Adding End-To-End Encryption To WhatsApp Is Great…But Not Quite As Secure As People May Think

from the human-error-is-the-intelligence-agency's-friend dept

Techdirt has just written about WhatsApp finishing the roll-out of end-to-end encryption to its billion users worldwide, including for group chats. That’s obviously pretty big news. As the Whatsapp blog post announcing the move notes:

Encryption is one of the most important tools governments, companies, and individuals have to promote safety and security in the new digital age. Recently there has been a lot of discussion about encrypted services and the work of law enforcement. While we recognize the important work of law enforcement in keeping people safe, efforts to weaken encryption risk exposing people’s information to abuse from cybercriminals, hackers, and rogue states.

While WhatsApp is among the few communication platforms to build full end-to-end encryption that is on by default for everything you do, we expect that it will ultimately represent the future of personal communication.

That’s likely, even with governments around the world muttering vague threats to weaken or backdoor crypto. And equally, there are bound to be plenty who will decry this latest move as “helping the terrorists” or “creating a safe space”, with all the hand-wringing and emotional blackmail that accompanies such pronouncements. But an article in the German news magazine Der Spiegel does a great job in explaining that even with strong, end-to-end crypto, WhatsApp conversations aren’t as secure as they might seem (Google Translate of original German).

Der Spiegel notes that end-to-end encryption is only available if all the participants in a conversation are using the latest version of the software. If one of them isn’t, group chats will be unencrypted. That lack of consistency will make it very easy to communicate in the mistaken belief that everything is hidden, when in fact it is taking place out in the open.

That problem is unlikely to affect many chats, but the second issue raised by the German article most certainly will. Der Spiegel points out that even with strong, end-to-end encryption in place, the accompanying metadata is still leaking important information about who you are communicating with, and when. Aggregating such metadata provides hugely valuable information about your network of acquaintances, and the patterns of your life.

Indeed, message metadata is arguably even more revealing than the content, because it already comes with computer-readable tags like sender, recipient, time, etc. It also scales: with a powerful enough computer you can work out the social interrelationships of thousands or even millions of people. That’s simply not possible looking at the content of messages, which needs to be parsed first — still a difficult task for machines — before it is analyzed en masse, also hard.

Der Spiegel reminds us that even though it is based on the open Signal Protocol, WhatsApp’s new encryption features are not open source. There is no way to know whether WhatsApp’s parent company, Facebook, has added backdoors — or might be forced to add them at a later date. Strong crypto doesn’t provide much protection if it has been subtly and invisibly compromised.

The article also notes that end-to-end encryption does not protect you from malware that is capturing your keystrokes and sending them over the Internet, or from slips like accidentally storing a screenshot of sensitive chats. Similarly, your super-secure chat may not actually be with the person you think it is: perhaps a smartphone was stolen, or was left unattended for a while. Group chats increase the risk that there are unwanted participants listening in to supposedly secret conversations.

Individually, those points may not be huge risks. But collectively, they mean that using strong, end-to-end encryption is not a magic formula that guarantees perfect online privacy for its users. As a result, they underline once more why the increasing deployment of encryption is a boon, not a bane — something governments should welcome for the enhanced security it brings ordinary users. In particular, they should not worry that it will not make things “go dark” for intelligence services. There are so many ways encryption can — and will — go wrong, that even in the unlikely event of terrorists using it for their communications, key information will always leak out.

Follow me @glynmoody on Twitter or, and +glynmoody on Google+

Filed Under: ,
Companies: facebook, whatsapp

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Adding End-To-End Encryption To WhatsApp Is Great…But Not Quite As Secure As People May Think”

Subscribe: RSS Leave a comment
Derek Kerton (profile) says:



To put words to it, chat data and meta data are the difference between unstructured data and structured data.

Structured data is data that is consistently structured, bu design, to carry specific significance. Think of a table with headings like: time, name, destination ID, caller ID, length of call.

Unstructured data is just a jumble of information that is captured, but is inconsistent in what it contains, has varied lengths, comes in many languages.

It’s a bit like comparing a box of all the photos of your life (unstructured) with a perfectly labeled photo album, four pictures per page, in chronological order.

Even though there is far more “information” in the shoe box, the information in the album is more usable, and thus more valuable.

Anonymous Coward says:

Authorities want to hear a clear and unambiguous communication: “We are going to do $ABadThing on $ACertainDate. $CurrentSlogan!! $TheOtherCurrrentSlogan!!”

They’re not going to get it.

They’ve never been able to get it, outside of listening to the plots of five year olds.

Authorities have always had to rely on teasing useful information out of noisy side channels, such as metadata. Given the magnificent dimensions of the dataset available to work with now, all this whining about ‘going dark’ is either a)a massive deflection, or b) sheer laziness.

I vote for b).

Anonymous Coward says:

Re: Re:

Authorities have always had to rely on teasing useful information out of noisy side channels,

Prior to the widespread use of computers, authorities had to rely on personal contacts with the citizens, mainly in the form of local police and local bureaucrats. Centralising police and bureaucracy removes this personal contact, and increases the demand to be able to force themselves into all conversations.

Rich Kulawiec (profile) says:

This is not encryption

Der Spiegel reminds us that even though it is based on the open Signal Protocol, WhatsApp’s new encryption features are not open source.

This isn’t encryption. This is the pretense of encryption. As we have seen (and are seeing) (and will see again), even if the encryption algorithms in play are sound, implementations of those algorithms in code are fiendishly difficult even for highly-skilled and experienced people. Bugs, including serious bugs, are often announced years later — and I use the word “announce” because of course it’s entirely possible they were found and NOT announced considerably earlier.

Encryption code that hasn’t been subjected to independent, open peer review is snake-oil, no better.

Cindy (user link) says:

WhatsApps end2end encryption how it work

It’s interesting to see how the media going gaga over this news as if WhatsApp has just released a new cool feature. For a company with this size, it should have been done a long time ago. Anyway, I asked a security researcher / mobile threat intelligence manager from Avast security company to write an article about this “hot” stuff. In the article, he also explains how end-to-end encryption works in WhatsApp.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...