2

I realize WhatsApp has end-to-end encryption.

But, can WhatsApp see certain metadata, such as the following?

  • With whom I send & receive messages
  • How many messages I send & receive
  • When I send & receive messages
4
  • 1
    Look at who owns WhatsApp and you will find your answer. – SDsolar Mar 23 '17 at 19:53
  • @SDsolar That's enough to want to ask the question, but not enough to be an answer. For example, WhatsApp cannot read the messages you send, even though it would be in Facebook's advertising interest for them to do so. – cloudfeet Mar 24 '17 at 11:52
  • A few years ago some roommates of mine found out how to hack individuals' WhatsApp accounts quite easily by stealing the login token over a local network... Not the worst thing in the world, but I wouldn't send anything too sensitive. – Aaron Mar 24 '17 at 13:35
  • I'd check this out: twit.tv/shows/security-now/episodes/555 Somewhere in the last 30-45 minutes Steve talks about the breakdown to a degree. It's closed source so no-one can really tell you what is or isn't happening. – Andrew Mar 24 '17 at 13:59
2

AFAIK, WhatsApp is closed source. And the data passes through their servers. And they have control on the keys used for encryption (because it is closed source). So on a security point of view, you should assume that they can read the content of the messages.

Whether they do it or no is a different question, but if privacy is important, you should not rely on WhatsApp.

Now to answer your precise questions:

can WhatsApp see with whom I send & receive messages

Of course they can. How could the know where to forward the messages?

can WhatsApp see how many messages I send & receive

Of course they can. I assume they have technical logs that should contain sender and recipient for each message. Such logs are required for the administration of a platform

can WhatsApp see when I send & receive messages

Of course they can, for the very same reason as for your first question

7
  • WhatsApp licenses the Open Whisper protocol for end-to-end encryption. This means that although the data passes through their servers, it is encrypted (by a private key that WhatsApp do not know). – cloudfeet Mar 24 '17 at 11:55
  • 1
    If you are concerned that they might not be following the encryption scheme they claim, that is an issue. But saying "they have control of the keys used for encryption" makes it sound like their protocol is designed that way. – cloudfeet Mar 24 '17 at 12:19
  • 1
    @cloudfeet WhatsApp supposedly does share data with Facebook for targeted advertising. I would not put it above FB to simply check messages for keywords before they're sent to the intended receiver. Safe in transit, but not safe from Zuckerberg. – S.L. Barth Mar 24 '17 at 12:24
  • @S.L.Barth Extracting and sharing keywords would definitely count as "not following the encryption scheme they claim", yeah. AFAIU, the data being shared with Facebook is phone number and usage patterns - exactly the kind of data this question was about, because it is exposed even with E2E. :) – cloudfeet Mar 24 '17 at 12:33
  • 2
    But yeah - at a certain point, the only protection we have is "they promised to use E2E", and relying on the idea that if they get caught doing something different (e.g. by dissassembly and network traffic inspection) that there will be actual consequences. Although, I think just the accusation would be enough to drive people away - there was that completely overblown "security flaw" in January 2017 that caused people to move to less-secure options like Telegram. – cloudfeet Mar 24 '17 at 13:16
1
  1. Yes, or it wouldn't be able to send messages. 2+3. If the data is logged yes.
1

Yes.

Sending a message via a routing service always requires some routing data to be readable by that service. To send a message on WhatsApp, you send it to their servers, which places your message in a queue for the recipient to fetch - which requires you to tell the servers which queue/inbox to use.

There are techniques to conceal routing information and traffic patterns, mainly based around mix networks. However, the protections of such networks rely on having multiple layers of routing which are not co-operating with each other (so no single organisation can meaningfully operate one of these on their own). Networks such as Tor rely on helpful people running their own servers to join in, because as long as your route through the mix network crosses one non-cooperating server you should be OK.

1
  • 1
    As Serge Ballesta noted, because WhatsApp is closed-source, their promise of end-to-end encryption cannot be checked using a code review + reproducible build process. However, you can also perform reviews by disassembly/debug and inspecting the network traffic, which are standard techniques. Given that WhatsApp breaking their E2E promise would be a name-making result for a security researcher, I personally think I would have heard about it, even though I lack the skill and particular motivation to do it myself. – cloudfeet Mar 24 '17 at 12:28
-1

While Whatsapp itself can naturally see to who you write messages to (because you send it over their server) and keep track about your social contacts, I understand your question more like:

"could one generally see my message partners and texts"

The answer is: YES THEY CAN

If you have, for example, a managed code rootkit on your phone, the person controlling it can see your display for example, or read your keys, and with this ability, they can see who you are texting.

Managed code rootkits will become more and more important in the days where a whole operating system like Android is written completely in Java, and such a rootkit would hook into the runtime environment, to speak clear the sandbox. I realise this is a bit off-topic, but the technology to do so is surprisingly straightforward and not so much what I would call "Black magic"

With such a technique there is no need for any encryption since information is gathered BEFORE it is encrypted.

3
  • Only the UI for Android is written in Java, the rest is C/C++ (Source: Wikipedia). – S.L. Barth Mar 24 '17 at 12:39
  • thanks for clearing this out @S.L.Barth. I believe the danger of someone hooking into your runtime is still given tho – clockw0rk Mar 24 '17 at 15:47
  • 1
    The question is about WhatsApp, not the general public. And your strawman of the general public is defeated when you start talking about the need for rootkits. That changes your strawman question to: "can malicious actors see who I'm texting on WhatsApp?" and then you open up the scope to far more than just rootkits. And you still miss the question. – schroeder Mar 24 '17 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.