<story><title>WhatsApp Just Switched on Encryption for a Billion People</title><url>http://www.wired.com/2016/04/forget-apple-vs-fbi-whatsapp-just-switched-encryption-billion-people/</url></story><parent_chain></parent_chain><comment><author>dang</author><text>&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=11431108&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=11431108&lt;/a&gt;</text></comment>
<story><title>WhatsApp Just Switched on Encryption for a Billion People</title><url>http://www.wired.com/2016/04/forget-apple-vs-fbi-whatsapp-just-switched-encryption-billion-people/</url></story><parent_chain></parent_chain><comment><author>aorth</author><text>So now WhatsApp is finally on par with iMessage and Signal, and shares the same weakness: public key distribution. Key distribution is controlled by a centralized server that could, for malicious or other reasons, send you new fake keys for people you communicate with. For iMessage, this is explained in this 2015 post by Matthew Green:&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;blog.cryptographyengineering.com&amp;#x2F;2015&amp;#x2F;09&amp;#x2F;lets-talk-about-imessage-again.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;blog.cryptographyengineering.com&amp;#x2F;2015&amp;#x2F;09&amp;#x2F;lets-talk-ab...&lt;/a&gt;&lt;p&gt;At least with Signal you can compile your own client (though that doesn&amp;#x27;t help if the server is going to send you fake public keys!).</text></comment>