0

I realize that MAC addresses are only used to tell different devices apart if they are on the same local network. So, what if they're not? Is MAC spoofing in Whatsapp still possible? Even if the perpetrator obtained the confirmation code from my phone, would it be possible, to unverify my account in the process?

And what if they also tried spoofing the IP address? Would it eventually unverify the account on one of the devices once the IP address on either one of them changed and Whatsapp noticed there were two verified instances of one account at the same time?

Improve this question
2
  • I believe you might be misunderstanding the role MAC addresses play and how it might relate to a application such as WhatsApp. WhatsApp does not verify users by MAC address, but by “higher” layers such as username and password. Taking a look at TCP/IP model might help
    – pm1391
    Commented Aug 14, 2018 at 2:41
  • 3
    ... I have no idea what you're trying to ask. whatsapp is based on the signal protocol which I thought derived its security from public-key cryptography and not IPs or MAC addresses. Can you provide some background links to explain how you arrived at this conclusion?
    – Mike Ounsworth
    Commented Aug 14, 2018 at 2:42

1 Answer 1

Reset to default
3

I have no idea where you got your information, but let's start at the very beginning citing reputable sources as we go.

This youtube video shows the process for enrolling a new device in WhatsApp. Since WhatsApp is built on the same cryptography as the Signal app -- called the Signal Protocol (source), let's assume they do the same stuff inside (Signal is open source while WhatsApp is owned by Facebook, so easier to know what's going on in Signal).

Enrollment Steps:

  1. Provide your mobile phone number.
  2. The server sends you an SMS with a one-time activation code.
  3. The device creates a cryptographic public key.
  4. The server registers this public key against your phone number in a big database.

You are now enrolled. When your friend wants to send you an encrypted message, they ask the server for the public key(s) registered to your phone number, and they can start encrypting for you.

I've never used WhatsApp, but Signal lets you link as many devices as you want to your phone number. But there is a menu to unlink devices.

Nowhere in there does it use your IP or MAC addresses, so whichever friend told you that is probably not a reliable source for tech info.

It does however assume that you are the only person who can receive SMSes at your phone number, so if you lose your SIM card, or are paranoid about nation-states, then it's possible for someone to register a second device under your phone number, and then (if it works the same as Signal) unlink your first device. So don't lose your SIM card.

Improve this answer
16
  • So, from what I understand, Whatsapp uses your mobile phone number and the confirmation code they send you via SMS as some sort of "login details", right? Because they suspect only you, the owner of the phone number, can receive the SMS verification code. That's reasonable. However, if Whatsapp doesn't allow the account to be logged in on more than one device at a time, does that mean that my account on my device would instantly become unverified (unavailable) the same moment they verified it on their phone? This would mean that having two verified accounts at a time should be impossible.
    – Jean Dieu
    Commented Aug 14, 2018 at 3:58
  • To add to this, how does exactly Signal know how many devices are linked to your account? It surely must use something to tell devices apart, otherwise you wouldn't be able to unlink them.
    – Jean Dieu
    Commented Aug 14, 2018 at 4:07
  • I've never used WhatsApp, so I'm going off my experience with Signal. You don't really "log in" -- there's no username or password. Instead, each device registers a cryptographic public key with the main WhatsApp / Signal sever. (think of this like a phone book of signal "email addresses" registered to your phone number). There is no problem registering multiple public keys (ie multiple devices) for one phone number. When someone wants to encrypt for you, they ask the server for all your public keys and encrypt a copy of the message for each one.
    – Mike Ounsworth
    Commented Aug 14, 2018 at 12:06
  • Unlinking a device is simple: you just remove that public key from the list associated with your phone number on the server. The next time someone sends you a message, they will no longer encrypt a copy for that public key / device. That device will see that there are new massages, but won't be able to decrypt them. (this is simplified, I'm sure the actual signal protocol has more moving pieces, but that's the part relevant to your question)
    – Mike Ounsworth
    Commented Aug 14, 2018 at 12:09
  • "There is no problem registering multiple public keys (ie multiple devices) for one phone number." But Whatsapp clearly states that this is in fact not possible. Source: faq.whatsapp.com/en/android/21009863/?category=5245245 Perhaps, if they tried to register a public key for their device, my key would be removed from the database, i.e. the key I have on my phone wouldn't match the key they store on their server and I would be notified that my account on my device is unverified, while theirs would become verified in the proccess.
    – Jean Dieu
    Commented Aug 15, 2018 at 22:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .