WhatsApp Chat Backup now supports Passkeys to encrypt data
Meta has added support for a new way to encrypt chat backups in WhatsApp Messenger: you can now use Passkeys to secure your data.
WhatsApp introduced end-to-end encrypted backups for chat backups in 2021. This security feature requires users to create a password, or save a 64-bit digital key on their device to protect the data from unauthorized access.
You may be aware that WhatsApp rolled out Passkeys support for Android in 2023, and for iOS in 2024. This addition allowed users to verify their account using a Passkey. However, it didn't support chat backups, until now, that is.
Unlike the older methods, i.e. using a password or a 64-bit key, Passkeys offer a passwordless option, there is nothing you need to remember, it never leaves your device, and is easier to use. You can use your face, fingerprint, or screen lock code to encrypt your chat backups. The announcement on WhatsApp's blog says that the encryption standard that is used for chat backups is the same that is used for chats and calls in the app.
To enable Passkey for chat backup in WhatsApp, go to the app's Settings > Chats > Chat backup > and select end-to-end encrypted backup. Here, you will be able to select the option to use a Passkey.
It may not be available for you yet, that is because WhatsApp says the feature is rolling out gradually to users, and it may take a few weeks or months before it is available for all users. Once you enable the option, you will be asked to use the Passkey to unlock access to your chat backups.
Passkeys for chat backups are supported on WhatsApp on iOS and Android.
WhatsApp recently added a message translation feature for chats, a built-in document scanner for Android, along with Live Photos for iOS, and Motion Photos on Android.
Do you use Passkeys?
I enjoyed reading this. Keep up the great work.
Loved this post! Simple, practical, and valuable.
Today I learned that passkeys can also be used for encryption – and not just web-based authentication.
Presumably using the WebAuthn PRF extension (pseudo-random function extension).
https://bitwarden.com/blog/prf-webauthn-and-its-role-in-passkeys/
Although, it’s difficult to get my head around how this works. If WhatsApp are using one key for both authentication and for asymmetric encryption, I wonder how it would work with multiple passkeys and what happens to the encrypted data if a user deletes or recreates a passkey.
If multiple passkeys are allowed, can the US government add themselves with their own passkey?