Whatsapp is adding passwords: what is the threat model that they want to protect their users from?

Question

Whatsapp has announced that they are introducing 2FA to their service. Normally, services rely on a password (what you know), and adding 2FA means that they require an additional code sent via SMS to your phone (what you have), but until now Whatsapp has always used the code sent via SMS and no password, so in their case adding 2FA means adding the password. I am trying to understand why, exactly, this should be useful.

In the common scenario (a service that requires a password, like an email provider), if some hackers violate the site and access the user database, they can crack the password hashes and access users' accounts. Adding 2FA prevents this scenario, because even if they can find your password they still need your phone. So far so good. But in Whatsapp's case, what is the advantage?

Until now, those who wanted to access your account needed to steal your phone (and the code to unlock the screen), then they could do everything (including moving the account to another phone, or changing the associated phone number). Now, instead, they'd also need the password. But who would ever want to do this? Normally one who wants to access someone else's Whatsapp account is for example a jealous wife that wants to check whether her husband is cheating on her. If she can use her husband's phone, unlocked, it means she can read every message, and adding the password doesn't prevent her from doing it, so this is not the scenario that they want to prevent. If Whatsapp supported using the same account on more than one device, the jealous wife could briefly take his phone, get the code sent vis SMS, and configure her husband's Whatsapp account on another phone, unbeknownst to him; then she could keep spying on him even when he is away, for example on an alleged "business trip" (maybe he is careful enough to delete all the compromising messages before he comes back, so this trick could let her discover the truth). Here, the password would prevent her from doing it... But Whatsapp doesn't support using the same account on more than one device, so it doesn't matter.

Any attempt to move the account to another phone, or to change the associated number, doesn't make much sense either, as these attacks can't be kept secret: the victims would immediately notice that the account on their phone doesn't work anymore and take some countermeasures, like creating a new one and informing everyone to stop writing to the old one. Quickly, the stolen account would become useless. A password would prevent this, ok, but I don't think this is an important scenario.

Another case where the password could make sense is if the attacker is a skilled one who can intercept the SMS code used as verification. Again, this would make it possible to steal the account, but since Whatsapp doesn't support multiple devices, the victim would immediately notice that the account on his phone has stopped working, and again the attack would be almost useless.

The FAQ says that "To help you remember your passcode, WhatsApp will periodically ask you to enter your passcode." This would help those who don't lock the screen, but if a user doesn't care about locking the screen, why would he enable 2FA then? And the developers even admit that this periodical asking for the code is to help you remember it, not to increase the security.

The most plausible scenario I can think of is: a criminal gang that can intercept SMS messages from all over the world (!!!) steals accounts, moving them to another phone, and then sends the legitimate user an SMS saying "If you want your account back, send us some bitcoins". A password would prevent this, ok. But, seriously, should we worry about this?

So what is a realistic use case in which someone actually benefits from adding the password?

Answer 1

They want to protect their users from a very real attack that was already successfully used against some Telegram users (those who didn't choose to use a password) in the wild. (Telegram is a similar service which also uses SMS for login)

The attack was done by a government or mobile network service provider and it's simple: they try to login into the service (Telegram in that case), pretend to be user with the victim's phone number and intercept the SMS sent to that number (because they obviously can intercept SMS). Now attacker can successfully log in to the service as the victim.

Link to the details on a performed real life attack (beware, it's in Russian)
For some reason it was thought that governments and mobile service providers can be trusted to not do these things, but now we have clear evidence that this is not the case.

Also, SMS are not transmitted securely, so actually anybody can intercept them if they have the right equipment and they are in the right place in the right time. This is a bit harder than just reading SMS when you have control over Mobile Network Service Provider, but it's still very doable. More info here (again, in Russian)

tl;dr SMS is very insecure channel, so relying only on SMS for delivering private information is indeed pretty bad

Answer 2

This would mitigate carrier breaches, rogue employees, law enforcement, etc. Mobile carriers have complete control over the user's texts, and can easily take over a Whatsapp account by trying to set up the account on another phone and intercepting the verification text. An additional authentication factor the carrier can't get access to (like e-mail or a password) prevents this.

Answer 3

Any attempt to move the account to another phone, or to change the associated number, doesn't make much sense either, as these attacks can't be kept secret: the victims would immediately notice that the account on their phone doesn't work anymore and take some countermeasures, like creating a new one and informing everyone to stop writing to the old one.

Even if the victim immediately notices and can react, it is still a security breach and requires action from the victim to get back its account or block it and create a new one. It's like saying: my car has a GPS I can track, so if it is stolen I can always get it back. Why lock it in the first place?

A password as a second authentication factor is a simple way to prevent this in the first place. It's not as important as, say, number verification or end-to-end encryption, which is probably why it's only being implemented now. Either way, it increases the security of your account, which begs the question: why not?

Answer 4

I'll answer on only one part to keep it brief:

Quickly, the stolen account would become useless. A password would prevent this, ok, but I don't think this is an important scenario.

You're forgetting getting access to the account allow to send message which will seems coming from the user, hence there's a real risk of compromising the user reputation by sending whatever message/picture to this user contact book.
think of any political account sending something going against their position, this could turn viral enough to discredit someone position in a political election for example.

The fact this doesn't seem important to YOU doesn't mean it is not important at all. You think about it as getting access to messages sent to the stolen account and not tihnking it can be used to send messages in behalf of the user.
Moreover WhatsApp could be liable on the consequences if they're not providing a way to their users to prevent that with the best possible security.