The Core

Forget Apple vs. the FBI: WhatsApp Just Switched on Encryption for a Billion People

This means that if any group of people uses the latest version of WhatsApp—whether that group spans two people or ten—the service will encrypt all messages, phone calls, photos, and videos moving among them. And that’s true on any phone that runs the app, from iPhones to Android phones to Windows phones to old school Nokia flip phones. With end-to-end encryption in place, not even WhatsApp’s employees can read the data that’s sent across its network. In other words, WhatsApp has no way of complying with a court order demanding access to the content of any message, phone call, photo, or video traveling through its service. Like Apple, WhatsApp is, in practice, stonewalling the federal government, but it’s doing so on a larger front—one that spans roughly a billion devices.

Most privacy buffs would stay clear of WhatsApp because of its connection to Facebook. However, even Edward Snowden likes Moxie Marlinspike's Signal app for secure communication. Moxie Marlinspike's involvement with WhatsApss's encryption efforts should lend some credence to it.

They've been working on this since 2013 when they began offering encrypted communications if both sides had it turned on for text messages only IIRC. Now it's on for everything, by default, for all users. When your average userbase doesn't have to think about changing a setting, or to figure out how to exchange keys, then this is a pretty big development given their sheer size. I'm going to have to give it another look as I have a hard time getting people to install Signal as it is.

I just installed it today to take a look. I have a ton of contacts already on there. It's hard to get these people to switch over to a more secure app like Signal or Threema just for chatting. In that case WhatsApp would be good enough.

I also use a no-contract SIM for my phone. It has a decent data plan, but phone calls and SMS are really expensive. Therefore I use apps to call when I can (or send SMS). You can make encrypted phone calls with WhatsApp that are charged to your data plan.

Proof that we're an older demographic.

Although I resemble that remark, that's not my excuse for just installing WhatsApp.

I've known about WhatsApp for years. It's probably the most popular app in Asia (though not in Japan where LINE kicks its a##). In its early days I didn't get it because it was initially a paid app. There were better free alternatives in my mind, and their security was laughable. It was a real afterthought for them. Until August 2012 they didn't even encrypt messages sent. Everything was in the clear. In 2013 there was a big flap about flaws in the ways they did encrypt messages. They were using the same key to encrypt every message in a conversation, so if the key was compromised so was everything you talked about. That also made it easier for the snoops to capture any part of a conversation and then work on decrypting it. Then there were problems with their payment systems. They were also hit with a contact list infecting worm. Also, there were ways your contacts could stalk you using 3rd party apps. The list goes on. The final straw was the Facebook acquisition. I was not interested in putting my communications in Facebook's hands. In summary, they weren't looking like thy type of app I wanted on my device.

So, what's different now? Well, after the Facebook acquisition WhatsApp has been left pretty much to its own devices. This plan to implement the Open Whisper Systems Signal protocol was in place before they were acquired, and was not stopped. That was very encouraging. Then the heavy involvement of Moxie Marlinspike to implement what is now known as the Signal protocol is the biggest sign that they're finally taking security and privacy seriously. This is an open source platform that we're likely to see implemented in other messaging apps after this.

I'm still not gung-ho about promoting WhatsApp for regular use. They still collect meta data about who you contact and although your communications are secure they can still tell who your're talking with and when. Being a part of Facebook I don't doubt they'd turn that information over in a heartbeat. However, for some fringe contacts whom I rarely get in touch with that's good enough.

Quote from: ergophobe on April 06, 2016, 04:34:43 PM

Proof that we're an older demographic.

Although I resemble that remark,

I know that Bill. But don't take it personally. I think I have a couple of years on you and though I have also heard all sorts of things about WhatsApp, I have not and do not plan to install it. I'm moving the other way in terms of that sort of thing!

Quote from: bill on April 06, 2016, 10:27:11 PM

Quote from: ergophobe on April 06, 2016, 04:34:43 PM

Proof that we're an older demographic.

Although I resemble that remark,

I know that Bill. But don't take it personally.

Should have included a  there...

I knew of it and its popularity but thought of it an a glorified MMS.  I text a fair amount, but it's just craigslist, family contacts, or Travoli. I guess if Trav wants to encrypt or meeting for dinner plans, I could load the app, hhh.

I'm not recommending the use of WhatsApp in general. There are better apps that are more secure. It's just that WhatsApp is now a bit more secure that I even bothered looking at it. This is possibly the biggest encrypted messaging app on the planet now. That's why I needed to take a look.

Use Signal instead if you need an app that communicates like this and you don't care whether the rest of the planet is using the same app.

Facebook is collecting all of that WhatsApp meta data, and that's a concern.

Should have included a  there...

I saw it whether there or not and intended mine to have the same.

>>What WhatsApp is not encrypting

I try to stick to the old rules when it comes to sensitive issues, whether a negative opinion about a neighbor or something weightier that you prefer not to share with the world at large

1. The maximum number of people who can keep a secret is two, and that depends on one of the parties being dead.
2. Prefer face-to-face to phone
3. Prefer phone to writing
4. Prefer ephemeral to recorded
5. Prefer encrypted to clear

Encryption is the least of it, but the best thing there is if it has to be in writing and at a distance.

I don't get it.
Brought my eldest a pay as you go phone.
It has no credit and isn't connected to wifi but WhatsApp is working.
How can this be!? Anyone?