WhatsApp has released a new open source browser extension to help further protect those who use its web-based messaging service.
The new extension is called Code Verify and works in partnership with web infrastructure company Cloudflare to provide transparent, independent, third-party verification of the code users receive on WhatsApp Web. This ensures that your WhatsApp web code has not been tampered with or altered.
While WhatsApp has for years protected personal messages sent via WhatsApp Web using end-to-end encryption as they travel from sender to recipient, many factors can weaken the security of a web browser that doesn't exist on mobile devices. application space. At the same time, since mobile operating systems like iOS and Android were created after the web, security measures on mobile devices may be stronger, especially in terms of how app stores review and approve each new app and software update.
In addition to implementing Code Verify for WhatsApp Web, WhatsApp is also offering it as open source software on GitHub so other services can use it as well.
code verification
Sub-resource integrity is a security feature that allows web browsers to verify that the resources they get have not been tampered with. Although it only applies to individual files, Code Verify extends the concept to verify the resources of an entire web page.
To do this at scale, WhatsApp has partnered with Cloudflare to act as a trusted third party. In fact, the company gave Cloudflare a cryptographic hash source of truth for WhatsApp Web JavaScript code so that when someone uses Code Verify, the extension automatically compares the code running on WhatsApp Web with the version of the code it verified. and published on Cloudflare. .
Meta Open Source offers the Code Verify extension and it will be available in the official browser extension stores for Google Chrome, Microsoft Edge and Mozilla Firefox. In a blog post, WhatsApp points out that its new extension does not save any data, metadata or user data and does not share any information with the service itself. The messages that users send and receive through WhatsApp Web are not read or seen by the company and neither it nor its parent company Meta will know whether or not someone has downloaded the Code Verify extension.
Once installed, the extension will run automatically every time you access WhatsApp Web and will act as a real-time alert system for the code delivered to you. You can also pin the extension to your browser's toolbar to see its results without any additional steps.