@thenexusofprivacy or they implemented it in a way that makes it hard to tell a real error from deliberate weakening

@thenexusofprivacy And a clever build and release developer could introduce this with a small change to an already-built artifact—so everyone who works on the source code only sees legit key generation.

This might be the result of a deliberate compromise? NSA can get access if they're willing to spend the computing cycles, Meta avoids certain kinds of government pressure 3/3

Maybe, instead of generating a secret key from a vast number of possibilities, WhatsApp's RNG is tweaked to generate a plausible-looking key from a smaller set—feasible for Meta to search using a cluster, but that looks legit from the outside.

Remember how long it took people to find the Debian […]

I am informed that depending on where you are in the world and your browser or operating system you might see:

* a normal turn-of-the-century website with news on it and one banner ad at the top
* a mess of popups and nags asking for all your personal information to be sent to two hundred of […]

Seems like a good idea to try a "how to turn off ai" on something page, it will probably do numbers 2/2