Conversation

Wow that is really bad. "If you're using a custom ROM or rooted phone, your [WhatsApp] messages won't be protected with end-to-end encryption."

Quote Tweet

Kilian

@kiliankoe

Aug 11, 2019

PSA: Using WhatsApp on a rooted Android device or running a custom ROM? No crypto for you. faq.whatsapp.com/en/android/260

Replying to

It's being misinterpreted. They're saying that their end-to-end encryption won't be able to protect people on alternative OSes, because they roll back many security features, break core parts of the security model and rarely ship full security updates even when available.

locked-mutex deallocator

Replying to

and

Maybe. That's probably what it means, but that's not what the words on the page say.

Replying to

and

No, not maybe. WhatsApp supports end-to-end encryption on other operating systems. This is a wording issue with their FAQ aimed at non-technical users. They aren't disabling end-to-end encryption on alternative OSes. It may be 2019, but there are still objective facts...

locked-mutex deallocator

Replying to

and

Well until their FAQ is no longer written in politician (write one thing and "mean" the opposite), that's not a sure fact. And I'd audit the code but it's closed source. Signal is better.

Replying to

and

Please stop spreading misinformation. The source code being unavailable does not mean that the code cannot be audited. It is also easily confirmed that this isn't the case. People spreading fake news like this need to stop. It's not okay. It's easy to make fact-based criticisms.

8:35 AM · Aug 12, 2019Twitter Web App

Replying to

and

There is plenty to criticize about WhatsApp without inventing false narratives. It isn't what the FAQ is saying, and the FAQ is not technical documentation. That answer is poorly worded, but it's not hard to understand what they mean and it's easy to verify that claim is wrong.

locked-mutex deallocator

Replying to

and

Explain "If you're using a custom ROM or rooted phone, your messages won't be protected with end-to-end encryption." This is misleading at best and needs to be rewritten. And yes it is possible to audit closed source software but it's far more work.

locked-mutex deallocator

Replying to

and

The reason I was saying I wouldn't audit the source to quickly confirm this claim is because I'd have to decompile the app and do a bunch of pointless busywork, all to prove something for an app I'd never use.

Show replies