You are viewing a single thread.
View all comments View context
1 point

Just encrypt it before sending it to their servers. How would you tell that apart from any other traffic it sends? (E.g. to check for new messages, to update who of your contacts is online, etc)

permalink
report
parent
reply
2 points
*

what does that have to do with anything? if you have to encrypt your messages manually yourself, that kind of proves the point that the service itself is not secure. And it’ll still show up on a network sniffer that they’re sending it to two places

permalink
report
parent
reply
1 point
*

Ok, let me break it down because clearly I didn’t explain it well.

What is supposed to happen, scenario 1: the client encrypts your messages with the public key of the recipient, sends it to the servers of WhatsApp (or whatever service) along with some encrypted metadata indicating the recipient, which then forward the message to the recipient.

What could happen, scenario 2: the client does the same, but also encrypts another copy of your message with a public key that belongs to WhatsApp, and send both versions to the WhatsApp servers. They decrypt and keep the second version while forwarding the first one to the recipient.

Or, scenario 3: they just never bother with end-to-end encryption, and always encrypt it with the WhatsApp key, still sending it to their servers which then reencrypt with the recipient’s key before forwarding.

In all cases, messages are sent only to the WhatsApp servers, not two places. The only visible difference is in scenario 2 where the communication is larger. You can’t inspect the metadata of the message with your network sniffer, because it is also encrypted, so there’s no way to rule out scenario 3.

If the protocol is designed to be transparent by not encrypting the entire payload sent to the servers, and you have access to the recipient’s private key (those are big ifs) then you could show that there is indeed an end-to-end encrypted message in there. But this is true for how many of these proprietary services? Maybe for WhatsApp.

permalink
report
parent
reply

Android

!android@lemdro.id

Create post

The new home of /r/Android on Lemmy and the Fediverse!

Android news, reviews, tips, and discussions about rooting, tutorials, and apps.

🔗Universal Link: !android@lemdro.id


💡Content Philosophy:

Content which benefits the community (news, rumours, and discussions) is generally allowed and is valued over content which benefits only the individual (technical questions, help buying/selling, rants, self-promotion, etc.) which will be removed if it’s in violation of the rules.


Support, technical, or app related questions belong in: !askandroid@lemdro.id

For fresh communities, lemmy apps, and instance updates: !lemdroid@lemdro.id

💬Matrix Chat

💬Telegram channels / chats

📰Our communities below


Rules

  1. Stay on topic: All posts should be related to the Android OS or ecosystem.

  2. No support questions, recommendation requests, rants, or bug reports: Posts must benefit the community rather than the individual. Please post to !askandroid@lemdro.id.

  3. Describe images/videos, no memes: Please include a text description when sharing images or videos. Post memes to !androidmemes@lemdro.id.

  4. No self-promotion spam: Active community members can post their apps if they answer any questions in the comments. Please do not post links to your own website, YouTube, blog content, or communities.

  5. No reposts or rehosted content: Share only the original source of an article, unless it’s not available in English or requires logging in (like Twitter). Avoid reposting the same topic from other sources.

  6. No editorializing titles: You can add the author or website’s name if helpful, but keep article titles unchanged.

  7. No piracy or unverified APKs: Do not share links or direct people to pirated content or unverified APKs, which may contain malicious code.

  8. No unauthorized polls, bots, or giveaways: Do not create polls, use bots, or organize giveaways without first contacting mods for approval.

  9. No offensive or low-effort content: Don’t post offensive or unhelpful content. Keep it civil and friendly!

  10. No affiliate links: Posting affiliate links is not allowed.

Quick Links

Our Communities
Lemmy App List
Chat and More

Community stats

  • 1.5K

    Monthly active users

  • 2.8K

    Posts

  • 34K

    Comments