If we blame end - to - end encryption of WhatsApp for the Israeli spyware Pegasus that affected 1, 400 select users of the Facebook - owned messaging app globally, including 121 in India, we will be barking up the wrong tree, say experts.
WhatsApp provides end - to - end encryption by default, which means only the sender and recipient can view the messages.
But the piece of NSO Group software exploited WhatsApp's video calling system by installing the spyware via missed calls to snoop on the selected users.
This raised questions about the utility of encryption, which also prohibits security agencies from tracing the origin of messages.
Traceability of WhatsApp messages is a key demand that India has put forward.
But security experts have warned that blaming end - to - end encryption for the spyware would not be right.
"WhatsApp as well as other leading instant messaging apps have recently adopted an end - to - end encryption.
The encryption process itself is solid, messages that leave your device are encrypted and they stay that way until they reach their final destination, " Yaniv Balmas, Head of Cyber Research, Check Point Software Technologies, told IANS.
"However, on your device, as well as on the receiving device the messages are decrypted so you can read them.
A malicious application running on your device can inspect them, change or delete them just as well as you could.
So the issue here is not in the applications or in their encryption protocol, but in the environment they are installed in, " Balmas said.
According to leading tech policy and media consultant Prasanto K. Roy, end - to - end encrypted apps (E2EE) do provide security, and messages or calls cannot be intercepted and decrypted en route without enormous computing resources.
"But once anyone can get to your handset, whether a human or a piece of software, the encryption doesn't matter any more.
Because on your handset, it's all decrypted, " he explained.
"There's plain text on your screen, and plain audio or video in your camera.
The right kind of spyware in your handset can read those messages or even listen in on your phone's mic to what someone is saying in the room, or see what's happening around, with the camera.
"If that happens then all apps are affected, not just WhatsApp.
The spyware doesn't care about the app - - it just reads the screen.
So, the recent incident has not changed the fact that E2EE apps/platforms are secure.
Hello EnglishHello English
