Does anyone know if an employer can access whatsapp messages if you are using their servers? Whatsapp apparently say the messages are encrypted, but I'm not sure about this.
The following research paper describes four attacks on WhatsApp. I don't know whether they have been fixed.
Impersonation attack. One attack allows an attacker to impersonate someone else. In particular, if the attacker has a particular phone number in mind (the victim's phone number), the attacker can register himself for that phone number and receive all WhatsApp messages that might have been intended for that phone number. See Section 5.2 of the paper.
This may be relevant to you.
SMS spam attack. A second attack allows an attacker to send arbitrary text messages to anyone around the world, for free, from the WhatsApp servers. See Section 5.4 of the paper.
Phone number enumeration attack. A third attack allows an attacker to enumerate the phone numbers of other WhatsApp users and identify the operating system they are using. See Section 5.5 of the paper.
Status message forgery attack. A fourth attack allows an attacker to change any other WhatsApp user's status message to anything of the attacker's choice. See Section 5.6 of the paper.
Implications. None of these directly address the particular question you asked. However, these vulnerabilities diminish my confidence in the security of WhatsApp.
The vulnerabilities described in the paper are extremely basic and elementary flaws. We're talking facepalm territory. The flaws include, for instance, a complete lack of access control or authentication; as well as inappropriate trust in the client. (Basically, OWASP A3, A8, and A9 violations.) Of course, anyone can make mistakes, but these are such basic mistakes that they make me wonder what other mistakes the WhatsApp developers may have made, and what is wrong with WhatsApp's security review process that these slipped through into deployment.
So, based upon this analysis, I would be reluctant to rely too heavily upon the security of WhatsApp.
This article regards Whatsapp's encryption to be too weak and the company's handling of security issues to be lacking:
This article says sender authentication is now more robust, but privacy concerns persist:
WhatsApp is a fairly popular messaging system according to the media:
It supports encryption and although having a number of security incidents, I would expect the security to be high and incidents similar to those above to be transient and managed by the company.
There is one special case when your messages might be at risk. That is if your phone or computer on which you are using WhatsApp is being administered by your employer. So if you have a smartphone provided by your employer, then your messages might be intercepted.
In conclusion, I think Whatsapp's message privacy is trustworthy. You should worry more about the security of your phone. Android smartphone are particularly not kept up-to-date with patches.
This is an interesting question as it was the topic of conversation I had last night. A friend related to me that where they work was an incident where a few members of staff had a group whatsapp, which generally they used at home, however they started to use it even at work and some of the conversations included gripes about management etc. My friend who was a senior supervisor had warned these person not to use it at work. A management meeting was called last month and what do you think the topic was? The manager was making them aware of a a situation that had arisen due to the presence of copies of chats that had been saved to the company server during automatic back-up and while doing a random security spot check, copies of various chats from this group was found. To cut a long story short, all the members of the group were called in and given enough rope to hang themselves with and got fired when the evidence was produced. It seems that if you use the company's wifi all information you send is routed through the company's server therefore what ever you send out is cataloged and saved on the server when it backs up at the end of the day. So no unless you are using your own data connection plan and disable wifi. Anything you send at work can end up as public fodder on your company's server. So be warned