The WhatsApp QR auth for web.whatsapp.com interests me.

Does anybody have any insight to the actual security model employed and any comments of possible attacks on it?

  • The QR code shown is just a random code. Your phone scans it and then the session will be "claimed" by your phone. WhatsApp will then push all your conversations to the session. Security wise I guess it would be possible to hijack a session, but am not sure how one would do that. – Oldskool Sep 22 '16 at 11:58
  • I'm thinking about a potential implementation and some of the possible attack vectors rather than trying to attack WhatsApp per se. It would seem to me that storing some secret on the phone would be an obvious weakness. I assume that the QR secure random (for a particular auth session) is somehow combined with phone secret which is then validated by the auth server. I wonder how WhatsApp protects acquiring the secret to effect some spoofing. – MarcP Sep 22 '16 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.