folex

So the main problem is that the only way to make something secure is to introduce authentication factors, e.g. passphrase or biometrics

That's what I understood too. AFAIK, they only could 'break' contact, and not control the actual public identity key, so no way to read user messages.

> to one under their control

I wasn't able to find proof for attacker's ability to provide pregenerated key, can you please provide link with/or quote? I also wasn't able to find description of WhatsApp key changing procedure, and intuitively it would be more than strange not to require new identity key be signed with previous one.

So the main problem is that on _identity_ key change, the new one isn't required to be signed with previous identity key? If so, that's plain stupid, isn't it?

I didn't quite grasp why attacking entity (e.g. government) has the ability to read messages. What does "WhatsApp has the ability to force the generation of new encryption keys for offline users" mean? Does it mean that WhatsApp backend has the ability to force sender to use pregenerated compromised key provided by attacker? In terms of WhatsApp security whitepaper, does that mean that attacker can force sender to use newly generated (by attacker) S_recipient, O_recipient and the main one, I_recipient? I'm asking because "force the generation of new _encryption_ keys" doesn't really specify who would generate keys, or what about identity key that signs everything.