Conversation

Wow that is really bad. "If you're using a custom ROM or rooted phone, your [WhatsApp] messages won't be protected with end-to-end encryption."

Quote Tweet

Kilian

@kiliankoe

Aug 11, 2019

PSA: Using WhatsApp on a rooted Android device or running a custom ROM? No crypto for you. faq.whatsapp.com/en/android/260

Replying to

It's being misinterpreted. They're saying that their end-to-end encryption won't be able to protect people on alternative OSes, because they roll back many security features, break core parts of the security model and rarely ship full security updates even when available.

locked-mutex deallocator

Replying to

and

Maybe. That's probably what it means, but that's not what the words on the page say.

Replying to

and

No, not maybe. WhatsApp supports end-to-end encryption on other operating systems. This is a wording issue with their FAQ aimed at non-technical users. They aren't disabling end-to-end encryption on alternative OSes. It may be 2019, but there are still objective facts...

locked-mutex deallocator

Replying to

and

Well until their FAQ is no longer written in politician (write one thing and "mean" the opposite), that's not a sure fact. And I'd audit the code but it's closed source. Signal is better.

Replying to

and

Please stop spreading misinformation. The source code being unavailable does not mean that the code cannot be audited. It is also easily confirmed that this isn't the case. People spreading fake news like this need to stop. It's not okay. It's easy to make fact-based criticisms.

locked-mutex deallocator

Replying to

and

Explain "If you're using a custom ROM or rooted phone, your messages won't be protected with end-to-end encryption." This is misleading at best and needs to be rewritten. And yes it is possible to audit closed source software but it's far more work.

Replying to

and

It's a poorly worded attempt to say that an insecure endpoint can compromise the end-to-end encryption. They're generalizing devices running a stock OS as secure and those with app-accessible root or a 'custom ROM' (which has connotations beyond 'alternative OS') as insecure.

8:44 AM · Aug 12, 2019Twitter Web App

Replying to

and

It's not correct, and it's misleading, but they aren't trying to say that they disable end-to-end encryption on these operating systems. It's easily verified that interpretation is wrong. It just needs to be retracted and turned into a complaint about their FAQ being misleading.