How safe is WhatsApp? How is the end-to-end encryption implemented?

The most popular messaging app worldwide is WhatsApp, easily exceeding competitors like Messenger, Signal, and Telegram. Is the app safe to use given how much personal information we frequently share in online conversations? Moreover, even with the encryption WhatsApp claims to provide, should you be concerned about potential attacks or data leaks?

Let’s examine WhatsApp’s security features, including end-to-end encryption, in more detail and attempt to provide some answers to those questions in this post. Later on, we’ll also go through some other tools you can use to protect your chats from prying eyes.

What is end-to-end encryption for WhatsApp?

Although instant messaging has been since the beginning of the internet, early versions were not at all secure. They exchanged plain text communications between users, to start. This implied that anyone with access to the company’s servers, including any intermediaries or nefarious characters later on, may read your conversations. The corporations that provided the services typically kept the keys to decode user communications on their end, even though many of those services introduced encryption-in-transit in the late 2000s.

However, end-to-end encryption (E2EE) has lately been embraced by numerous platforms in order to enhance message secrecy and user privacy. Only the sender and receiver are in possession of the keys required to decrypt one another’s messages in an end-to-end encrypted communication channel. Nobody else can see your messages, not even the platform, your Internet service provider, or a hacker with access to the encrypted data.

The open-source Signal protocol from Open Whisper Systems has been a component of WhatsApp’s end-to-end encryption technology since 2014. You may be familiar with the business as the creators of the communication application Signal, a rival to WhatsApp that takes pleasure in prioritising security and privacy.

The documentation for WhatsApp states that almost all of your conversation on the service is protected by end-to-end encryption. This includes calls, voicemails, media, status updates, and texts.

How does the encryption in WhatsApp operate?

Public-key encryption is the first cryptographic method included in WhatsApp’s Signal encryption technology. Simply said, it entails having two randomly generated keys, one of which each user keeps private and the other of which is made available to the public.

Here, communications are encrypted using the recipient’s public key by the sender. The recipient uses their private key to decrypt it on the other end. WhatsApp never has access to the private key because it is generated by your device. This straightforward cryptographic method has been in use for years, and updated versions are now used to secure anything from emails to cryptocurrency wallets.

Standard public-key encryption, however, is insufficient on its own. It has a single weak point, which causes problems. Your past, current, and future chats could all be uncheckedly decrypted if your secret key is ever stolen. The designers of the Signal protocol came up with an innovative method called double ratchet encryption to fix this.

The protocol makes use of a combination of permanent and temporary keys rather than assigning each user a unique static set of keys. Every time you send a new message, the latter changes. This indicates that only a small number of communications might be decrypted if a hypothetical attacker managed to discover one particular key. Although perpetual key renewal may seem like an overkill solution, it is also straightforward enough that our cellphones can manage it with ease.

The company’s technical white paper on the subject contains a lot more information about WhatsApp’s encryption technique. The key point is that the encryption is strong and reliable enough to thwart eavesdropping and other similar elementary attacks.

Is your WhatsApp conversation safe? What do experts believe?

You may use WhatsApp to check the end-to-end encryption of your individual chats and calls. To enable encryption, simply tap the “Encryption” label after selecting the contact’s name in a chat window within the app. A 60-digit number and a QR code will be displayed to you. Compare the results after repeating these steps on the recipient’s phone.

Your chat is properly end-to-end encrypted as long as the number matches on both devices. WhatsApp refers to this as a “security code,” but it’s really simply a more convenient way to show the public key we discussed earlier. By completing this step, you can increase the likelihood that your communication will reach the intended recipient and not some shady imposter posing as your contact. Additionally, it holds WhatsApp responsible since if the keys don’t match, the business would come under intense scrutiny.

However, WhatsApp isn’t ideal; outside of the chat interface, it records quite a bit of information about you. Your contact list, location, device identifiers, and purchase history are just a few of the information gathered. Signal is the only option, though, that places an emphasis on security and makes the claim that it collects less data. Even more widely used chat programmes like Messenger and Telegram don’t come standard with end-to-end encryption.

Security experts advise WhatsApp above the majority of the competition for this reason. The data-sharing practises of the app have drawn strong criticism from the Electronic Frontier Foundation. The statement continues, “WhatsApp still uses strong end-to-end encryption, and there is no reason to doubt the security of the contents of your messages on WhatsApp.”

How does WhatsApp utilise my data when it collects it?

It is now obvious that WhatsApp does not save your chat histories, media files, or other sensitive information. What more about you does the programme know, and how is this information stored? Here are the main points of WhatsApp’s Privacy Policy in an abridged form:

• When creating a WhatsApp account, you give basic information about yourself, including your name, status, and profile image.
• WhatsApp may be able to see and gather geolocation information if you accept the location permission and utilise a feature like Live Location. Based on your internet connection and the region code of your phone number, it can also determine your general location.
• The platform can see transaction information like the receiver, shipping information, and amount if you utilise WhatsApp Payments.
• Your contact list is not stored or collected by the platform. Once it realises a contact already has a WhatsApp account, though, it does maintain a record.
• WhatsApp gathers information on usage patterns, including Last Seen, online behaviour, device kind, signal quality, and time zone.

On the surface, the majority of this data appears to be unharmful. WhatsApp is just one of numerous Meta platforms, though. So, when combined with your Facebook and Instagram pages, even simple information might go a long way towards identifying you as an individual. For instance, Meta can promote new Facebook friends based on frequent WhatsApp interactions by using their phone numbers. Even if it cannot view the substance of your messages, it is nonetheless aware that contact has occurred.

Threats via WhatsApp that you should be aware of

By this point, it should be very obvious that the information in your WhatsApp chats remains private. There are still some security risks, though, that you need to be aware of. Your chats will never be intercepted on their route to you, but once they get there, they become quite vulnerable. Or, to put it another way, your phone and the device of any recipient are far simpler targets for prospective assaults.

An attacker with physical access to your smartphone, for instance, could copy your WhatsApp message database from it if you misplace it. Thank goodness, WhatsApp encrypts this file, because on Android, obtaining the key requires root access. You probably have nothing to worry about if you have no idea what something is. However, they were still able to access media items like pictures and movies. All of this can be simply fixed with a quick smartphone screen lock.

Cloud backups to Google Drive and iCloud are another widely known possible attack vector. WhatsApp will automatically backup your communications to these services without using any encryption at all. This implies that if a hacker manages to access your cloud storage account, they might be able to access your WhatsApp data as well.

Fortunately, WhatsApp has already made it possible to encrypt backups of chats using a password or encryption key. The latter is a 64-digit key that was produced randomly. For best security, keep it in a password manager. Since this is an optional function, make sure you turn it on in the WhatsApp for Android app’s Settings > Chats > Chat backup menu.

Consider enabling two-factor authentication when talking about WhatsApp’s optional security measures. Under WhatsApp Settings > Account > Two-step verification, you may locate it. When registering your account on a new phone, you will need to enter a PIN. Although it won’t stop data leaks, it might stop nefarious actors’ bogus login attempts.