WhatsApp adds end-to-end encryption using TextSecure
Security boost initially available on Android app, with an iOS version coming soon
WhatsApp adds end-to-end encryption using TextSecure | Technology | The Guardian
More than 600 million WhatsApp users are about to benefit from default end-to-end encryption, which should prevent any snoops spying on their communications.
The security boost comes after the Facebook-owned messaging provider contracted Open Whisper Systems, the creator of the TextSecure encrypted text app, to incorporate its technology into WhatsApp.
The new feature is currently only available in the Android version of WhatsApp, but Open Whisper Systems co-founder Moxie Marlinspike confirmed to the Guardian an iOS alternative was in the works. There will soon be support for encrypted messaging for group chat and media messages, too.
Systems that use end-to-end encryption are hard to break because the key that unscrambles communicationsis only stored on users’ phones. In previous versions of WhatsApp, those keys were also stored by servers as well as users’ phones, giving Facebook or WhatsApp admins access to messages.
The TextSecure encryption protocol is particularly strong as it uses a form of what’s known as “forward secrecy”, which means a fresh key is created for every message sent.
In a blog post, the Open Whisper Systems team said the WhatsApp project “represents the largest deployment of end-to-end encrypted communication in history”.
The only other comparable service deployed on such a massive scale is Apple’s iMessage, which has one notable weakness, in that many people back up messages to Apple’s iCloud service, where data isn’t protected as efficiently.
Though it has just created a rival, Open Whisper Systems will continues to work on its own products, which include RedPhone for Android for encrypted voice communications and the iOS Signal apps that do protected calls and messaging.
WhatsApp adds end-to-end encryption using TextSecure | Technology | The Guardian
Marlinspike and his colleagues want to make encryption the default on all devices. “We’re more excited about our own apps than ever. We’ll continue to use TextSecure as a place to advance the state of the art, and hopefully incorporate those gains into third-party products as they progress, like we’ve done here,” he said.
WhatsApp’s new encryption feature may not tempt some users away from apps such as TextSecure and Signal to Facebook, especially if they are concerned about the metadata from their messages – who contacted whom, and when.
When Facebook bought WhatsApp for $19bn earlier this year, co-founder Jan Koum sought to allay privacy concerns, by pointing out that he grew up in in the USSR during the 1980s, where surveillance was rife, and promised to make technology that would keep out spies.
Marlinspike declined to answer questions surrounding WhatsApp’s use of metadata, and whether TextSecure was more secure as it wouldn’t share such information, only adding: “Yes, TextSecure will always be an app that is focused first and foremost on simple-to-use private communication.”
Handing such strong encryption to hundreds of millions of users will likely irk law enforcement bodies, who have suggested encryption efforts from the likes of Apple and Google will only benefit terrorists and other serious criminals.
“They [criminals] already have their own encryption tools, they’re just hard to use,” Marlinspike added. “People engaging in those kinds of activities are willing to put up with a cumbersome user experience, but regular people aren’t. Large-scale surveillance hurts us most of all.”
