Out of curiosity, how can end-to-end encryption be verified when both the clients and the servers are closed-source?

How can you know it’s not E2EE? The absence of evidence is not the evidence of absence, or something like that.

I agree that closed source is harder to verify, but that’s not the same as insecure.

If you can't verify your messages are E2EE, you have to trust the vendor. But if you trust the vendor, you don't need E2EE to begin with.

There are other threat actors than the vendor looking to compromise the confidentiality of your message.

Those actors don't have the vendor's encryption keys.

WhatsApp lets you upload your chat history to either icloud or google's cloud offerings. Those backups are accessible to Apple/Google. Many people have enabled it, so if you are in any decently sized group chat you can basically assume it's available to Apple/Google, the people who hack them, and whomever they have data sharing contracts with.

Personally I use Telegram because they don't mind non-official clients like the FOSS builds. Whatsapp on the other hand is known to ban non-official clients. API access isn't available either unless you are a big corporate user, at which point you need a facebook ads account and cooperate with some API reseller... no joke lol.

Like... Facebook can read all your messages? The encryption only protects you from entities that are not Facebook. With that out of the door, it's not really worth it to even consider other angles of attack, since you now depend on the goodwill of a billion dollar company whose sole purpose and reason for existence is to extract and monetize your data. WhatsApp is a nice chat tool, but it's nothing you should ever use for secure communication. Sending a letter via mail is more safe.

that's incorrect. WhatsApp is end to end encrypted using the signal technology as confirmed by moxie. are you suggesting Facebook tricked the signal team into believing that WhatsApp is using end to end encryption when it isn't? a source: https://signal.org/blog/there-is-no-whatsapp-backdoor/

Honest question, then: outside of things like ethical concerns about supporting Facebook, and some missing features like enabling a passphrase to open the app, why should anyone use Signal over WhatsApp? Given that WhatsApp has a better UI/UX and that the people you want to talk to are much more likely to have it, and it supports some things that Signal is known for like disappearing messages (though limited to 7 day expiry).

I love Signal and all the work Moxie and his team have put into it and the protocol, so this isn't a diss to them, but just wondering what the disadvantages would be for someone just looking for an E2EE communication app.

One difference I suppose would be that Facebook would have all the message metadata; just not the contents.

If they can, then either Facebook boldly lied about implementing end-to-end encryption[0], or found significant attack against the Signal protocol, which is considered quite safe.

They do have access to the metadata, i.e. whom you messaged and when.

--

[0] https://techcrunch.com/2016/04/05/whatsapp-completes-end-to-...

> Facebook can read all your messages?

Whatsapp still does E2E encryption. (Same as Signal) Facebook can't read your messages. (There's still the scenario of you getting a special version of the app with that functionality disabled of course) You can also enable notification for changed signatures, which I do see changing as people replace their phones.