WhatsApp's "E2E" code is from Signal, which is open source.
This zealous belief that all secure cryptography must be open source is something I hear a lot from open source advocates, but not so much from cryptography engineers.
This zealous belief that all secure cryptography must be open source is something I hear a lot from open source advocates, but not so much from cryptography engineers.
It's the exact same code we use in Signal: https://github.com/whispersystems/libsignal-protocol-java
You are better off verifying the actual compiled and distributed apk files than verifying the source.
For an example of a more sophisticated approach, look at:
Remember, in this case, it's especially easy to reverse, because you have the source code; all you're doing is matching the control flow graph to the original source.
I imagine I won't ever get to it, but that sounds like an interesting problem to try to work on.
[To whomever down voted... I guess I get down voted for not showing gratitude immediately after he posted a reply? This is why I don't post here often. Quite mean people here.]
I think it's great when people further verify WhatsApp's client security, please share your analysis!
My primary concern here is a long con. Everything is probably okay now, but after a while, people will stop looking and verifying. With WhatsApp keeping source closed, it makes that period of time shorter, I think. I will try to work your suggestion into my job :) If I'm paid to do it, I can keep doing it indefinitely, even working on tools to automate it.