Meta explains how third-party apps will hook into Messenger and WhatsApp
External services will likely have to adopt the same Signal protocol it uses for end-to-end encryption.
Meta has revealed more details about how third-party messaging apps can be interoperable with WhatsApp and Messenger. The company is being required to open up its apps to a certain extent to comply with the Digital Markets Act (DMA), a new European Union law that comes into effect this week.
"We think the best way to deliver interoperability is through a solution which builds on Meta’s existing client/server architecture," Meta wrote in a blog post. "The approach we have taken in terms of implementing interoperability is the best way of meeting DMA requirements, whilst also creating a viable approach for the third-party providers interested in becoming interoperable with Meta and maximizing user security and privacy."
Meta says it has been working on interoperability with the European Commission for nearly two years. To begin with, interoperability will need to support text-based messages and the ability to share images, voice notes, videos and other files. In the future, Meta will need to enable group chats and calling between WhatsApp and Messenger and third-party apps.
For the time being, third-party developers will likely have to use the Signal protocol to hook into Messenger and WhatsApp. Meta uses that protocol for end-to-end encryption (E2EE) on both apps, "as it represents the current gold standard for E2EE chats." Developers will have the option of using a compatible protocol, but only "if they are able to demonstrate it offers the same security guarantees as Signal."
Meta notes that when it comes to messaging entirely within the WhatsApp and Messenger ecosystems, it controls both the sending and receiving clients. In such cases, it can affirm that only the sender and intended recipients will be able to see messages.
However, it added that "while we have built a secure solution for interop that uses the Signal protocol encryption to protect messages in transit, without ownership of both clients (endpoints) we cannot guarantee what a third-party provider does with sent or received messages, and we therefore cannot make the same promise." As such, Meta is indicating that messages that originate from or are sent to a third-party app may not be as secure as those that stay completely within its own ecosystem.
Developers who connect their apps to WhatsApp and Messenger will have to host media files that they send to Meta's platforms on their own servers. WhatsApp or Messenger will then download the media from the media via a Meta proxy service.
To enable interoperability, makers of third-party messaging apps will need to sign an agreement with Meta. The company notes that it needs to be ready to turn on interoperability with another service within three months of receiving a request, though "it may take longer before the functionality is ready for public use."
