Skip to main content
65 votes
Accepted

Is Signal still more secure than WhatsApp?

There are still a couple of security functions, which may matter to you, which Signal does better than WhatsApp. Client-Side Fanout When you use a group chat in WhatsApp, you send your message to the ...
SEJPM's user avatar
  • 9,780
61 votes
Accepted

More secure to use e.g. Whatsapp Web in Franz than in browser?

But I was wondering, is it actually more secure to use for example Whatsapp Web in Franz instead of the browser? No, Franz is not inherently more secure than a regular browser. Under the hood, ...
Arminius's user avatar
  • 44.9k
48 votes

Can I use WhatsApp to securely send public key, symmetric key and private key?

E2EE doesn't protect data at rest. Unlike Signal, WhatsApp doesn't encrypt internal message database. A forensic analysis can decrypt deleted messages if Data Encryption Keys which encrypt user's and ...
defalt's user avatar
  • 6,901
46 votes
Accepted

Which protocols exist for end-to-end encrypted group chat?

Let me try to sum up what the landscape of end-to-end encrypted messaging protocols for group chat looks like: Protocols like PGP have been around for some time and offer "group messaging" by simply ...
FredericJacobs's user avatar
25 votes

Can I use WhatsApp to securely send public key, symmetric key and private key?

No, No, No! Don't base your security on a program that is a crippled version of the Signal protocol. public key It is public and normally one publishes it on the net and verify it with other channels ...
kelalaka's user avatar
  • 5,559
22 votes

Is Signal still more secure than WhatsApp?

Disclaimer: this is a non-technical contribution (an addition to the already-given answer). Some content may be subjective, possibly speculative. I believe that when evaluating/comparing information ...
Marcin K's user avatar
  • 341
21 votes

How does Jami (formerly Ring.cx) really work, and how secure is it?

As a Jami (formerly Ring) developer I will try to answer this. Of course this answer is inevitably biased and incomplete, but it might answer some concerns or misunderstandings about how Jami works, ...
aberaud's user avatar
  • 312
21 votes

How can we determine if there is actual encryption and what type of encryption on messaging apps?

How can we be certain if there is an actual encryption and what type of encryption. Unless you have access to the code and have the knowledge to analyze the specific implementation and algorithm for ...
Steffen Ullrich's user avatar
14 votes

How does WhatsApp's new group chat protocol work and what security properties does it have?

Firstly, from their paper Messages to WhatsApp groups build on the pairwise encrypted sessions outlined above to achieve efficient server-side fan-out for most messages sent to groups. This is ...
Nathan's user avatar
  • 852
10 votes

Is Telegram E2E Still Insecure?

2017-11-01 update: MIT Security analysis of Telegram finds it to be insecure. Quote from the following paper ...”our survey shows that Telegram has had serious and simple issues in the protocol (e.g. ...
Trey Blalock's user avatar
  • 14.2k
10 votes

How can we determine if there is actual encryption and what type of encryption on messaging apps?

As others have stated, it can be difficult to impossible to validate good encryption implementations, for some definition of good. Conversely indicators of concern can often be seen, for some ...
user10216038's user avatar
  • 8,143
9 votes
Accepted

Does perfect forward secrecy work with group chats or chat history?

I think you mean Perfect forward secrecy, which WhatsApp does support in its end-to-end encryption. PFS is difficult for chat apps, because of the uncertainty in the connection, and is the reason many ...
Yorick de Wid's user avatar
8 votes

Can I use WhatsApp to securely send public key, symmetric key and private key?

Your public key is public. You can publish or send it without protection. Unless you have the very specific need that your identity must not be associated with your public key. Your private (or ...
A. Hersean's user avatar
  • 10.6k
7 votes

Is loss of conversation history inherent to end-to-end encryption?

No, loss off message history isn't inherent to end to end encryption, but it's inherent to forward secrecy. It might be either the Wire developer conflating between e2e and FS, or they consider FS to ...
Lie Ryan's user avatar
  • 31.5k
7 votes

Can Apple technically intercept iMessage messages

If you make use of Apple's iMessage service then you are implicitly trusting Apple, as they wrote all the code that you are running and therefore could make it do anything they want it to. So either ...
Rory McCune's user avatar
  • 62.4k
7 votes
Accepted

Why do we need OMEMO if XMPP is already encrypted?

TLS (Transport Layer Security) simply encrypts the data in transit between two endpoints. This is good for preventing casual observation, but doesn't protect the data from all vectors. And TLS is ...
Ruscal's user avatar
  • 851
6 votes

Telegram messages in group are seen immediately

I think your group is in fact a so-called Super Group. Super Groups work a little differently than normal groups and the one-check/two-check system doesn't apply here. All messages get double checks ...
Jochem Kuijpers's user avatar
6 votes
Accepted

Does WhatsApp have a golden key to decrypt messages?

A "golden key stored in device memory"? Not that I know of. But WhatsApp does have a vulnerability that potentially allows it to access any messages not yet marked as delivered, according to this ...
sampablokuper's user avatar
6 votes
Accepted

How do end-to-end encrypted chat services ensure that the server admin doesn't add new members to a chat?

It is possible for a server admin to silently add an infiltrator to group chats. But without letting the group to be notified, It's not possible well atleast in Signal protocol. Signal is open-source ...
defalt's user avatar
  • 6,901
6 votes

Why do we need OMEMO if XMPP is already encrypted?

TLS - protects your data to the server. OMEMO, OTR, PGP - protects your data to the device of your interlocutor Only TLS - is preferred to use only on your home server or on corporate servers (where ...
J.Doe's user avatar
  • 61
6 votes

Private messaging for protesters

This is hard to answer, because, depending on how hard an entity might push, anyone might still give away information/unlock his/her phone under a threat. However: To mitigate accidental unlocks, you ...
Marcel's user avatar
  • 4,093
6 votes
Accepted

Man-in-the-middle attacks in end-to-end encryption

Suppose the client software is trustworthy (after all, if it isn't, how do you know it doesn't send a copy of all your messages somewhere). Everyone installs the client, it generates a new key pair ...
Z.T.'s user avatar
  • 8,524
6 votes

How can we determine if there is actual encryption and what type of encryption on messaging apps?

If you are only interested in finding if there is some form encryption, you can simply dump the traffic from the app and look at it to see if the contents are encrypted or not following the specs ...
Grooke's user avatar
  • 278
5 votes
Accepted

Why is DARPA interested in secure messaging platform using blockchain technology?

I see your question as having two parts: Why blockchain? According to ZDNet's summary of the request, the preference for a decentralised blockchain solution is rooted in an interest in moving away ...
Robbie's user avatar
  • 233
5 votes

Implications of prominent *secure messaging apps* requiring phone number identifiers

Not having a phone number tied to you wouldn't really stop intelligence agencies from associating you with who you're talking with. Encryption ensures they can't track what you're talking about, but ...
Lie Ryan's user avatar
  • 31.5k
5 votes

Required a simple guide for secure messaging application

This is actually just the opposite; it is a rather in-secure way of handling messages. Repeat after me: "My server should never, ever, be able to read the contents of a 'secure' message." Because ...
Ruscal's user avatar
  • 851
5 votes

Are Whatsapp and Signal truly secure and user-privacy friendly?

WhatsApp has a known security design loophole. The private keys are indeed stored on the user's device. When you install WA on device B, you will be taking ownership of your account again. At this ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
4 votes

Diffie Hellman Key Exchange in a messaging application

To get a good picture of the Diffie Hellman Key Exchange some diagramatic representations may be helpful. The common approach for messaging applications on Android (or any other client devices) in ...
Douglas Daseeco's user avatar
4 votes

Does WhatsApp have a golden key to decrypt messages?

No, it's implausible that WhatsApp owns a key to read your end-to-end encrypted messages. WhatsApp implements end-to-end encryption per the Signal protocol which has maintained a good reputation in ...
Arminius's user avatar
  • 44.9k
4 votes

Telegram: Security risks for a user of using third-party socks5 proxy?

The biggest security concern for most communication system is third party abilities to sniff / intercept and decode/tampered the message. Such attack are called "Man-in-the-middle attacks" (MiTM). ...
mootmoot's user avatar
  • 2,407

Only top scored, non community-wiki answers of a minimum length are eligible