End-to-end encryption is the best possible safeguard against Meta snooping on your data.
This has always been my biggest pet peeve with WhatsApp. Yes, they might encrypt it all and the encryption might be practically unbreakable, but what worries me is what Meta might do with the private encryption keys. Lem me elaborate further.
I’ll start by trying to explain how key-based encryption, the type of encryption WhatsApp uses, work at their core, for those who don’t know (THIS IS GOING TO BE AN OVERSIMPLIFICATION). Imagine you want a friend to send you a message with super sensitive contents. Here’s what you do to guarantee that no one else can read it but you:
First, you generate two keys, which are pretty much two really big numbers. One will be called the public key and the other one will be the private key.
Then, you go to the person who wants to send you stuff and say “Hey John, remember that really important message you wanted to send me? Take my public key and make sure you cypher your message using it”.
Once you receive the message, you decypher it using the private key. Using the private key is the only way you can read this message. You can’t use the public key for it because it won’t work.
This means that, if someone else manages to get the encrypted message, they will need the private key to read what it says, but they don’t have it, only you have it. The only thing they can do keep guessing what that key is until they find what it was and read the message, but that can take up to millions of years, even using supercomputers.
As you can see, this works really well for sending messages without anyone but the sender and the reciever knowing what is being said, and that’s why it’s so used in encrypted message apps…
…but what if Meta has access to the private keys? I mean, what if, after WhatsApp creating the public and private keys for messaging, the private key is retrieved and stored in Meta’s servers, making them able to read all the messages you receive?
Can someone with more experience in the subject say if my concerns are valid?
This has always been my biggest pet peeve with WhatsApp. Yes, they might encrypt it all and the encryption might be practically unbreakable, but what worries me is what Meta might do with the private encryption keys. Lem me elaborate further.
I’ll start by trying to explain how key-based encryption, the type of encryption WhatsApp uses, work at their core, for those who don’t know (THIS IS GOING TO BE AN OVERSIMPLIFICATION). Imagine you want a friend to send you a message with super sensitive contents. Here’s what you do to guarantee that no one else can read it but you:
This means that, if someone else manages to get the encrypted message, they will need the private key to read what it says, but they don’t have it, only you have it. The only thing they can do keep guessing what that key is until they find what it was and read the message, but that can take up to millions of years, even using supercomputers.
As you can see, this works really well for sending messages without anyone but the sender and the reciever knowing what is being said, and that’s why it’s so used in encrypted message apps…
…but what if Meta has access to the private keys? I mean, what if, after WhatsApp creating the public and private keys for messaging, the private key is retrieved and stored in Meta’s servers, making them able to read all the messages you receive?
Can someone with more experience in the subject say if my concerns are valid?