Fans of privacy and online security will be dismayed to learn that WhatsApp, the Facebook-owned instant messaging service which claimed to offer end-to-end encryption for all users, may not actually be as secure as we were led to believe.
The revelation comes following a report that the encryption used by the service suffers from a fatal flaw which could, possibly deliberately, allow Facebook to see messages sent by users, perhaps opening the company up to requests from the government. End-to-end encryption would normally mean that only the sender and the receiver of the message would have access to the encryption keys required to decode the message, meaning the service owner itself would have no access.
According to Tobias Boelter, a cryptography and security researcher at the University of California, Berkeley however, a flaw in the Signal protocol created by Open Whisper Systems means that WhatsApp has the ability to force the change of a key when offline. New messages would then be sent as normal with the user having no idea that the key had changed.
The recipient is not made aware of this change in encryption, while the sender is only notified if they have opted-in to encryption warnings in settings, and only after the messages have been re-sent. This re-encryption and rebroadcasting effectively allows WhatsApp to intercept and read users’ messages.
Interestingly, the Signal app does not suffer from the same problem, which obviously leaves WhatsApp and Facebook open to the question of why it is in evidence here.
[In Signal], if a recipient changes the security key while offline, for instance, a sent message will fail to be delivered and the sender will be notified of the change in security keys without automatically resending the message.
Boelter reportedly told Facebook about the issue back in April, only to be told that the app was exhibiting expected behavior. That alone is troublesome, and Facebook is now being coy about the whole situation. As things stand right now though, if security of your messages is paramount we can only suggest using the Signal app rather than WhatsApp – at least until things are cleared up.
Update x1: Facebook has now responded to the issue, offering a “solution” in the form of Show Security Notifications feature could be turned on in the app to notify whenever a security code is changed:
Over one billion people use WhatsApp today because it is simple, fast, reliable and secure. At WhatsApp, we’ve always believed that people’s conversations should be secure and private. Last year, we gave all our users a better level of security by making every message, photo, video, file and call end-to-end encrypted by default.
In WhatsApp’s implementation of the Signal protocol, we have a “Show Security Notifications” setting (option under Settings > Account > Security) that notifies you when a contact’s security code has changed. We know the most common reasons this happens are because someone has switched phones or reinstalled WhatsApp. This is because in many parts of the world, people frequently change devices and Sim cards. In these situations, we want to make sure people’s messages are delivered, not lost in transit.
Update x2: WhatsApp has released a statement of its own as well:
The Guardian posted a story this morning claiming that an intentional design decision in WhatsApp that prevents people from losing millions of messages is a “backdoor” allowing governments to force WhatsApp to decrypt message streams.This claim is false.
WhatsApp does not give governments a “backdoor” into its systems and would fight any government request to create a backdoor. The design decision referenced in the Guardian story prevents millions of messages from being lost, and WhatsApp offers people security notifications to alert them to potential security risks. WhatsApp published a technical white paper on its encryption design, and has been transparent about the government requests it receives, publishing data about those requests in the Facebook Government Requests Report.
(Source: The Guardian)
You may also like to check out:
You can follow us on Twitter, add us to your circle on Google+ or like our Facebook page to keep yourself updated on all the latest from Microsoft, Google, Apple and the web.