Back in early 2016, WhatsApp introduced end-to-end encryption for WhatsApp chats. However, a new report claims that the group chats in WhatsApp can be easily infiltrated. A group of German cryptographers have discovered flaws in WhatsApp’s encryption that makes this possible.
The cryptographers from Ruhr University Bochum in Germany announced this at the “Real World Crypto Security Conference in Zurich, Switzerland on the 10th of January. The report from Wired says:
Anyone who controls the app’s servers could insert new people into private group chats without needing admin permission. The confidentiality of the group is compromised as soon as the uninvited member can obtain all the new messages and read them.
End-to-end encryption is a secure method of communication where only the people communicating can access messages sent. Cyber-criminals and hackers, telecoms and Internet providers or governments cannot read these communications. Even the company that built and runs the service cannot access messages, and hence cannot easily cooperate with authorities who request these exchanges.
According to the researchers, only an administrator of a WhatsApp group can invite new members, but WhatsApp doesn’t use any authentication mechanism for that invitation that its own servers can’t spoof. This basically means that a server can add any new member to the group without any interaction with the administrator.
Once this happens, the phone of every participant in the group then automatically shares secret keys with that new member, giving him or her full access to any future messages.
A WhatsApp spokesperson confirmed the findings, however, added that “no one can secretly add a new member to a group and a notification does go through that a new, unknown member has joined the group.”
WhatsApp is now expected to give more power to group administrators in the aftermath of these findings. In the coming days, administrators will be able to block any or all group members from sending any kind of text message, voice message or media files.
At this very moment, the largest debate in the world is around Whatsapp and their brand new End to End Encryption.
With the Apple vs. FBI debacle just barely out the door, a new threat to “National Security” of many governments is the encryption of messages on the world’s largest messaging app. This app which daily carries personal data of nearly a billion users has just pushed a major upgrade that will encrypt the messages, files, images, videos, etc. of each chat from a point of origin to a point of receiving.
How does it work?
If both users of a Whatsapp message (i.e. the sender and recipient) have updated to the latest update, then their message is encrypted with a 256-bit algorithm. Which in turn means that, apart from the sender and the recipient of said message, no one will know what message was sent, including WhatsApp.
WhatsApp uses what’s called public key encryption: To send a message to User B, User A asks a WhatsApp server for a public key that applies to User B. User A then uses the public key to encrypt the message. User B’s private key—only available on User B’s phone—decrypts the message.
Image via Wired
The encryption method is so diverse the service will encrypt all messages, phone calls, photos, and videos moving among them. And that’s true on any phone that runs the app, from iPhones to Android phones to Windows phones to old school flip phones.
To get more information on how this works you can download WhatsApp’s Whitepaper here.
Why Did it Happen?
Jan Koum, WhatsApps founder, was one of the first to voice support for Apple in the Apple vs. FBI debate. The company has been encrypting some of the information on the messages since 2013.
Facebook, which is WhatsApp’s parent company, is also trying to implement encryption in their messaging systems, and with WhatsApp’s encryption out the door, this may happen sooner than later.But, why is all of this important for us as users? The answer to this question lies within our thought processes. After the biggest information leak by Edward Snowden, it has become apparent that governments have become careless in combating terrorism. To the point where they are breaking the fundamentals of privacy and collecting data on each of their citizens, breachings the basics of the law systems set in many countries.
We’ve been working for the past two years to give people better security over their conversations on WhatsApp… People deserve security. It makes it possible for us to connect with our loved ones. It gives us the confidence to speak our minds. It allows us to communicate sensitive information with colleagues, friends, and others. We’re glad to do our part in keeping people’s information out of the hands of hackers and cyber-criminals. – Said Jan Koum
But, why is all of this important for us as users?
The answer to this question lies within our thought processes. After the biggest information leak by Edward Snowden, it has become apparent that governments have started collecting personal analogue and digital data, which is an equivalent of hundreds and thousands of email, calls, personal images, videos, and messages.
Snooping in on private moments has been the biggest conversation of the past few years. With WhatsApp adding a no backdoor system the data on the service becomes completely private. No requests by the governments will be entertained, and WhatsApp has made that loudly clear.
This will ensure privacy to a billion users of the largest messaging application in the world. Which means no matter what moment you share on this app with the latest update, you can be assured no one is snooping in on it.
But it is not only the governments that this information encryption is trying to prevent. Hundreds of hackers and cyber-thieves are constantly on the lookout for an easy payday. This encryption will protect sensitive data from being easily taken and used against you. This also prevents identity theft and many other cyber crimes that one may have become a victim to in the past.
What About the Security Risk?
Many Governments and security agencies will debate, that this will help terrorists communicate easier, and security will mostly be broken. In pushing back against end-to-end encryption, the US government argues that it’s merely trying to maintain the status quo—that it has long had the power to issue a warrant for communications data.
With no backdoor, WhatsApp data will not be decrypted; no information apart from timestamps and metadata of when the messages were sent and possibly who they were sent to will be available to the app makers themselves.
Encryption is one of the most important tools governments, companies, and individuals have to promote safety and security in the new digital age. Recently there has been a lot of discussion about encrypted services and the work of law enforcement. While we recognize the important work of law enforcement in keeping people safe, efforts to weaken encryption risk exposing people’s information to abuse from cybercriminals, hackers, and rogue states. – WhatsApp
For the time being it seems that the free world citizens are winning the battle over privacy. But the security agencies and governments are not ones to sit back and watch quietly. For one there remains a significant vulnerability for privacy-concerned people using WhatsApp to communicate. The metadata about communications is not secret. The government, could, for example, demand to know from Facebook/WhatsApp with whom a particular user communicated, when he or she did so, and how frequently. They may even be able to tell where the parties to a conversation were located when the conversation took place.
The metadata and timestamps about communications are not secret. The governments could demand to know from Facebook/WhatsApp with whom a particular user communicated, when he or she did so, and how frequently. They may even be able to tell where the parties to a conversation were located when the conversation took place.
