Apps / Data / Guest posts / Privacy / Social media

WhatsApp is not really encrypting your messages

A team of white-hat hackers found that anyone on the same network as your phone could gain access to the content of your messages.

This is a guest post by TwoSense founder Dawud Gordon. A version of this article first appeared on the TwoSense blog.
WhatsApp’s security was recently hacked by white-hat researchers. After much click-baiting, it turns out they’re not actually collecting any information they shouldn’t be. They are, however, protecting it poorly, and they still have access to message content with the ability to share it with Facebook.

Security researchers at Brno University of Technology in the Czech Republic (fun fact: Brno is where Gregor Mendel discovered modern genetics) were able to reverse-engineer WhatsApp’s security mechanisms and published their findings in an academic journal.

Read the study

Instantly there was a frenzy of click-baited articles about how WhatsApp was stealing data from users. Reading the study itself showed that while they are indeed collecting data, that data is reasonable given the service they are providing. For example, if you start a call with a friend, your WhatsApp client sends your phone number and that of your friend to the server. In WhatsApp your number is your username, which is needed for the system to know who to connect you with.

WhatsApp on iPhone.

(Photo by Flickr user Álvaro Ibáñez, used under a Creative Commons license)

A while back we wrote a post about how WhatsApp announced it would be releasing end-to-end encryption for its mobile service. They had also announced that they themselves would lose access to user messages, with only the sender and recipient being able to decrypt communication. This confused me because it came just after their $19 billion acquisition by Facebook, presumably for the content of the user communication coursing through their network.

Why on earth were they worth $19 billion to Facebook if the user generated content within WhatsApp was about to disappear within an encrypted channel? What the Brno hack revealed is that their implementation fell far short of their claims, and Facebook’s investment in the content of WhatsApp’s users’ communication was safe.

In interviews with journalists WhatsApp stated that they would use Public Key Encryption, where only the sender and recipient can unencrypted content. Indeed they did, but they used the same key for every user. This makes the Brno hack possible, meaning anyone on the same network as your phone could gain access to the content of your messages. Also, it means that WhatsApp themselves still have access to all message content. Moreover, their parent corporation Facebook has access as well and the ability to target you with advertising based on the content of your WhatsApp messaging.

While this is surprising given WhatsApp’s previous PR, it does explain the mysterious $19 billion price tag (ultimately $21.8 billion) that Facebook was willing to put on WhatsApp. In my opinion, fully encrypting all WhatsApp content would make WhatsApp a near worthless asset to Facebook, especially considering the repeal of the $0.99 a year subscription model. We should not expect it any time soon, no matter how many posts like this one appear.

Series: Brooklyn

Before you go...

Please consider supporting Technical.ly to keep our independent journalism strong. Unlike most business-focused media outlets, we don’t have a paywall. Instead, we count on your personal and organizational support.

3 ways to support our work:
  • Contribute to the Journalism Fund. Charitable giving ensures our information remains free and accessible for residents to discover workforce programs and entrepreneurship pathways. This includes philanthropic grants and individual tax-deductible donations from readers like you.
  • Use our Preferred Partners. Our directory of vetted providers offers high-quality recommendations for services our readers need, and each referral supports our journalism.
  • Use our services. If you need entrepreneurs and tech leaders to buy your services, are seeking technologists to hire or want more professionals to know about your ecosystem, Technical.ly has the biggest and most engaged audience in the mid-Atlantic. We help companies tell their stories and answer big questions to meet and serve our community.
The journalism fund Preferred partners Our services

Join our growing Slack community

Join 5,000 tech professionals and entrepreneurs in our community Slack today!

Technically Media