WhatsApp could exfiltrate messages at the ends. But I assume the trick lies in the word "default". Didn't Skype also default to end-to-end encryption, unless there was a server flag that disabled it for that specific user (I might be fuzzy on the details)
This is not true. The IETF draft is explicit that E2EE means that the message cannot be read by any party other than the sender and the intended receiver. When companies like Meta claim they support E2EE, this is what they claim. There are no tricky semantics or legalese at play here.
> Do you trust facebook (excuse me, meta) to not snoop on your messages
No, but I trust some nosy German guy at TU Whatever to spend hours poking at the assembly, find that hidden flag and proudly present it at 40C3.
With enough eyeballs, all source is open (and AI will give us far more eyeballs than we have any idea what to do with).
Sure, you can have different builds distributed to different people, but the NSA can also just do that with Signal, Signal being open source makes it that much easier. FDroid mitigates this somewhat, but it's not like the NSA can't get a fake TLS certificate for their domain and MITM your communications.
wongarsu|1 month ago
londons_explore|1 month ago
If you want to assure me your e2e is secure, there must be at least two clients implemented by different people, with at least one of them opensource.
Whatsapp used to have this, but lately they have cracked down on third party clients.
4gotunameagain|1 month ago
Do you trust facebook (excuse me, meta) to not snoop on your messages, and to not share them with the "intelligence" agencies ?
Fripplebubby|1 month ago
miki123211|1 month ago
No, but I trust some nosy German guy at TU Whatever to spend hours poking at the assembly, find that hidden flag and proudly present it at 40C3.
With enough eyeballs, all source is open (and AI will give us far more eyeballs than we have any idea what to do with).
Sure, you can have different builds distributed to different people, but the NSA can also just do that with Signal, Signal being open source makes it that much easier. FDroid mitigates this somewhat, but it's not like the NSA can't get a fake TLS certificate for their domain and MITM your communications.