Someone sends me a link. Whatsapp shows its preview. How can they do that despite being E2E encrypted?

  • 4
    The link gets decrypted at some point of time (that's why you're able to view it). And maybe it's not WhatsApp that actually "shows" you the preview, maybe WhatsApp just gives the link to the OS and asks the OS to give you a preview. – pri Oct 27 '20 at 11:33
  • 2
    What has the preview to do with E2E encryption? WhatsApp can locally create a preview, save it as image or similar and then send this image with E2E encrypted, similar to how user provided images or text messages are send. – Steffen Ullrich Oct 27 '20 at 14:51
  • 2
    You appear to be assuming that the WhatsApp server sends the preview and not your local client. – schroeder Oct 27 '20 at 16:44
  • @pri if OS gets the link from Whatsapp then OS has the info that this user is viewing this link? Someone from my circle told that he got a link from her mom about a clothing item. Just after that she saw google ads. showing that ad to her on her phone! – user263210 Oct 28 '20 at 12:53
  • pri, Steffen & schroeder. Just a newbie trying to learn ho privacy is ensured. Please refer to some good resource if you can. The keyboard from google, etc. has all the what is being typed. Our passwords, CC details. Lets assume Google is a well known, law abiding citizen, but there are tones of 3rd party keyboards, launchers and apps on playstore which are used in other apps, like plugins. Does OS make sure that these apps don't leak user data to their servers? Or there is only law that stops them to do so? Interested in tech stuff. Thanks – user263210 Oct 28 '20 at 12:59

WhatsApp client makes http request to the site as the sender types in, in order to fetch site meta properties.

<meta property="og:title" content="Information Security Stack Exchange">
<meta property="og:description" content="Q&A by infosec enthusiasts">
<meta property="og:image" content="https://cdn.sstatic.net/Sites/security/Img/logo.svg?v=f9d04c44487b">
<meta property="og:url" content="https://security.stackexchange.com">

Link preview requires sender to be online and the message is yet to be sent. WhatsApp client makes http request for any text that matches with the regular expression of the URL.

Once metadata is retrieved, it is sent as message. The problem with this design is that if there's a query string in a URL, WhatsApp client will not escape it and put it in a GET request as parameter. This leaks the next immediate word in the typed message if you forget to put space between the URL and text while typing the message.

  • WOW. This data can be sniffed. Will try today. Thanks. Plus do check the comments in question. – user263210 Oct 28 '20 at 13:01

Last I knew they used GET requests, this does pose some issues as it leaks IP, device info and WhatsApp version. The chats themselves are encrypted though. This information is a little outdated but I am not aware of it changing, although I can't rule out WhatsApp has updated its security since then.

See https://techcrunch.com/2017/06/15/should-whatsapp-let-you-disable-url-previews/ for more information

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.