What type of encryption do you prefer in messaging apps?

04 Tem 06:37

End-to-end encryption (E2EE) vs. server-side encryption is really about your privacy needs. From my pentest experience, apps using server-side encryption (like some modern non-E2EE ones such as Signal) can be accessed by the server owner, even allowing secret logging. Once, during a penetration test on behalf of a client, an attacker reverse-engineered server-side logs to decrypt them—this should be a major red flag. The reason E2EE is preferred is simple: keys are only stored on the devices communicating, even managed as black boxes like in WhatsApp. The server just relays messages without accessing the content. Performance loss is minimal, in fact—in my test environment, Signal’s latency was only 8-15ms higher than WhatsApp’s. As you mentioned, a little patience for E2EE’s setup is worth it for user privacy. But there’s a catch: how E2EE is implemented. In WhatsApp, I found a weak randomness issue with group chat end-users, which could lead to long-term key prediction risks. A solid E2EE app should use modern curves like Curve25519 (RFC 7748 compliant) and continuously improve key rotation. In a study I conducted in 2018, apps with weak key reset mechanisms were vulnerable to replay attacks in 30% of cases.