Meta maintains end-to-end encryption while supporting third party apps in WhatsApp, Messenger

Meta has outlined the steps it has taken to ensure the privacy and security of its users, despite introducing interoperability support for third party messaging apps in the EU to comply with regulations.

WhatsApp has been testing the features in the beta version, with only one-on-one chats supported at the moment. For the first year, Meta is required to implement one to one instant messaging capabilities and sharing of multimedia files. Support for voice calls and group messaging are only required in future updates. Third party providers will have to sign an agreement with WhatsApp to enable interoperability, with Meta publishing references for the requirements for WhatsApp initially. The requirements for interoperability with Messenger will be shared at a later date.

According to the regulations, the interoperability functionality has to be enabled within three months of receiving a request, but Meta has indicated that setting up the technical infrastructure and testing may take more than the mandated time, for a public rollout to all users. Meta has indicated that it intends to focus on privacy while building the interoperability capabilities, ensuring end-to-end encryption (E2EE) for all users. E2EE has been the default for all users on WhatsApp since 2016, but is still in the process of being rolled out for Messenger users.

WhatsApp and Messenger both use the Signal Protocol for E2EE. Meta has indicated that it prefers third party providers to use the Signal Protocol as well, or at least a compatible one that demonstrably offers the same guarantees as the Signal Protocol. Meta also uses the Noise Protocol Framework for securing communications between the client and a WhatsApp server. A Noise Handshake is necessary as part of the Noise Protocol, which will now become a requirement for any third party services that want to be interoperable with WhatsApp. Meta is also considering the introduction of a proxy intermediary to provide third-party providers more flexibility and control.