Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does anyone know if an employer can access whatsapp messages if you are using their servers? Whatsapp apparently say the messages are encrypted, but I'm not sure about this.

share|improve this question
Secure against an employer - perhaps. Secure - certainly not. That'd need end-to-end encryption. –  CodesInChaos Jan 12 '13 at 11:29

5 Answers 5

The following research paper describes four attacks on WhatsApp. I don't know whether they have been fixed.

Impersonation attack. One attack allows an attacker to impersonate someone else. In particular, if the attacker has a particular phone number in mind (the victim's phone number), the attacker can register himself for that phone number and receive all WhatsApp messages that might have been intended for that phone number. See Section 5.2 of the paper.

This may be relevant to you.

SMS spam attack. A second attack allows an attacker to send arbitrary text messages to anyone around the world, for free, from the WhatsApp servers. See Section 5.4 of the paper.

Phone number enumeration attack. A third attack allows an attacker to enumerate the phone numbers of other WhatsApp users and identify the operating system they are using. See Section 5.5 of the paper.

Status message forgery attack. A fourth attack allows an attacker to change any other WhatsApp user's status message to anything of the attacker's choice. See Section 5.6 of the paper.

Implications. None of these directly address the particular question you asked. However, these vulnerabilities diminish my confidence in the security of WhatsApp.

The vulnerabilities described in the paper are extremely basic and elementary flaws. We're talking facepalm territory. The flaws include, for instance, a complete lack of access control or authentication; as well as inappropriate trust in the client. (Basically, OWASP A3, A8, and A9 violations.) Of course, anyone can make mistakes, but these are such basic mistakes that they make me wonder what other mistakes the WhatsApp developers may have made, and what is wrong with WhatsApp's security review process that these slipped through into deployment.

So, based upon this analysis, I would be reluctant to rely too heavily upon the security of WhatsApp.

share|improve this answer

This article regards Whatsapp's encryption to be too weak and the company's handling of security issues to be lacking:


This article says sender authentication is now more robust, but privacy concerns persist:


share|improve this answer

WhatsApp is a fairly popular messaging system according to the media:

WhatsApp handles ten billion messages per day as of August 2012

Financial Times: WhatsApp "has done to SMS on mobile phones what Skype did to international calling on landlines.

It supports encryption and although having a number of security incidents, I would expect the security to be high and incidents similar to those above to be transient and managed by the company.

There is one special case when your messages might be at risk. That is if your phone or computer on which you are using WhatsApp is being administered by your employer. So if you have a smartphone provided by your employer, then your messages might be intercepted.

In conclusion, I think Whatsapp's message privacy is trustworthy. You should worry more about the security of your phone. Android smartphone are particularly not kept up-to-date with patches.

share|improve this answer
Thanks Christian does the encryption apply to photos too or just text? –  secunda Jan 12 '13 at 9:40
The content of the message (text, photos, other media) is passed through an encrypted channel. –  Cristian Dobre Jan 12 '13 at 11:26

This is an interesting question as it was the topic of conversation I had last night. A friend related to me that where they work was an incident where a few members of staff had a group whatsapp, which generally they used at home, however they started to use it even at work and some of the conversations included gripes about management etc. My friend who was a senior supervisor had warned these person not to use it at work. A management meeting was called last month and what do you think the topic was? The manager was making them aware of a a situation that had arisen due to the presence of copies of chats that had been saved to the company server during automatic back-up and while doing a random security spot check, copies of various chats from this group was found. To cut a long story short, all the members of the group were called in and given enough rope to hang themselves with and got fired when the evidence was produced. It seems that if you use the company's wifi all information you send is routed through the company's server therefore what ever you send out is cataloged and saved on the server when it backs up at the end of the day. So no unless you are using your own data connection plan and disable wifi. Anything you send at work can end up as public fodder on your company's server. So be warned

share|improve this answer

They are encrypted now, since summer more or less. You can do a simple check connecting your smartphone to the wifi and send a message while either you are sniffing in your own mobile (shark for android) or sniffing from other device (mitm)

share|improve this answer
Just saying "encrypted" is pretty meaningless without saying how. –  CodesInChaos Jan 12 '13 at 8:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.