WhatsApp’s “End-to-End Encryption” Isn’t What You Think

WhatsApp proudly advertises its end-to-end encryption (E2EE) as a guarantee that only you and the person you’re communicating with can read your messages. However, the reality is more nuanced.

1. Metadata Exposure
While message content is encrypted, WhatsApp collects metadata—information about who you communicate with, when, and how often. This data can be shared with parent company Meta and, upon request, with law enforcement agencies.

2. Vulnerabilities in Group Chats
Recent research has highlighted weaknesses in WhatsApp’s group messaging system. The platform lacks cryptographic management for group messages, allowing potential attackers to add unauthorized members to group chats without proper verification.

3. Prekey Depletion Attacks
A study titled “Prekey Pogo” revealed that WhatsApp’s implementation of the Signal protocol is susceptible to prekey depletion attacks. Such attacks can degrade the security of future messages, compromising the intended forward secrecy of E2EE.

4. Message Flagging and Content Review
If a user flags a message, WhatsApp can access its content to assess potential violations. This process involves decrypting the message, which contradicts the notion of absolute end-to-end encryption.

5. Backup Vulnerabilities
WhatsApp offers encrypted backups, but users must opt-in for this feature. Unencrypted backups stored on cloud services like Google Drive or iCloud are susceptible to access by third parties, including the service providers themselves.

6. Exploitation by Spyware
In 2019, the Pegasus spyware exploited a vulnerability in WhatsApp, allowing attackers to install surveillance software on users’ devices. This incident underscores that vulnerabilities can exist, enabling unauthorized access despite encryption claims.

7. Data Recovery Possibilities
Deleted WhatsApp messages can sometimes be recovered through backups or third-party software, challenging the perception that once a message is deleted, it’s gone forever.

⸻

#OpLog Day 7
URL: oplog.isalman.dev
Repo: github.com/hotheadhacker/akkoma-blog