I was asking because I have a notification today in one of my chats saying that e2ee was enabled. I didn't see the same notification in any group chats. Outside of that notification, it's not clear to me when things are encrypted.

Maybe the next step is a more obvious indicator.

I just checked this with a group chat I'm in, and it said that it was not yet enabled because one person has not yet updated.

After a few weeks, non-updating users will get a stern warning that Whatsapp will stop working until they update. Whatsapp does this with every version. They expire every few months.

Doesn't everyone in the chat have to have the new version of the app before it's all e2e?

I guess? Hence the indicator. It would be nice to know if someone switched phones and e2ee turned off, for example.

> Once a client recognizes a contact as being fully e2e capable, it will not permit transmitting plaintext to that contact

They do this to prevent degradation attacks.

Once your number had e2e support0, you can't switch to a phone without e2e. Notifications on key changes are switched off by default, but I hope they still warn you in the chat history. We'll see.

It doesn't seem to say anything about the Web client, though.

no proof without open source

The open-source alternative is the Signal app made by Whisper Systems, the same people helping with WhatsApp from TFA, available for Android and iOS: https://whispersystems.org/

Don't know what kind of funding they've been having, but for an open-source app, it's pretty polished.

Matrix uses the Signal protocol for encryption as well, if you want a fully free implementation of the same tech.

https://matrix.org/git/olm/

thanks! could i use it to connect to WhatsApp?

WhatsApp uses a proprietary (fork of XMPP) messaging protocol and does not interoperate with anyone else (intentionally), like Hangouts and Skype, and unlike Matrix which is federated, and has gateways for IRC and XMPP already available.

You could inspect the packets yourself to see that they are encrypted.

skype is encrypted too, and backdoored. don't forget whatsapp is owned by facebook.

how do i know they aren't sending the chat log in a side channel, encrypted?

It's worse to use an encrypted but potentially compromised channel than a plain text one only when you assume the encryption is not in fact compromised, which you shouldn't do.

So I fail to see the problem. It still likely protects you from nosy neighbors or nasty non tech savvy competitors, even if it doesn't protect you from state level actors or from Facebook itself.

The above, in addition to the fact that open source is neither required for auditing, nor guarantees proper auditing occurring (see OpenSSL having vulnerabilities for years before anybody released them to the public)