WhatsApp is an application that allows users on mobile devices to communicate with each other using end-to-end encryption. With it, users can securely chat with and call each other, send files, and engage in group chats. Although WhatsApp uses telephone numbers as contacts, calls and messages actually use your data connection; therefore both parties to the conversation must have Internet access on their mobile devices. Due to this, WhatsApp users don't incur SMS and MMS fees.
WhatsApp is owned by Facebook. The app itself is closed-source software, which means that it is very difficult for outside experts to confirm that the company has implemented their encryption in a secure way. Nonetheless, the methods that WhatsApp uses to send encrypted messages are public, and regarded as secure.
Installing WhatsApp on your iPhone
Step 1: Download and Install WhatsApp
After WhatsApp finishes downloading, tap "Open" to launch the app.
Step 2: Register and Verify your Phone Number
WhatsApp will request access to your contacts. If you grant this access, WhatsApp will have a full list of your contacts' phone numbers. If you do not grant this access, you can manually add each of your contacts for chat messages, however you cannot make a new call without granting WhatsApp access to your phone's contacts. If you'd like to send photos, media, or files, Whatsapp will request access to these files as well.
Tap "Continue," then tap "Allow" for each if you wish to grant these permissions.
WhatsApp will next request access to send you notifications. Tap "OK" to be notified when you receive new messages.
Tap "Agree & Continue." You will then see a screen that looks like this:
Enter your mobile phone number and tap "Done." You will then see a confirmation dialogue:
Click "Yes." In order to confirm your phone number, you will be sent an SMS text with a six-digit code. Enter it into the dialogue that looks like this:
To use WhatsApp, the person that you are messaging or calling must have WhatsApp installed as well.
When a new encrypted conversation is initiated, you will see a notification as follows: "Messages you send to this chat and calls are now secured with end-to-end encryption
. Tap for more info." At this point, you can verify
the authenticity of the person you are talking with, to ensure that their encryption key
wasn't tampered with or replaced with the key
of someone else when your application downloaded it (a process called key verification
). Verifying is a process that takes place when you are physically in the presence of the person you are talking with. To verify, you can manually view the contact by tapping on their name at the top, then in the subsequent screen, tapping on the blue lock icon:
Have your contact follow the same process on their phone. The following screen will be titled "Verify security code":
You will see a string of 60 numbers. You can either verify by manually reading off these numbers and making sure they correspond with your contact's numbers, or having them scan your QR code which appears on this screen.
Another verification method you may want to consider is taking a screenshot of the numbers and sharing it over a secondary secure channel, like PGP-encrypted email.
Once this is done, you can be assured that encrypted communications with this contact really are only accessible by yourself and your contact. This applies to both text messages within WhatsApp as well as WhatsApp voice calls.
Additional Security Settings
Show Security Notifications
As stated above, if for any reason the encryption key of a contact changes, you may want to be notified of this change.
Ordinarily, a key
changing is no cause for alarm: this often happens as a result of app re-install or switching phones. There is, however, the possibility of a key change being caused by a malicious third party performing a man-in-the-middle attack
. For this reason, it is good practice to verify (as described above) once again when the key of your contact changes. By default, WhatsApp doesn't display when contacts keys change. To enable this, go into Settings → Account → Security, and slide 'Show security notifications' to the right:
Also stated above, you'll probably want to ensure that unencrypted backups are not sent to Apple.
Navigate to Settings → Chats → Chat Backup to ensure cloud backups are turned off. Under "Auto Backup" choose "Off":