Two questions.
My family insist on using Whatsapp for the family chats. I have to keep a copy on a device just so I can communicate with them. I do so under protest, as I was always told it isn't secure. My brother has just said
"oh Whatsapp is encrypted, it's perfectly secure".
First, is it actually as encrypted and safe as my brother claims? That would solve everything.
Second, if it isn't, where can I get some proof that we should switch to Telegram or whatever? Proof which doesn't make me look like a raving loony?
Cybersec researcher here. The content of your chat is encrypted end to end. Their servers can't read what you write. This is because they use the same protocol as signal, x3dh and double ratchet. However, they can and will collect everything else. Contact info, for example, phone, etc
If you login to another device with WhatsApp, does it show your chat history? If so, then the servers have your key.
I've never used any FB service, so I don't know., and I don't know anyone who uses WhatsApp.
To "link" other devices you have to scan a qr from your phone, so it's certainly possible that during that process the devices connect and share the key, and the servers don't have it.
Or the servers could have it. Idk, it's closed source, that's the problem at hand.
Sounds like it transfers the ID Out-of-band, so that's good, does the desktop get the chat history then? (It's possible it pulls chat history from the phone).
Oh, I agree with the closed source issue. That makes it a no-sale for me.
No, the protocol is sound enough, WhatsApp doesn’t have the key, doesn’t want the key (so they will probably not be responsible for what you are communicating with others), and doesn’t need the key - as others have put so eloquently, the metadata is rich enough for them.