Hacker News Reader

My question is, how can this be verified?

They have released a whitepaper [1] where they go into details of how the encryption works, so using this knowledge in theory one should be able to verify that the encryption is legitimate.

[1] https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...

Nice! Thank you

Watch the traffic go by with a packet sniffer? Verifying that it is done securely is a lot harder, but you can at least verify that things are not being sent as plain text/data.

Yeah but that just shows its https.

Can't you MITM yourself fairly easily to decrypt the https and see what's being passed? Assuming you have full control of your device.

Watching traffic is irrelevant, the encryption of the transport (WhatsUp always used TLS for that) is not in question here, this is about end to end encryption and if WhatsUp can either decrypt the data for users or switch them off E2EE at any point without it being noticeable to either end.

Reply on news.ycombinator.com