Hacker News Reader

Comment by 0xy | Hacker News Reader

Firstly, by default WhatsApp backs up your encryption keys to the cloud making your messages totally accessible and not E2E encrypted at all.

Secondly, Telegram secret messages have been repeatedly proven to be E2E encrypted, including by independent researchers, so "Pavel can read all your messages!" is just misinformation.

As for the alternatives, well Signal is very likely compromised given their server repo is abandoned and they refuse to address why (they maintain a closed source version). Why else would an "open source project" act that way, if not gagged?

View on HN

This is NOT true. Message keys are never sent to the cloud in WhatsApp, no matter what.

You’re referring to the optional backup that requires users to opt-in. This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key (but not the data) to that. Both companies would need to cooperate to read your messages, and this is OPT-IN by default.

This isn’t E2EE, but it’s opt-in by default. It also has nothing to do with the key exchange for E2EE messages.

You’re comparing WhatsApp, with all messages end-to-end encrypted and where the only way to compromise that is an opt-in cloud backup, to Telegram, where the vast majority of people (anyone using cloud chats) do not use Telegram’s encryption.

Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.

> This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key

It is a plain text backup to Google Drive. There is no key Whatsapp holds. Google can read it all, and has revealed the chats to help the Govt in multiple high profile cases here in India.

You can extract it yourself, with the credentials of your Google account- https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre...

> You’re referring to the optional backup that requires users to opt-in.

With telegram, if you enable secret chats, it is never backed up to the cloud. It is a guarantee, unlike Whatsapp where you do not know whether your contact has enabled cloud backups

Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.

> Signal is very likely compromised given their server repo is abandoned

Signal has client-side E2E encryption.

I don't understand this argument, it's okay for an "open source project" to abandon their server repo with no explanation and if it's compromised and leaking metadata to third parties it's fine?

People are killed over metadata.

> it's okay for an "open source project" to abandon their server repo with no explanation

Show me how you can prove what they publish on github is running on Signal servers and I'll agree here. Otherwise this point is moot.

They could publish cute cat pics on the repo instead for all I care, it's the same level of trust involved.

Reply on news.ycombinator.com