Hacker News new | ask | show | jobs
by baby 1688 days ago
How is this a violation of privacy… that’s not how e2e encryption works.
2 comments

e2e encryption does nothing about ensuring deletion. Whatsapp can simply re-deliver the same encrypted blob.
That’s called a replay attack and is absolutely something e2e encryption protects against
There are actually three different things: replays, reloading a message, and delayed messages. Replays are impossible in the signal protocol, so that’s not what happened. Delayed messages is part of signal: you can receive message2 before message1. Reloaded message is probably what happened, it doesnt work at the signal level since “deleting a message” is not something signal specifies.
e2e encryption means the party in the middle does not have the key to the data. It is somewhat of a misnomer since it is a feature of key-agreement more than a feature of encryption.

Any other features are dependent on the protocol that uses the secret key. You will generally see an encryption method that is protected against cipher-text manipulation, but e2e does not guarantee that. Similarly, a protocol that uses e2e encryption can add replay protections, but it is not at all a feature inherent in e2e.

I could well imagine that whatsapp has some replay protection build in. I could similarly imagine they have a way to override that in case they need to. Heck, perhaps the replay protection is implemented with WhatsApp as the ultimate arbiter of what counts as a replay. As long as WhatsApp does not know the key used to encrypt my messages, the encryption is e2e in my book.

Whatsapp also shows certain messages as "forwarded many times".
That is done on the client side. Basically, you have a `ForwardCount` and if it is > 5, it shows that message. Not need for breaking E2E here.