WhatsApp now offers end-to-end encrypted communications

[ahhming]

WhatsApp is announcing that they have completed development on end-to-end communication technology. The end-to-end encryption will only work with the latest version of the WhatsApp app, but in the meantime users will be able to see which messages are encrypted or not. 

 

Quote

This means that if any group of people uses the latest version of WhatsApp—whether that group spans two people or ten—the service will encrypt all messages, phones calls, photos, and videos moving among them. And that's true on any phone that runs the app, from iPhones to Android phones to Windows phones to old school Nokia flip phones.

This move comes after the recent FBI and Apple fight over encryption, in which the FBI attempted to compel Apple to disable a security feature in iOS by creating a special version of the operating system and loading to a suspect's phone. 

 

Quote

Every call made and every message, photo, video, file, and voice message sent will now be protected. Only the person who can read it will be able to see it, and cybercriminals, hackers, governments, and not even WhatsApp will be able to read the messages for themselves.

 

 

Source:

http://www.androidcentral.com/whatsapp-turns-end-end-encryptions-over-1-billion-people

 

http://www.winbeta.org/news/whatsapp-spites-fbi-implements-end-end-encryption

[Aytex]

I don't undersatnd all this panic all of a sudden, its not like the American government Hasn't  spied us illegally...

[Cryosec]

yeah I still don't trust whatsapp

[minibois]

8 minutes ago, Aytex said:

I don't undersatnd all this panic all of a sudden, its not like the American government Hasn't  spied us illegally...

>illegally
 

that's because they make the rules and decide what is legal and illegal.. And why would they tell you if they did do it illegally?

[Aytex]

3 minutes ago, Minibois said:

>illegally
 

that's because they make the rules and decide what is legal and illegal.. And why would they tell you if they did do it illegally?

They don't but i think its obvious they do

[Admiral Naismith]

This thread has already started going off the rails...

 

Glad to see encryption taking more of a center stage. Hopefully this trend continues for the long term.

[Nup]

Glad to see that whatsapp isn't wasting any time on the encryption band wagon. Good trend

 

Also; ayyyy, ahhming! 

[Murdoch]

So what's their business model?

 

So they've enabled End to End encryption and the pertinent "Only the person who can read it will be able to see it, and cybercriminals, hackers, governments, and not even WhatsApp will be able to read the messages for themselves."

 

They removed the annual small fee for usage with the same number after a year.

 

They don't serve ads.

 

I know they've mentioned that businesses will be able to have some services on WhatsApp eventually, yet Facebook paid $19 Billion (albeit mostly shares) for them or something equally ridiculous.

 

I'd love to know how they think it was worth that much, and how they'll monetize it to any sort of level that would recoup the price they paid. Perhaps it was purely about market share.

 

 

[Doobeedoo]

Good to see encryption being used for such.

 

Now, option to make sent images to auto delete in few seconds, would appreciate :3

[LAwLz]

1 hour ago, Murdoch said:

So what's their business model?

 

So they've enabled End to End encryption and the pertinent "Only the person who can read it will be able to see it, and cybercriminals, hackers, governments, and not even WhatsApp will be able to read the messages for themselves."

 

They removed the annual small fee for usage with the same number after a year.

 

They don't serve ads.

 

I know they've mentioned that businesses will be able to have some services on WhatsApp eventually, yet Facebook paid $19 Billion (albeit mostly shares) for them or something equally ridiculous.

 

I'd love to know how they think it was worth that much, and how they'll monetize it to any sort of level that would recoup the price they paid. Perhaps it was purely about market share.

That's what I was thinking too. I wouldn't be surprised if Facebook bought them just for marketshare reasons. Better to "kill" competitors (or in this case, buy them) than to possibly fade into obscurity as your rivals becomes bigger and more powerful.

They might also just be interested in the meta data. Even if Facebook don't know what you are talking about, the mere fact that you are talking to some specific friend, at a specific location and at a specific time can be enough to determine what ads might be interesting to you.

[suicidalfranco]

2 hours ago, Murdoch said:

So what's their business model?

 

So they've enabled End to End encryption and the pertinent "Only the person who can read it will be able to see it, and cybercriminals, hackers, governments, and not even WhatsApp will be able to read the messages for themselves."

 

They removed the annual small fee for usage with the same number after a year.

 

They don't serve ads.

 

I know they've mentioned that businesses will be able to have some services on WhatsApp eventually, yet Facebook paid $19 Billion (albeit mostly shares) for them or something equally ridiculous.

 

I'd love to know how they think it was worth that much, and how they'll monetize it to any sort of level that would recoup the price they paid. Perhaps it was purely about market share.

 

 

i think their business model now is to have a paid service to businesses 

[MrDynamicMan]

The the reason that this is happening is because it would be much more difficult for Facebook to trawl out a theme from a massive group chat for marketing, because instead of $user visiting $topics in $genre it's a wall of text. 

 

Guess they decided it would be easier to enable end to end and gain rep from that, than try to find marketable themes from whatsapp chats. 

[Ren]

On ‎4‎/‎6‎/‎2016 at 2:30 AM, MrDynamicMan said:

Guess they decided it would be easier to enable end to end and gain rep from that, than try to find marketable themes from whatsapp chats. 

Actually it's a falsified publicity stunt to keep their international market alive with all the concern about NSA or other government agencies. Don't think it's about positive reputation as much as reducing very negative reputation. WhatsApp was found to be used in a lot of criminal incidents and has a huge eastern audience, so it stands to reason that intelligence agencies will follow them.

 

What nobody is talking about is that it's **only** end-to-end encryption, meaning your phone and the recieving one will be the only things decrypting keys, but as it passes through WhatsApp possession, they have the capability of revoking and replacing an encryption key with another. This means WhatsApp can both 'solve' the encryption and decode messages, and know where they are going by sourcing the second, replacement key. All it takes is a government subpoena or whatever and their encryption is completely thwarted.

 

 

There was a recent case of this happening somewhere but I don't remember what it was for. The reason this exists is because WhatsApp was told what they can and cannot do, and the company involved in the encryption method could not make it work properly with full encryption, WhatsApp ends up opting for the quicker and easier method entirely.

[Ren]

Another thing is hardware microcode* box encryption environments for Skylake+ arch Intel processors. This is the same exact level of shit as Apple's San Bernardino iPhone case, except Intel can submit keys to anyone without the user ever possibly finding out. This also means your hardware can be hijacked from the deepest level if your entry key is ever grabbed, and cannot be "removed" since it is encrypting the processes themselves. Think about how dangerous that will be if compromised for a second. It cannot/should not be used in business or corporate environments.

 

 

IIRC it looks like this kind of: Data source >Entry key> [Encrypted "box" environment] >Exit key> <Entry Key< >Exit Key> Destination.

 

This means that once malware or anything like that is inside the box, they control where the information can go entirely.

 

*This is done on the absolute deepest level possible (which I don't know if microcode is the right term for) so it can't be completely removed. Haswell cannot have this technology but every architecture after Skylake will have it AFAIK unless Intel makes something completely new. So it doesn't even matter if you use encrypted services, your Intel hardware is already capable of telling the whole story (and more).

 

 

Originally this was only on Core i7+ if I recall, but a forced update about 2 months ago added it to everything down to Celerons and Atoms based on Skylake i7. Intel can disable the "service" of it, but it can be reinitiated so it's actually infinitely safer to always be enabled even if Intel *could* let gov't in or you could be hijacked without any control over what the malware does. This is why the update was released, not sure if it's good bad news or extremely bad news.

[NateGSR117]

That great, but what is their motive for doing this? Are they just trying to hop on the band wagon for encryption before the competition get a fighting chance for them sweet, sweet market shares?

[Ren]

3 minutes ago, NateGSR117 said:

That great, but what is their motive for doing this? Are they just trying to hop on the band wagon for encryption before the competition get a fighting chance for them sweet, sweet market shares?

Posted above for you guys. It's because WhatsApp's largest audience is outside of the U.S. and/or Europe, but the top agencies involved in surveillance are from these countries and have shown interest in monitoring foreign citizens through companies that operate in these regions. It's for public relations and doesn't really assist the majority of users with meaningful privacy; Joe Schmoe was never going to get your shit anyway. It's the talented that would, and still can get any of that info. Foreigners are concerned over aggressive U.S. spying for example, and this is a statement that's supposed to appeal to them. In reality, it's much worse than the iPhone situation (imo anyway. At the very least it's just as bad, but it should be easier to crack).

[NateGSR117]

Just now, Ren said:

Posted above for you guys. It's because WhatsApp's largest audience is outside of the U.S. and/or Europe, but the top agencies involved in surveillance are from these countries and have shown interest in monitoring foreign citizens through companies that operate in these regions.

thanks for shortening it for me, I'm just not willing to read that wall of text right now. I'll probably read it later once I have nothing else better to do.

[Ren]

Just now, NateGSR117 said:

thanks for shortening it for me, I'm just not willing to read that wall of text right now. I'll probably read it later once I have nothing else better to do.

No worries. It's mostly explaining why/how in closer to layman's terms. I'm not 100% positive I can explain it better/more technically so it might not even be worth reading that wall of text, lol.

[Murdoch]

On 06/04/2016 at 1:47 AM, suicidalfranco said:

i think their business model now is to have a paid service to businesses 

 

Yeah, I think I was being a little unimaginative about the potential for monetizing that sort of thing.

 

It is possible that Whatsapp could be used to replace a lot of traditional call centre type services, companies would be willing to pay a lot for that, cause hosting some of those services on Whatsapp would certainly reduce costs. There is potential to develop a distributed system for cheap call operators too. An Uber for "customer service" if you like.

 

But yeah it seems like the "Business to Customer" revenue model is what they are going for, yet they're still adamant that doesn't mean advertising. So hopefully we don't see Businesses on Whatsapp spamming us with adverts any time soon.

[qwertywarrior]

i wonder why they didnt use zrtp

[LAwLz]

These are fantastic news. Not just are they enabling good end-to-end encryption, but they are also really detailed about how it is implemented, and they worked with Open Wisper Systems to implement it. Looking through it right now and it looks great. They even implemented a feature where you can meet up in person and verify the public key of the one you are talking with (only needs to be done once).

 

 

There is one thing I don't get though. Doesn't Whatsapp allow you to look at your old messages? If I install Whatsapp on both my tablet and cellphone, how will I be able to see the messages I sent/received on my phone when I am on my tablet? Will all messages be lost if I for example factory reset my phone?

[Misanthrope]

On 4/5/2016 at 1:40 PM, Aytex said:

I don't undersatnd all this panic all of a sudden, its not like the American government Hasn't  spied us illegally...

"I don't understand why people lock their front doors everyone knows a thief can pick the lock, henceforth I leave mine wide open! "

[Murdoch]

2 minutes ago, Misanthrope said:

"I don't understand why people lock their front doors everyone knows a thief can pick the lock, henceforth I leave mine wide open! "

 

This is why I appreciate companies using technical solutions to prevent "snooping". Instead of having all the keys to open all the doors, they've just locked them all and given the user the key, and said it's up to you who you want to let in.

 

It even hands the apathy back into the Public's hands too, if nobody really cares, then bury your head in the sand when your Government starts to pass Draconian legislation, requiring access, or banning certain encryption. But that's a decision between the Public and their government, not us.

 

[suicidalfranco]

1 hour ago, LAwLz said:

There is one thing I don't get though. Doesn't Whatsapp allow you to look at your old messages? If I install Whatsapp on both my tablet and cellphone, how will I be able to see the messages I sent/received on my phone when I am on my tablet? Will all messages be lost if I for example factory reset my phone?

you can only have WA open on one device at a time (plus a web browser), old messages live only on the device where you use WA and are backed up on iCloud and Drive 

[LAwLz]

1 hour ago, suicidalfranco said:

you can only have WA open on one device at a time (plus a web browser), old messages live only on the device where you use WA and are backed up on iCloud and Drive 

I see. So the backups of messages are handled by iCloud and Google Drive, not WhatsApp. I assume that the messages are not encrypted when they get sent to those servers either.