Discussion

• @matthew_d_green Matthew Green on x

  Woohoo! WhatsApp has released key transparency! https://engineering.fb.com/...

• @lorenzofb @lorenzofb on x

  Good to see WhatsApp add new security and privacy features. “Device Verification” is particularly interesting, and it's built to counter malicious fake versions of WhatsApp, which still trick a lot of people. https://blog.whatsapp.com/... https://twitter.com/...

• @rme Raúl Martínez on x

  Whatsapp introduces refresh tokens to prevent advanced OS-level attacks https://engineering.fb.com/... https://twitter.com/...

• @wabetainfo @wabetainfo on x

  WhatsApp announces account security features with new device verification and automatic security codes! They help users prevent unauthorized access to accounts and protect against mobile device malware, and they will be available over the coming months. https://wabetainfo.com/...…

• @sweis Steve Weis on x

  Whatsapp & @_klewi released a Rust implementation of an auditable key directory to help provide key transparency for end-to-end encrypted messaging. Code: https://github.com/... Blog post: https://engineering.fb.com/... Academic papers: https://eprint.iacr.org/... https://eprint.…

• @matthew_d_green Matthew Green on x

  Proposals like Key Transparency don't address every one of these attack vectors. But they signal very loudly that developing further attacks in this direction probably is not a great investment.

• @josephbonneau Joseph Bonneau on x

  Congrats to Kevin (@_klewi), Sean and the entire @WhatsApp team. We published our CONIKS paper 8 years ago so it's been a long road but I'm very excited to see key transparency is finally launching! https://twitter.com/...

• @olemoudi @olemoudi on x

  So essentially they implemented “refresh token rotation”, which is on the OAuth2 RFC to mitigate unauthorized parties from stealing and using the token subrepticiusly https://twitter.com/...

• @matthew_d_green Matthew Green on x

  So here's a thread on key transparency, and why this is a big deal. 1/

• @whatsapp @whatsapp on x

  Your privacy remains our priority. To better protect our users, we're rolling out 🆕 security features that give you more layers of privacy and more control over your messages 🔒 Check the 🧵 below to see the new account defense updates.

• @fb_engineering @fb_engineering on x

  .@WhatsApp has launched a new cryptographic security feature to automatically verify a secured connection based on key transparency. Learn how key transparency solutions help strengthen end-to-end encryption. https://engineering.fb.com/... https://twitter.com/...

• @_klewi Kevin Lewi on x

  Today, we (@WhatsApp) announced our plans to deploy key transparency, as a way for users to be able to verify each other's public keys “automatically”. Lots of details go into this, and are described in this blog post here: https://engineering.fb.com/... 🧵

• @matthew_d_green Matthew Green on x

  So the major signal we're getting from WhatsApp (and from Apple, a few months ago) is that they intend to make secure messaging as safe and private as they possibly can. These systems are important, and they will invest in blocking even sophisticated attacks.

• @fb_engineering @fb_engineering on x

  .@WhatsApp's new feature fights against⚠️malware. Here's how Device Verification on WhatsApp helps protect users' accounts from on-device malware while allowing uninterrupted access to calls and messages. https://engineering.fb.com/... https://twitter.com/...