Someone sends me a link. Whatsapp shows its preview. How can they do that despite being E2E encrypted?
WhatsApp client makes http request to the site as the sender types in, in order to fetch site meta properties.
<meta property="og:title" content="Information Security Stack Exchange"> <meta property="og:description" content="Q&A by infosec enthusiasts"> <meta property="og:image" content="https://cdn.sstatic.net/Sites/security/Img/logo.svg?v=f9d04c44487b"> <meta property="og:url" content="https://security.stackexchange.com">
Link preview requires sender to be online and the message is yet to be sent. WhatsApp client makes http request for any text that matches with the regular expression of the URL.
Once metadata is retrieved, it is sent as message. The problem with this design is that if there's a query string in a URL, WhatsApp client will not escape it and put it in a GET request as parameter. This leaks the next immediate word in the typed message if you forget to put space between the URL and text while typing the message.
Last I knew they used GET requests, this does pose some issues as it leaks IP, device info and WhatsApp version. The chats themselves are encrypted though. This information is a little outdated but I am not aware of it changing, although I can't rule out WhatsApp has updated its security since then.
See https://techcrunch.com/2017/06/15/should-whatsapp-let-you-disable-url-previews/ for more information