer some concerns or misunderstandings about how Jami works, ...
- 312
21
votes
How can we determine if there is actual encryption and what type of encryption on messaging apps?
How can we be certain if there is an actual encryption and what type of encryption.
Unless you have access to the code and have the knowledge to analyze the specific implementation and algorithm for ...
- 208k
10
votes
How can we determine if there is actual encryption and what type of encryption on messaging apps?
As others have stated, it can be difficult to impossible to validate good encryption implementations, for some definition of good.
Conversely indicators of concern can often be seen, for some ...
- 8,213
9
votes
Accepted
Does perfect forward secrecy work with group chats or chat history?
I think you mean Perfect forward secrecy, which WhatsApp does support in its end-to-end encryption. PFS is difficult for chat apps, because of the uncertainty in the connection, and is the reason many ...
- 3,408
8
votes
Can I use WhatsApp to securely send public key, symmetric key and private key?
Your public key is public. You can publish or send it without protection. Unless you have the very specific need that your identity must not be associated with your public key.
Your private (or ...
- 10.7k
7
votes
Is loss of conversation history inherent to end-to-end encryption?
No, loss off message history isn't inherent to end to end encryption, but it's inherent to forward secrecy.
It might be either the Wire developer conflating between e2e and FS, or they consider FS to ...
- 31.6k
7
votes
Can Apple technically intercept iMessage messages
If you make use of Apple's iMessage service then you are implicitly trusting Apple, as they wrote all the code that you are running and therefore could make it do anything they want it to.
So either ...
- 62.6k
7
votes
Accepted
Why do we need OMEMO if XMPP is already encrypted?
TLS (Transport Layer Security) simply encrypts the data in transit between two endpoints. This is good for preventing casual observation, but doesn't protect the data from all vectors. And TLS is ...
- 841
7
votes
Accepted
Man-in-the-middle attacks in end-to-end encryption
Suppose the client software is trustworthy (after all, if it isn't, how do you know it doesn't send a copy of all your messages somewhere).
Everyone installs the client, it generates a new key pair ...
- 8,654
6
votes
Accepted
Does WhatsApp have a golden key to decrypt messages?
A "golden key stored in device memory"? Not that I know of.
But WhatsApp does have a vulnerability that potentially allows it to access any messages not yet marked as delivered, according to this ...
- 2,081
6
votes
Accepted
How do end-to-end encrypted chat services ensure that the server admin doesn't add new members to a chat?
It is possible for a server admin to silently add an infiltrator to group chats. But without letting the group to be notified, It's not possible well atleast in Signal protocol.
Signal is open-source ...
- 6,971
6
votes
Why do we need OMEMO if XMPP is already encrypted?
TLS - protects your data to the server.
OMEMO, OTR, PGP - protects your data to the device of your interlocutor
Only TLS - is preferred to use only on your home server or on corporate servers (where ...
- 61
6
votes
Private messaging for protesters
This is hard to answer, because, depending on how hard an entity might push, anyone might still give away information/unlock his/her phone under a threat. However:
To mitigate accidental unlocks, you ...
- 4,143
6
votes
How can we determine if there is actual encryption and what type of encryption on messaging apps?
If you are only interested in finding if there is some form encryption, you can simply dump the traffic from the app and look at it to see if the contents are encrypted or not following the specs ...
- 278
5
votes
Implications of prominent *secure messaging apps* requiring phone number identifiers
Not having a phone number tied to you wouldn't really stop intelligence agencies from associating you with who you're talking with.
Encryption ensures they can't track what you're talking about, but ...
- 31.6k
5
votes
Required a simple guide for secure messaging application
This is actually just the opposite; it is a rather in-secure way of handling messages. Repeat after me: "My server should never, ever, be able to read the contents of a 'secure' message." Because ...
- 841
5
votes
Are Whatsapp and Signal truly secure and user-privacy friendly?
WhatsApp has a known security design loophole.
The private keys are indeed stored on the user's device. When you install WA on device B, you will be taking ownership of your account again.
At this ...
- 5,418
4
votes
Diffie Hellman Key Exchange in a messaging application
To get a good picture of the Diffie Hellman Key Exchange some diagramatic representations may be helpful.
The common approach for messaging applications on Android (or any other client devices) in ...
- 634
4
votes
Does WhatsApp have a golden key to decrypt messages?
No, it's implausible that WhatsApp owns a key to read your end-to-end encrypted messages.
WhatsApp implements end-to-end encryption per the Signal protocol which has maintained a good reputation in ...
- 45.1k
4
votes
Telegram: Security risks for a user of using third-party socks5 proxy?
The biggest security concern for most communication system is third party abilities to sniff / intercept and decode/tampered the message. Such attack are called "Man-in-the-middle attacks" (MiTM). ...
- 2,417
3
votes
Spoofing the identity of another user in Telegram
Yes.
Every Telegram account has a phone number attached. You can see the attached phone number to check if is the correct one.
If you don't know the phone number of someone, anything can be shown as ...
- 5,365
3
votes
Accepted
Signal: Secure way to transfer images out of encrypted chat?
As @MiaoHatola pointed out in a comment, the obvious solution is to use the Signal Desktop Client (Chrome App) which allows you to be signed in and receive messages simultaneously on your phone and ...
- 191
3
votes
Is the Wire messaging app secure?
To answer your first (and easy) question: Yes, they use Signal's protocol.
The second question is a tough one. (But since they do use Signal's protocol, you might as well use Signal, don't you think?)...
- 31
3
votes
Which protocols exist for end-to-end encrypted group chat?
Maybe Asynchronous Ratcheting Tree is what you are asking for.
You can also take a look at Messaging Layer Security:
Messaging Layer Security (MLS) is an IETF working group building a
modern, ...
- 31
3
votes
Does Google have access to keystrokes on our Android device keyboard?
According to their confidentiality statement, Google doesn't collect anything from what you type when using GBoard, except the searches you make using the G button (for an obvious reason, they need ...
- 141
Only top scored, non community-wiki answers of a minimum length are eligible