Skip to main content
73 votes
Accepted

How is WhatsApp sending end-to-end encrypted messages in push notifications?

WhatsApp could be using VOIP background mode along with PushKit for solving this problem. Voip pushes are: delivered directly to the app. considered high-priority notifications and are delivered ...
Abhay Singh's user avatar
65 votes
Accepted

Is Signal still more secure than WhatsApp?

There are still a couple of security functions, which may matter to you, which Signal does better than WhatsApp. Client-Side Fanout When you use a group chat in WhatsApp, you send your message to the ...
SEJPM's user avatar
  • 9,780
63 votes
Accepted

How might the Chinese government be blocking only specific types of WhatsApp traffic?

Given that Whatsapp traffic has end-to-end encryption, ... End-to-end encryption neither implies anonymity nor that the underlying protocol is unrecognizable to an eavesdropper and doesn't reveal any ...
Arminius's user avatar
  • 44.9k
61 votes
Accepted

More secure to use e.g. Whatsapp Web in Franz than in browser?

But I was wondering, is it actually more secure to use for example Whatsapp Web in Franz instead of the browser? No, Franz is not inherently more secure than a regular browser. Under the hood, ...
Arminius's user avatar
  • 44.9k
55 votes
Accepted

Whatsapp encryption keys

"I did not generate my private/public keys" You didn't, but your device did. "nor can I change them" I wouldn't be surprised if they add that ability in future (as it'd just be a case of being ...
Nathan's user avatar
  • 852
48 votes

Can I use WhatsApp to securely send public key, symmetric key and private key?

E2EE doesn't protect data at rest. Unlike Signal, WhatsApp doesn't encrypt internal message database. A forensic analysis can decrypt deleted messages if Data Encryption Keys which encrypt user's and ...
defalt's user avatar
  • 6,901
42 votes
Accepted

How can WhatsApp do both targeted advertisement and end-to-end encryption?

Your WhatsApp account is linked to your Facebook account. They know lots about you from your Facebook activity, and can use that to direct targeted ads at you on WhatsApp, without knowing anything at ...
Mike Scott's user avatar
  • 10.3k
36 votes

How To Recover End-To-End Encrypted Data After Losing Private Key?

You have found another example of the balance security vs usability. If you want true E2E encryption, end users are responsible for their keys and for possible backups of their messages. Full stop. If ...
Serge Ballesta's user avatar
34 votes
Accepted

Which Cryptography algorithm is used in WhatsApp end-to-end security?

WhatsApp partnered with Open Whisper Systems for the cryptographic portions of messaging. The process involves a variation of Off the Record (OTR), Perfect Forward Secrecy (PFS), and the Double ...
munkeyoto's user avatar
  • 8,692
33 votes
Accepted

Does backing up WhatsApp on Google Drive expose messages?

You're confusing message integrity and security with secrecy. WhatsApp provides end to end encryption, meaning the message you send can only be read by the recipient and vice versa. This protects you ...
zzarzzur's user avatar
  • 1,132
32 votes
Accepted

Can governments intercept end-to-end encrypted Whatsapp communication through lawful interception?

It's very unlikely that any government agency would crack the encryption. They would need the key. And the only way they could get that is if Whatsapp had a backdoor or weakness in their software ...
Fiksdal's user avatar
  • 3,107
31 votes
Accepted

How can WhatsApp restore local or Google Drive Backups?

First assumption: The backup key is saved on WhatsApp servers too. Otherwise a local phone to phone backup would not work? TL;DR: Yes, after some investigation, this seems to be the case. Secondary ...
Yorick de Wid's user avatar
25 votes

Can I use WhatsApp to securely send public key, symmetric key and private key?

No, No, No! Don't base your security on a program that is a crippled version of the Signal protocol. public key It is public and normally one publishes it on the net and verify it with other channels ...
kelalaka's user avatar
  • 5,559
22 votes

Is Signal still more secure than WhatsApp?

Disclaimer: this is a non-technical contribution (an addition to the already-given answer). Some content may be subjective, possibly speculative. I believe that when evaluating/comparing information ...
Marcin K's user avatar
  • 341
19 votes

How To Recover End-To-End Encrypted Data After Losing Private Key?

If user changes the device, reinstalls the app, private key which stored on client will be lost. I know i can create new key pairs for future messages but how can i restore the old ones? Why do you ...
vidarlo's user avatar
  • 16.6k
17 votes

How does the Signal Protocol, used by WhatsApp, work?

Take a look at this technical white paper from WhatsApp, they recently moved to the Signal Protocol for e2e encryption. Public Key Types Identity Key Pair – A long-term Curve25519 key pair, ...
joshperry's user avatar
  • 391
14 votes

Whatsapp encryption keys

It is correct that you did not generate the keys, WhatsApp did. So you have to trust WhatsApp on this, and on not keeping any copy of the private key. At most you can verify that you are exchanging ...
Guille's user avatar
  • 385
14 votes

How does WhatsApp's new group chat protocol work and what security properties does it have?

Firstly, from their paper Messages to WhatsApp groups build on the pairwise encrypted sessions outlined above to achieve efficient server-side fan-out for most messages sent to groups. This is ...
Nathan's user avatar
  • 852
12 votes
Accepted

If I accidentally agree for new WhatsApp's terms and conditions, How to revert that?

As a general rule of thumb with these things, the only way to disagree with the terms of use is by not using it. If you're expecting that you can "revert" your agreement and only be subject ...
Conor Mancone's user avatar
11 votes

How is WhatsApp sending end-to-end encrypted messages in push notifications?

What you call Push Notifications (the ones you see in your notification center) are not exactly the same thing as Remote Notifications (the ones sent via APNs). On Android the two are totally ...
Thibault D.'s user avatar
11 votes

How can WhatsApp do both targeted advertisement and end-to-end encryption?

End-to-end encryption is not peer-to-peer. There is a centralised XMPP server which handles delivery of messages. What's app client communicates with the server to send and receive messages between ...
defalt's user avatar
  • 6,901
10 votes

"Whatsapp Web is open in another computer or browser" - What should I do?

Open Whatsapp in your handset. Go to Options named "Whatsapp Web", Click on "Logout from all computers" & then try to login again.
Surendra Patil's user avatar
10 votes
Accepted

Attack vector for exploiting WhatsApp's retransmission "vulnerability"?

What does a real-life attack look like that would exploit this vulnerability? Here is a possible scenario: Alice lives in an oppressive government. She communicates with journalist Jonas over ...
Arminius's user avatar
  • 44.9k
10 votes
Accepted

How did Instagram know the content of my WhatsApp conversation and Google searches?

I'm figuring that the foundational knowledge about this topic is slowly being lost to time, and there are new course modules in schools around the world to cover this type of thing, so I think it's ...
schroeder's user avatar
  • 131k
10 votes
Accepted

Free messaging (but not images, video, etc) on United Airlines free wifi: is it secure?

Whatsapp uses different servers to process attachments. They are hosted on different domains. All they need to do is to block those multi-media processing domains. Reference: paper 2015 These types of ...
schroeder's user avatar
  • 131k
9 votes

How can application like Whatsdog detect user online status from Whatsapp?

It's actually by an undocumented API from whatsapp and you can communicate over Websockets to get the online status of people. This article will show you how it is done and even provide a PoC for it ...
Nico's user avatar
  • 509
9 votes
Accepted

Does WhatsApp's link preview on the link messages leak information?

WhatsApp client makes http GET request to the site sender types in, in order to fetch site's meta properties that show up in preview. <meta property="og:title" content="Information ...
defalt's user avatar
  • 6,901
8 votes

Why is whatsapp using 6 digit codes for verification?

Why are there not less than 6 digits? The longer the code, the harder it is to guess. One could argue that 4 is already enough if you discard the code after a failed attempt, but why should you throw ...
Christian Strempfer's user avatar
8 votes
Accepted

Why you can't see online status of others if you hide yours?

It's not, it's merely a fair use policy/scenario. You get a privacy benefit (seeming to be offline), but you have to pay a price (not knowing when others are online). Technically, they could tell ...
ndrix's user avatar
  • 3,306
8 votes

How does the WhatsApp chat history recovery work together with their encryption mechanism?

WhatsApp includes a feature to explicitely cope with users losing their phones or the phones being broken. That feature is discussed in a article from the Guardian where it is seen as a back door: ...
Serge Ballesta's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible