How secure is whatsapp encryption

Is WhatsApp safe? How does its end-to-end encryption work?

Edgar Cervantes / Android Authority

WhatsApp is the most used chat application in the world, handily surpassing rivals like Messenger, Signal, and Telegram. Given how much sensitive data we tend to share in online conversations, is the app safe to use? Moreover, should you be worried about potential hacks or data leaks, even with the encryption WhatsApp claims to offer?

In this article, let’s answer those questions by taking a closer look at WhatsApp’s security measures, including end-to-end encryption. Later, we’ll also discuss some additional features you can take advantage of to keep your chats safe from prying eyes.

WhatsApp security: What is end-to-end encryption?

Dhruv Bhutani / Android Authority

Instant messaging has been around since the dawn of the internet, but early implementations were far from secure. For one, they exchanged messages between users in plain text. This meant that anyone with access to the company’s servers could read your messages, including any intermediaries or malicious actors down the line. And even though many services implemented encryption-in-transit in the late 2000s, companies usually held the keys to decrypt user communications on their end.

See also: What is encryption?

More recently, however, many platforms have adopted end-to-end encryption (E2EE) to improve message confidentiality and user privacy. In an end-to-end encrypted communication channel, only the sender and receiver have the keys necessary to decrypt each other’s messages. Nobody else — including the platform, your ISP, or even a hacker with access to the encrypted data — can read your messages.

WhatsApp uses end-to-end encryption for all messages and calls by default.

Since 2014, WhatsApp’s end-to-end encryption system has relied on Open Whisper Systems’ open-source Signal protocol. You may know the company as the developers of chat application Signal, a WhatsApp competitor that prides itself on putting security and privacy first.

According to WhatsApp’s documentation, virtually all of your communication on the platform is secured with end-to-end encryption. This includes messages, media, voice notes, calls, and even status updates.

How does WhatsApp’s encryption work?

Edgar Cervantes / Android Authority

The Signal encryption protocol used by WhatsApp combines multiple cryptographic techniques, starting with public-key encryption. Put simply, it involves each user owning a pair of randomly generated keys — one that stays private and another that gets distributed publicly.

The idea here is that a sender uses the recipient’s public key to encrypt messages. On the other end, the recipient uses their private key to decrypt it. Since your device generates the private key, WhatsApp never has access to it. This simple cryptographic technique has been used for decades now, with modified versions securing everything from emails to cryptocurrency wallets.

The Signal protocol used by WhatsApp is universally regarded as the gold standard for encrypted messaging.

However, standard public-key encryption isn’t secure enough on its own. It suffers from a single point of failure. If your private key ever gets compromised, an attacker could decrypt your past, present, and future chats completely unchecked. To remedy this, the developers behind Signal’s protocol devised a novel technique called double ratchet encryption.

Instead of using a static set of keys for each user, the protocol uses a mix of permanent and temporary keys. The latter changes every time you send a new message. This means that if a theoretical attacker were to gain access to one particular key, they wouldn’t be able to decrypt more than a few messages. Constantly renewing keys seems like an overkill solution, but it’s also simple enough that our smartphones can handle it effortlessly.

Of course, there’s a lot more to WhatsApp’s encryption system — which you can find in the company’s technical white paper on the subject. However, the crux of the matter is that the encryption is sound and robust enough to ward off eavesdropping and similar basic attacks.

Read More: Best private messaging apps

Is your WhatsApp chat secure? What do the experts think?

Dhruv Bhutani / Android Authority

WhatsApp lets you verify that your individual chats and calls are end-to-end encrypted. Simply open a chat within the app, tap on the contact’s name, and, finally, the “Encryption” label. You’ll find yourself presented with a QR code and a 60-digit number. Now, follow the same steps on the recipient’s phone and compare the values.

As long as the number matches on both devices, your chat is properly end-to-end encrypted. WhatsApp calls this a “security code,” but it’s just an easier way to represent the public key we spoke about earlier. Completing this step also helps ensure that your communication is reaching the right person and not a malicious imposter pretending to be your contact. It also keeps WhatsApp accountable — if the keys don’t match, it would place the company under tremendous scrutiny.

WhatsApp's key verification feature lets you ensure that your chat wasn't hijacked or intercepted by a malicious third-party.

Having said that, WhatsApp isn’t perfect — it records a fair amount of information about you outside of the chat interface. The data collected includes your contact list, location, device identifiers, and transaction history, among others. However, Signal is the only alternative that claims to collect less data and emphasizes security with independent security audits. Other popular chat applications like Messenger and Telegram don’t even offer end-to-end encryption by default.

Read more: What data does WhatsApp collect on me?

For this reason, security researchers recommend WhatsApp over most of the competition. The Electronic Frontier Foundation is a vocal critic of the app’s data-sharing practices. However, it maintains that “WhatsApp still uses strong end-to-end encryption, and there is no reason to doubt the security of the contents of your messages on WhatsApp.”

Signal co-founder and renowned cryptographer Moxie Marlinspike has also vouched for the app in the past. In a 2017 blog post, he said, “We [Signal] believe that WhatsApp remains a great choice for users concerned with the privacy of their message content.”

Do you think WhatsApp is safe?

468 votes

Potential WhatsApp attacks you should stay wary of

Andy Walker / Android Authority

It’s pretty clear by now that the contents of your WhatsApp chats stay confidential. However, there are still some potential security pitfalls that you should be aware of. While your chats won’t ever get intercepted on their way to you, they’re pretty exposed once they reach their destination. In other words, your phone and any recipient’s device are far easier targets for potential attacks.

If you lose your smartphone, for example, an attacker with physical access to it could copy your WhatsApp message database off the device. Thankfully, WhatsApp encrypts this file, and recovering the key requires root access on Android. If you don’t know what that is, you likely have nothing to worry about. That said, they could still access media files such as images and videos. All of this can be easily remedied with a simple screen lock on your smartphone.

Your phone and cloud storage account are easier targets for most attackers, so secure your backups well.

Another well-publicized potential attack vector involves cloud backups to Google Drive and iCloud. By default, WhatsApp will back up your chats to these services without any encryption whatsoever. This means that if an attacker somehow gains access to your cloud storage account, they could also theoretically get their hands on your WhatsApp data.

Luckily, WhatsApp has already rolled out the ability to encrypt chat backups with a password or encryption key. The latter is a randomly generated 64-digit key. You can store it in a password manager for maximum security. This is an opt-in feature, so make sure that you enable it under Settings > Chats > Chat backup within the WhatsApp app on Android.

On the subject of WhatsApp’s optional security features, consider turning on two-factor authentication as well. You can find it under WhatsApp Settings > Account > Two-step verification. This will require you to enter a PIN when registering your account on a new phone. It won’t prevent data leaks but could prevent fraudulent login attempts from malicious actors.

FAQs

WhatsApp uses end-to-end encryption, which means nobody except the sender and recipient can read messages. Other chat apps like Facebook Messenger and Telegram don’t use end-to-end encryption by default.

Yes, all chats on the platform are encrypted by default. WhatsApp uses an end-to-end encryption system based on the Signal protocol.

A remote hacker cannot read your WhatsApp chat history because all communication on the platform is encrypted. However, someone with physical access to your smartphone could read your messages.

WhatsApp “end-to-end encrypted” messages aren’t that private after all

Enlarge / The security of Facebook's popular messaging app leaves several rather important devils in its details.

Yesterday, independent newsroom ProPublica published a detailed piece examining the popular WhatsApp messaging platform's privacy claims. The service famously offers "end-to-end encryption," which most users interpret as meaning that Facebook, WhatsApp's owner since 2014, can neither read messages itself nor forward them to law enforcement.

This claim is contradicted by the simple fact that Facebook employs about 1,000 WhatsApp moderators whose entire job is—you guessed it—reviewing WhatsApp messages that have been flagged as "improper."

End-to-end encryption—but what’s an “end”?

Enlarge / This snippet from WhatsApp's security and privacy page seems easy to misinterpret.

Jim Salter

The loophole in WhatsApp's end-to-end encryption is simple: The recipient of any WhatsApp message can flag it. Once flagged, the message is copied on the recipient's device and sent as a separate message to Facebook for review.

Messages are typically flagged—and reviewed—for the same reasons they would be on Facebook itself, including claims of fraud, spam, child porn, and other illegal activities. When a message recipient flags a WhatsApp message for review, that message is batched with the four most recent prior messages in that thread and then sent on to WhatsApp's review system as attachments to a ticket.

Although nothing indicates that Facebook currently collects user messages without manual intervention by the recipient, it's worth pointing out that there is no technical reason it could not do so. The security of "end-to-end" encryption depends on the endpoints themselves—and in the case of a mobile messaging application, that includes the application and its users.

An "end-to-end" encrypted messaging platform could choose to, for example, perform automated AI-based content scanning of all messages on a device, then forward automatically flagged messages to the platform's cloud for further action. Ultimately, privacy-focused users must rely on policies and platform trust as heavily as they do on technological bullet points.

Content moderation by any other name

Once a review ticket arrives in WhatsApp's system, it is fed automatically into a "reactive" queue for human contract workers to assess. AI algorithms also feed the ticket into "proactive" queues that process unencrypted metadata—including names and profile images of the user's groups, phone number, device fingerprinting, related Facebook and Instagram accounts, and more.

Human WhatsApp reviewers process both types of queue—reactive and proactive—for reported and/or suspected policy violations. The reviewers have only three options for a ticket—ignore it, place the user account on "watch," or ban the user account entirely. (According to ProPublica, Facebook uses the limited set of actions as justification for saying that reviewers do not "moderate content" on the platform.)

Although WhatsApp's moderators—pardon us, reviewers—have fewer options than their counterparts at Facebook or Instagram do, they face similar challenges and have similar hindrances. Accenture, the company that Facebook contracts with for moderation and review, hires workers who speak a variety of languages—but not all languages. When messages arrive in a language moderators are not conversant in, they must rely on Facebook's automatic language-translation tools.

"In the three years I've been there, it's always been horrible," one moderator told ProPublica. Facebook's translation tool offers little to no guidance on either slang or local context, which is no surprise given that the tool frequently has difficulty even identifying the source language. A shaving company selling straight razors may be misflagged for "selling weapons," while a bra manufacturer could get knocked as a "sexually oriented business."

WhatsApp's moderation standards can be as confusing as its automated translation tools—for example, decisions about child pornography may require comparing hip bones and pubic hair on a naked person to a medical index chart, or decisions about political violence might require guessing whether an apparently severed head in a video is real or fake.

Unsurprisingly, some WhatsApp users also use the flagging system itself to attack other users. One moderator told ProPublica that "we had a couple of months where AI was banning groups left and right" because users in Brazil and Mexico would change the name of a messaging group to something problematic and then report the message. "At the worst of it," recalled the moderator, "we were probably getting tens of thousands of those. They figured out some words that the algorithm did not like."

Unencrypted metadata

Although WhatsApp's "end-to-end" encryption of message contents can only be subverted by the sender or recipient devices themselves, a wealth of metadata associated with those messages is visible to Facebook—and to law enforcement authorities or others that Facebook decides to share it with—with no such caveat.

ProPublica found more than a dozen instances of the Department of Justice seeking WhatsApp metadata since 2017. These requests are known as "pen register orders," terminology dating from requests for connection metadata on landline telephone accounts. ProPublica correctly points out that this is an unknown fraction of the total requests in that time period, as many such orders, and their results, are sealed by the courts.

Since the pen orders and their results are frequently sealed, it's also difficult to say exactly what metadata the company has turned over. Facebook refers to this data as "Prospective Message Pairs" (PMPs)—nomenclature given to ProPublica anonymously, which we were able to confirm in the announcement of a January 2020 course offered to Brazilian department of justice employees.

Although we don't know exactly what metadata is present in these PMPs, we do know it's highly valuable to law enforcement. In one particularly high-profile 2018 case, whistleblower and former Treasury Department official Natalie Edwards was convicted of leaking confidential banking reports to BuzzFeed via WhatsApp, which she incorrectly believed to be "secure."

FBI Special Agent Emily Eckstut was able to detail that Edwards exchanged "approximately 70 messages" with a BuzzFeed reporter "between 12:33 am and 12:54 am" the day after the article published; the data helped secure a conviction and six-month prison sentence for conspiracy.

How secure is WhatsApp

When you install the WhatsApp messenger on your smartphone, the application asks you to verify your phone number, import existing contacts, and, importantly, agree to the processing of personal data.

The logical question is, how safe is it to give a regular application such wide access to personal information? Cybersecurity experts are skeptical of WhatsApp developers' initiatives to process and store user data. Let's see why this messenger is not recommended for those who care about their own privacy and anonymity. nine0003

WhatsApp encryption

WhatsApp uses end-to-end encryption to protect all kinds of data used in the application. The messenger’s encryption algorithm and keys not only make it impossible to decrypt messages transmitted by users, but, according to WhatsApp management, prevent third parties and even government intelligence agencies from intercepting calls and reading users’ correspondence.

In addition to the encryption feature, WhatsApp allows users to fine-tune their privacy settings, including visibility of their status and profile to other messenger users. nine0003

How secure is WhatsApp?

Cybersecurity experts say "not 100%." Yes, end-to-end encryption makes WhatsApp more secure than other instant messaging software. However, like any application, WhatsApp is often targeted by sophisticated digital attackers (hackers).

Please note that by agreeing to the WhatsApp privacy policy, you voluntarily give the messenger access to your contact list and the ability to track your online activity, i.e. in what places (geolocation) and for how long you use WhatsApp. This, to some extent, puts your confidentiality and integrity of personal information at risk. And in the modern world, personal data is a valuable commodity, especially among various scammers and annoying advertisers. nine0003

WhatsApp security issues

In May 2019, hackers discovered that it was possible to infect users' phones with spyware by calling potential victims via WhatsApp. And although the developers of the messenger quickly fixed the software error, the personal data of a certain number of users still "leaked" to the network.

What's more, WhatsApp collects and stores information about all your online activity through the app. And although the WhatsApp management verbally denies its politicization and the possibility of interacting with the authorities of different countries, there are several facts confirming that the popular messenger transferred user data to the secret services at their request. nine0003

How can WhatsApp users protect themselves?

To protect your phone and keep personal information private from prying eyes, we recommend using a virtual private network (VPN).

VPN is based on technology that allows you to anonymously access your favorite sites or use your favorite applications from virtual IP addresses, bypassing the server of your Internet provider.

Such a mechanism for accessing the Internet excludes the theft of personal data by any of the methods available today. All Internet traffic is securely encrypted and transmitted through a secure tunnel to one of the VPN provider's remote servers located in different parts of the world. You can change your virtual location by choosing a different access server, moving from, say, Russia to Malaysia in a second. Attackers simply will not keep up with tracking your activity! nine0003

Most VPN service providers allow users to evaluate the capabilities of their services and test one of the VPN applications for Android or iOS for free before deciding to purchase a permanent subscription.

Among other things, it is recommended that you keep your smartphone app and software (OS) up to date, make the most of your WhatsApp privacy settings and, if possible, never share valuable content with unfamiliar users. nine0003

Why WhatsApp will never be secure / Sudo Null IT News

Columnist Pavel Durov, founder of the Telegram messenger

The world seems shocked by the news that WhatsApp has turned any phone into a tracking device. Everything on your phone, including photos, emails and texts, was accessible to attackers just because you have WhatsApp installed.

However, this news did not surprise me. Last year, WhatsApp had to admit to a very similar problem - a hacker could access all of your phone's data through a single video call. nine0053
Every time WhatsApp fixes a critical vulnerability in its app, a new one appears in its place. All security issues are well suited for surveillance, they look and work like backdoors.

Unlike Telegram, WhatsApp does not open source, so security researchers cannot easily check for backdoors. WhatsApp not only does not publish the code, they do the exact opposite: WhatsApp deliberately obfuscates the binaries of their applications so that no one can carefully examine them. nine0003

Perhaps WhatsApp and its parent company Facebook are even required to implement backdoors - through secret processes such as secret orders from the FBI. It's not easy to run a secure messenger while in the US. During the week our team spent in the United States in 2016, FBI agents tried to infiltrate us three times. Imagine what will happen to an American company in 10 years of operating in such an environment.

I understand that the law enforcement agencies justify installing backdoors as an anti-terrorist effort. The problem is that such backdoors can also be used by criminals and authoritarian governments. No wonder dictators seem to love WhatsApp. The lack of security allows them to spy on their citizens, which is why WhatsApp is not blocked in countries like Russia or Iran, where Telegram is banned by the authorities. nine0003

In fact, my work on Telegram was a direct response to personal pressure from the Russian authorities. Then, in 2012, WhatsApp was still transmitting messages in clear text. This is madness. Not only governments or hackers, but also mobile providers and WiFi administrators had access to all WhatsApp texts.

WhatsApp later added some encryption, which quickly turned out to be a marketing gimmick: the decryption key was available to at least a few governments, including Russia. Then, as Telegram began to gain popularity, the founders of WhatsApp sold their company to Facebook and said they had “privacy built into their DNA.” If this is true, then this is probably a dormant or recessive gene. nine0003

Three years ago, WhatsApp announced that they had implemented end-to-end encryption so "no third party can access messages." This coincided with an aggressive call for all users to back up their chats to the cloud. However, WhatsApp did not tell users that, when backed up, messages are no longer end-to-end encrypted and could be accessed by hackers and law enforcement. Brilliant marketing that has resulted in some naive people now serving prison terms. nine0003

Those who didn't fall for the constant pop-ups advising to back up their chats can still be tracked down with a number of tricks, from accessing contacts backups to subtle changes to the encryption key. WhatsApp user-generated metadata — logs describing who is talking to whom and when — is leaked to all agencies in large volumes through the parent company. In addition, you get a set of critical vulnerabilities that replace each other. nine0003

WhatsApp has a stable and consistent history, from zero encryption at creation to current vulnerabilities oddly suited for surveillance purposes. Looking back, there has not been a single day in their ten year history when this service was secure. That's why I don't think just updating the WhatsApp mobile app will make it secure. To become a privacy-focused service, WhatsApp must risk losing entire markets and clash with authorities in its own country. They don't seem ready for this. nine0003

The founders of WhatsApp left the company last year due to privacy concerns. They are definitely bound either by secret orders or by the NDA, so they cannot publicly discuss backdoors without risking losing their fortune and freedom. However, they were able to admit that they "sold the privacy of their users."

I can understand the reluctance of the WhatsApp founders to provide more details - it's not easy to compromise your comfort. Several years ago, I had to leave my country after refusing to comply with government-sanctioned violations of the privacy of VKontakte users. It was unpleasant. But will I do something like this again? With pleasure. Each of us will die sooner or later, but we, as a species, will stay here for a while. That is why I think that the accumulation of money, fame or power does not matter. Serving humanity is the only thing that really matters in the long run. nine0003

And yet, despite our intentions, I feel like we have failed humanity in this whole WhatsApp spy story. Many people can't stop using WhatsApp because their friends and family are still there. This means that we at Telegram have done a poor job of convincing people to switch. Although we have attracted hundreds of millions of users over the past five years, this has not been enough. Most internet users are still held hostage by the Facebook/WhatsApp/Instagram empire. Many of those who use Telegram are also on WhatsApp, meaning their phones are still vulnerable. Even those who have completely given up on WhatsApp are probably using Facebook or Instagram, both of which think it's okay to store your passwords in cleartext (I still can't believe a tech company is capable of doing something like this and quit dry from water). nine0003

In nearly six years of its existence, Telegram has not experienced the major data breaches or security flaws that WhatsApp shows every few months. In the same six years, we have disclosed exactly zero bytes of data to third parties, while Facebook/WhatsApp shares any information with almost anyone who claims to work for the government.

Few people outside of the Telegram fan community realize that most of the new messaging features first appear on Telegram and then copied by WhatsApp down to the smallest detail. More recently, we witnessed Facebook's attempt to borrow the entire philosophy of Telegram, with Zuckerberg suddenly stating the importance of privacy and speed, quoting the description of the Telegram app almost word for word in his F8 speech. nine0003

But whining about FB's hypocrisy and lack of creativity won't help. We have to admit that Facebook is executing an effective strategy. Look what they've done with Snapchat.

We at Telegram must acknowledge our responsibility in shaping the future. It's either us or the Facebook monopoly. Either freedom and privacy, or greed and hypocrisy. Our team has been competing with Facebook for the past 13 years. We already beat them once, in the Eastern European social media market. We will beat them again in the global messaging market. We have to. nine0003

It won't be easy. The Facebook marketing department is huge. And we at Telegram do not do marketing. We don't want to pay journalists and researchers to tell the world about Telegram. To do this, we rely on you - our millions of users. If you like Telegram enough, you will tell your friends about it. And if every Telegram user persuades three of their friends to delete WhatsApp and use Telegram permanently, then Telegram will already become more popular than WhatsApp.