alt Hacker NewsSorry to be "that guy", because I don't know the details of how WhatsApp does E2EE, but in any proper (as in secure and private) implementation the only thing that should matter is whether the client follows the spec? You might as well ask, how does $browser work with HTTPS?
Replies
The only thing that matter is whether you trust the app or not.
- If it is proprietary, you just have to blindly trust it (as is the case with WhatsApp currently: they say it is end-to-end encrypted, but you can't verify).
- If it is open source, then some people will want to understand how it works before they trust it. Other will either blindly trust (like for proprietary software) or trust that persons they trust understood how it works and were convinced.
> You might as well ask, how does $browser work with HTTPS?
Well, exactly. I am interested in how the WhatsApp interop works just as I am interested in how HTTPS works.
I think the suspicion is based on this app being offered in a region whose government is hostile to privacy and this implementation being connected with the strong nativist bent in Europe.
The "spec" is not relevant in any way because we have no idea what else is going on. Why was it relevant that these operators must specifically be in the EU? Everyone is just complying with the global spec...but the app provider must be in Europe...okay.
That's not what OP is asking, he's asking how do you have two separate e2e encrypted apps that can interact.
I can confirm that you don't know.
I can count 3 mistakes here:
1- The client isn't the only thing that matters (There's servers)
2- The client doesn't follow a spec in WhatsApp, there is no spec as it's a private non-interoperable system.
3- Browsers and HTTPS work with an entirely different encryption model, TLS is asymmetric, certificate based and domain based. TLS may be used in Whatsapp to some extent, but it's not the main encryption tool.
Well, yes. But one could think of a world in which WhatsApp has its own internal protocol and to bolt on third-party support they just decide to represent third party clients as “virtual clients” on the server side, which would be the easiest way to make it work while not having E2EE support. Especially since the feature only exists for legal compliance purposes.
(This is not the case, apparently.)