Whatsapp’s messaging app supposedly ensures strong end-to-end encryption, with the idea being that only the people involved in a conversation will ever be able to read the messages. But as it turns out, a programming bug — that Whatsapp has known about for some time and has not fixed — theoretically allows Whatsapp to snoop on any encrypted messages sent over the platform.
The Guardian first reported on the bug, which was found by Tobias Boelter, a security researcher at the University of California, Berkeley. The security flaw is related to how Whatsapp handles offline messages, and appears to be the result of a decision by Whatsapp to favor a seamless user experience over total security.
End-to-end encryption relies on both users having two parts of a secure key, used to encrypt and then decrypt the message. But to make sure that messages are always sent, even when the recipient is offline, Whatsapp appears to have compromised that system. According to The Guardian, “WhatsApp has the ability to force the generation of new encryption keys for offline users, unbeknown to the sender and recipient of the messages, and to make the sender re-encrypt messages with new keys and send them again for any messages that have not been marked as delivered.”
In theory, that would allow WhatsApp — or any government agency with the appropriate court order — to snoop on supposedly secure messages. There is no evidence that this has been done, and since the security bug relies on proactive involvement by WhatsApp, it seems unlikely that illegal hackers could use this bug to spy on users.
Still, it’s a blow for WhatsApp’s supposedly tight security. Professor Kirstie Ball, a privacy advocate, told the Guardian that “it is a huge threat to freedom of speech, for it to be able to look at what you’re saying if it wants to. Consumers will say, I’ve got nothing to hide, but you don’t know what information is looked for and what connections are being made.”
Separately, a Buzzfeed investigation yesterday highlighted a danger associated with Signal, another secure messaging app that has grown in popularity in recent months. Buzzfeed pointed out that once you sign up for Signal with your phone number, the fact that you are using Signal is visible to anyone else who has your phone number. Since Signal is an app expressly designed for privacy advocates and whistleblowers, that might show guilt by association.
