7
$\begingroup$

WhatsApp offers end-to-end encryption. However, when I start using it on a second device such as a PC running Windows, I can decrypt incoming messages without providing any private key into my second device or application.

When a party sends a message to my account which has two clients receiving the incoming message, on PC and mobile device, they receive the same message perfectly.

If my private key is generated by my first device and stored on my first device, how is the private key being passed to my second device without any security flaw?

$\endgroup$
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$ – e-sushi Feb 7 '18 at 5:19
  • $\begingroup$ LINE has provided their technical whitepaper that described how message end-to-end encryption (a.k.a. Letter Sealing) was done. $\endgroup$ – user12183 Feb 7 '18 at 10:54
11
$\begingroup$

If by "using them on a second device such as a PC running Windows" you mean that you open Whatsapp web there, then no you cannot decrypt your messages there.

Whatsapp web is a client that connects to your phone (usually using whatsapp servers as proxy).

The client has shared keys with the phone (you scanned them as QR code) and the phone uses this to encrypt the already (on the phone) decrypted messages.

+----------------------------------+                     +----------------------------------------+
|                                  |                     |                                        |
|                                  +--------------------->                                        |
|    Whatsapp Web Client           |     encrypted       |         Whatsapp Servers               |
|                                  <---------------------+                                        |
|     shared key with phone        |                     |                                        |
+----------------------------------+                     +---+---------------------^--------------+
                                                             |                     |
                                                             |                     |
                                                             |                     |
                                                             |                     |
+-----------------------------------+                        |                     |
|         encryption secret keys    |                        |                     |
|                                   <------------------------+                     |
|                                   |                                              |
|      Your phone                   |         encrypted                            |
|                                   |                                              |
|      shared key with web client   +----------------------------------------------+
+-----------------------------------+

Basically the Web client is just a GUI for your phone client, connected (securely) over the web.

You can try the following: Turn off your phone while using whatsapp web. You will see, that you cannot send and receive messages anymore.

$\endgroup$
  • $\begingroup$ please share source of this descciption $\endgroup$ – khan Feb 6 '18 at 10:07
  • $\begingroup$ I am running a program from whatsapp on my PC which can be downloaded from here whatsapp.com/download $\endgroup$ – Ook Feb 6 '18 at 10:07
  • $\begingroup$ @RI8S I just wrote it. Source is my brain. You can look basically anywhere if you don't trust me. e.g. Wikipedia $\endgroup$ – Josef Feb 6 '18 at 10:10
  • 4
    $\begingroup$ @Ook No, it's not only TLS and messages are end-to-end encrypted from phone to client. At least this was the case last time I quickly looked at that (mid 2017). Of course, Whatsapp is closed-source. There could be anything in there and even if it isn't, they can push an update to the play store tomorrow which mails all your keys to the NSA... $\endgroup$ – Josef Feb 6 '18 at 10:26
  • 2
    $\begingroup$ The key factors here being that a. the messages are re-encrypted, and that b. the Web GUI doesn't really count as one of the "ends" (but even if it did you'd still be fine because of a) $\endgroup$ – Lightness Races with Monica Feb 6 '18 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.