Hacker News Reader

Comment by indigo945 | Hacker News Reader

This is not true, unlike Telegram, WhatsApp has a reasonable model for E2EE and it's enabled by default. The UI is lackluster and it really should scream more when contacts' public keys change (to prevent MITM attacks), and it doesn't protect metadata such as your contact list at all, but all of that is still better than Telegram, which offers no encryption for group chats at all.

View on HN

> but all of that is still better than Telegram, which offers no encryption for group chats at all

I think Telegram (group) chats are encrypted, just not end to end.

Transport encryption is table stakes. It's really no longer something that can be mentioned as if it were something special. When I browse to a random website I don't think “wow HTTPS, so secure”. The channel client <-> service is encrypted, but the service still gets all of the data in plaintext.

On a technical level, Telegram is are as secure as Facebook Messenger. Both offer transport encryption and optionally E2EE secret chats. Actually, I might trust Facebook more (on a technical level) because they don't have Telegram's disastrous history with home-brewed crypto protocols.

The thing with E2E encryption, is it really verifiable? Has anyone actually gotten/extracted the WhatsApp secrets and then checked that what goes in one end comes out the other fully encrypted, systematically?

After all, everything goes through WhatsApp's proprietary clients and servers, we don't know what voodoo they do along the way. Just because they claim it's E2E encrypted, doesn't really make it so, I'd imagine. Has their E2E encryption been confirmed independently?

They had Moxie Marlinspike, who is behind Signal, audit their encryption code. Of course, we can't know if the code they let him audit is actually the code that gets deployed, and it's also been a few years since then, but the E2EE has been independently confirmed.

> This is not true

The fact that I recieve advertising in FB for things discussed in a 1:1 chat in whats app, minutes after discussing them, means it's not secure. E2E is end to end, not end to FB to end.

May be the other E has been googling about the thing you discuss. Metadata is an important flaw, they don't need to compromise the E2E communication to track/profile you.

What keyboard are you using?

Reply on news.ycombinator.com