E2EE doesn’t mean that the developer/company can’t be a member of the “ends” in “End-to-end encryption”. WhatsApp is closed-source, so nobody can really confirm which E2EE algorithm is at play. However, considering that the E2EE is the implementation of a known E2EE algorithm, such algorithms often support more than two keys (hence, more than two people), so, a third-key from Charlie can be part of the conversation, unbeknownst to Alice and Bob. If Meta would inject their own key inside every WhatsApp conversation, they could effectively read things.
For example: GPG/PGP support multiple public keys, so the same encrypted message can be decrypted by any private keys belonging to those public keys. Alice can send a message to both Bob, Charlie and Douglas, collectively specifying their public keys at the moment of the encryption. Then, the exact same payload would be sent to them, and they would use their own private keys to decrypt the message.
So, let’s suppose that a closed-source messaging app company/developer had their own pair of public and private keys, and they public key is injected in every conversation made through their app. They’d also obfuscate it from the UI so the UI won’t show the hardcoded “third-party”. This way they could easily read every single message being exchanged through their app. It’s like TSA with a “master key” that can open everyone’s travelling bags, no matter where you bought the travelling bag.
Even Signal may have this. Yeah, libsignal is “open-source”, but the app isn’t. What if their app had some hardcoded public key from Signal team? The only trustworthy E2EE is encoding it yourself using OpenPGP and similar. And if one is more privacy-worried than me, there are projects such as the “Tinfoil Chat” which is almost-immune to eavesdropping, involving optocoupled (hence, airgapped) circuitry, separate machines for networking, decryption and encryption, Onion-routing, and so on.
In summary: nobody should trust out-of-the-box E2EE, especially those hidden within a closed-source app.
E2EE doesn’t mean that the developer/company can’t be a member of the “ends” in “End-to-end encryption”. WhatsApp is closed-source, so nobody can really confirm which E2EE algorithm is at play. However, considering that the E2EE is the implementation of a known E2EE algorithm, such algorithms often support more than two keys (hence, more than two people), so, a third-key from Charlie can be part of the conversation, unbeknownst to Alice and Bob. If Meta would inject their own key inside every WhatsApp conversation, they could effectively read things.
For example: GPG/PGP support multiple public keys, so the same encrypted message can be decrypted by any private keys belonging to those public keys. Alice can send a message to both Bob, Charlie and Douglas, collectively specifying their public keys at the moment of the encryption. Then, the exact same payload would be sent to them, and they would use their own private keys to decrypt the message.
So, let’s suppose that a closed-source messaging app company/developer had their own pair of public and private keys, and they public key is injected in every conversation made through their app. They’d also obfuscate it from the UI so the UI won’t show the hardcoded “third-party”. This way they could easily read every single message being exchanged through their app. It’s like TSA with a “master key” that can open everyone’s travelling bags, no matter where you bought the travelling bag.
Even Signal may have this. Yeah, libsignal is “open-source”, but the app isn’t. What if their app had some hardcoded public key from Signal team? The only trustworthy E2EE is encoding it yourself using OpenPGP and similar. And if one is more privacy-worried than me, there are projects such as the “Tinfoil Chat” which is almost-immune to eavesdropping, involving optocoupled (hence, airgapped) circuitry, separate machines for networking, decryption and encryption, Onion-routing, and so on.
In summary: nobody should trust out-of-the-box E2EE, especially those hidden within a closed-source app.