The contents of the chat messages are e2e encrypted, so meta can't see what you are sending.

But they can see all of the Meta data, ie how often you chat with someone, how often you send pictures/videos/voice messages, etc.

That is more than enough to know everything about you and your friends.

My understanding is that it IS encrypted, and its supposed to use the Signal protocol (Signal developed it and released it for others to use)

The problems are with

• metadata (like the other comment explained)
• closed source, so we take their word on it for how it works. It's possible they're being misleading or doing something shady

See this image from a few years ago:

Note that signal does require this, which isn't in the chart:

• phone number (for now)
• last active date
• sign up date (I think)

I assume Whatsapp encryption is equivalent to https, your connection to the server is encrypted and "impossible" to be intercepted and decrypted, but on the server end everything arrives as clear text, so the only people that can watch your conversation is the recipient of the messages and whatsapp.

I case they're set on WhatsApp:

You could use something like:

https://github.com/mautrix/whatsapp

and bridge WA to a secure Matrix server of your choice. That way you can have a secure environment and they can use whatever they like.

Here is an overview table about messengers, in case you want to compare them and have more arguments in the discussion:

https://www.messenger-matrix.de/messenger-matrix-en.html

I wouldn't consider WA secure. They do tracking, they have your phone numbers and those of all of your friends and know exactly who you talk to, when, and how often. Even if they don't know the content of the message because it's encrypted, that's a lot of information for the algorithm to feed on. Apart from that, I'm not sure if they have access to the encryption keys. They might be able to decrypt everything if they want.

I'm sure someone wrote a lengthy blog article about WA. But unless someone does a proper security audit including where the encryption keys are stored and the implications of that and how extra features like breaking encryption in case someone flags an inappropriate post turns out... The 'it's safe' is just a claim by your brother or Meta. You're free to believe in anything you want. But it's not necessarily true.

WhatsApp gives you the option to back up all messages to Google or Apple Cloud unencrypted.

No Telegram lol. Thats way worse. Whatsapp sais they are E2EE but its all "trust me bro" because you cannot look at the code.

With Telegram its a little pain to open encrypted chats and groups are always unencrypted. So its useless.

Let them try Signal, its nearly identical but you can trust it.