Questions tagged [whatsapp]

Whatsapp is a proprietary instant messaging client for smartphones

Filter by
Sorted by
Tagged with
72
votes
2answers
14k views

How is WhatsApp sending end-to-end encrypted messages in push notifications?

WhatsApp implemented end-to-end encryption (whitepaper) in their latest update. How is it possible for WhatsApp to send push notifications with message contents to the Apple Push Notification service?...
64
votes
2answers
15k views

Whatsapp encryption keys

Today I woke up and checked my Whatsapp and got the message that communications are encrypted end-to-end from now on. However, how can I know whether Whatsapp can be trusted? I did not generate my ...
63
votes
1answer
30k views

How does end to end encryption work with whatsapp web?

Since today I have noticed whatsapp is using end to end encryption. However web.whatsapp.com is also still working. Does whatsapp establish a connection with my phone to keep things secure?
46
votes
2answers
6k views

How might the Chinese government be blocking only specific types of WhatsApp traffic?

There are currently media reports that the Chinese government are blocking some types of messages sent via WhatsApp ("pictures, voice messages and video"). Given that WhatsApp traffic has end-to-end ...
39
votes
2answers
10k views

Is Signal still more secure than WhatsApp?

WhatsApp has "recently" deployed end-to-end encryption using the Signal protocol, which is of course also being used by Signal itself. The related white paper (PDF). Now this raises the question: Is ...
26
votes
4answers
8k views

How can WhatsApp do both targeted advertisement and end-to-end encryption?

Recently there have been a lot of news articles which say that Facebook will very soon add advertising to WhatsApp, yet will keep the end-to-end encryption (source): [M]essages will remain end-to-...
26
votes
1answer
9k views

More secure to use e.g. Whatsapp Web in Franz than in browser? [closed]

Yesterday I found out this application called Franz. Their policy says they don't collect any information about your chats and can't read them (because it's just an application who bundles them all ...
24
votes
3answers
29k views

Which Cryptography algorithm is used in WhatsApp end-to-end security?

I have a presentation to make on Social Network Security. I have been doing some research regarding this. I did a lot of searching, but was unable to find the Crypto Algorithm used by WhatsApp for ...
22
votes
3answers
4k views

My country is attempting to block WhatsApp, what to do?

My country (Brazil) will start a 48 hour block on WhatsApp tomorrow, with cooperation from data (3G/4G) companies, but not home ISP companies (yet). My question is: How can I still access and send ...
20
votes
3answers
24k views

Does backing up WhatsApp on Google Drive expose messages?

I was wiping and restoring a family member's Android phone today, as it was running slowly with loads of apps on it. I decided to back up their WhatsApp messages to Google Drive in order to recreate ...
19
votes
5answers
10k views

Can governments intercept end-to-end encrypted Whatsapp communication through lawful interception?

Since Whatapp started end-to-end encryption with an option for users to verify keys, many government security agencies, like the Indian one, red-flagged such use of encryption. Now, Yesterday the ...
19
votes
2answers
6k views

How can WhatsApp restore local or Google Drive Backups?

This is all not about their end-to-end transmission protocol and my question is mostly Android centric. What I ask myself: When reading about hacking and decrypting local WhatsApp database backups it ...
19
votes
1answer
12k views

How does the Signal Protocol, used by WhatsApp, work?

I want to understand the process of the Signal Protocol. I have google it, but I am unable to find any good article or tutorial. I want to understand the basic definition and functionality of the ...
19
votes
2answers
12k views

How does WhatsApp's new group chat protocol work and what security properties does it have?

By now everybody has noticed that WhatsApp rolled out full end-to-end encryption recently, for direct communication, for media attachments and for group chats. I've read their white-paper (PDF) and ...
18
votes
1answer
2k views

How would one verify that the public key from WhatsApp's servers belongs to the person I expect it to?

WhatsApp had recently announced end-to-end encryption on all communications. While that's an impressive move, I still have a big open question mark. The articles and this white paper suggest that the ...
12
votes
3answers
4k views

Can I use WhatsApp to securely send public key, symmetric key and private key?

I am asking this because WhatsApp says it is end-to-end encrypted. Are there any problems with sending a public key through WhatsApp? There might be some objections to sending symmetric and private ...
10
votes
3answers
47k views

Does WhatsApp disclose the sender's IP address?

Does WhatsApp disclose the sender's IP address? Is it possible to get it by running netstat -a or via Wireshark?
10
votes
1answer
2k views

How can WhatsApp recover messages sent to a damaged phone?

My mom has an Android phone that fell in the water for a couple of seconds, around 16:30. She managed to disassemble the phone and turn it off. We both share a group that is end-to-end encrypted (all ...
10
votes
1answer
168 views

How can faulty version of an iOS app (such as WhatsApp) expose the whole device to crashes or take-over

There was a lot of recent, prominent news about a security vulnerability in WhatsApp that affects also iOS versions of the app. The volnerability has been described as carrying the risk of an attacker ...
10
votes
1answer
2k views

Why is whatsapp Inc. still caching user data even after introducing the end to end encryption?

Last week Whatsapp introduced the end to end encryption to prevent man in the middle intercept/attack. The company claims that the data such as text, call, video, images and documents are stored ...
8
votes
5answers
388 views

Given properly implemented end-to-end encryption with no backdoors, can whatsapp comply to hand over customer messages?

According to The Telegraph, a member of the British government is calling on WhatsApp to release the messages sent by the terrorist that committed the attack on London on March 22, 2017. It's lead ...
8
votes
3answers
26k views

How can application like Whatsdog detect user online status from Whatsapp?

Whatsdog detects whether your victim is online or not. What are they doing in the background? We know that Whatsapp does not provide any API or SDK for this, so how can anyone monitor this type of ...
8
votes
1answer
656 views

Attack vector for exploiting WhatsApp's retransmission “vulnerability”?

A few days ago, an old "vulnerability" of WhatsApp re-appeared in the media. The Guardian published this article calling the vulnerability a "backdoor". The article cites these findings of Tobias ...
7
votes
1answer
222 views

Does WhatsApp's link preview on the link messages leak information?

When we want to send a message that contains only a link - such as a question from the Stack Exchange network - WhatsApp displays information from the website as below: Does this leak information ...
7
votes
2answers
2k views

What's safest way to run WhatsApp? [closed]

For work I have to use WhatsApp. I agree with EFFs concerns about WhatsApp and personal data (harvesting it and shoveling it into Facebook), and perhaps even its security. I thought it would be ...
7
votes
1answer
2k views

Can mobile network operators read WhatsApp metadata?

After turning on end-to-end encryption for WhatsApp is it possible for the network operators to read the metadata of the messages being exchanged? I see here (in Transport security) that metadata ...
7
votes
2answers
3k views

How does the WhatsApp chat history recovery work together with their encryption mechanism?

As WhatsApp states: every time a user installs or updates the app, a new key pair would be generated on the user's device. So I assume that the chat history on iCloud which was encrypted by the old ...
6
votes
2answers
7k views

How does the Whatsapp web client synchronize with the mobile application keeping all E2E?

How is it possible to maintain an E2E communication while using the whatsapp web client? I've found different Q&A ( f.i. How does end to end encryption work with whatsapp web? ) but nobody ...
6
votes
1answer
1k views

Understanding a Whatsapp account hack (social engineering?)

A friend of mine (Bob) received a suspicious Whatsapp message today, seemingly from a former colleague (Alice), who claimed to have "forwarded [to Bob] an SMS with a code in it by mistake", and who ...
6
votes
3answers
323 views

If whatsapp has end-to-end encryption, How does it fight spam?

I was just going through whatsapp Terms and Service here: https://www.whatsapp.com/legal/ and found that they may work with Facebook to fight spam etc. How is it possible when Whatsapp servers cannot ...
6
votes
2answers
15k views

Found an application (Whatsapp) initiating UPnP requests, is it something that I should worry about?

I have logged in into my router using the web interface. I was checking UPnP forwarding (which is enabled by default), and found out that whatsapp is initiating a UPnP request on port 65072. Is ...
6
votes
1answer
3k views

Sniffing WhatsApp Traffic

I was wondering if its possible to obtain private keys for Whatsapp to be able to sniff traffic between two WhatsApp Android devices (both under my control). I understand that WhatsApp traffic is now ...
6
votes
1answer
5k views

Private key storage for end2end encrypted messaging

I am familiar with asymmetrical encryption, private/public keys... I am wondering about the "new" trend coming from WhatsApp, Facebook, ... to have end to end message encryption. From my ...
5
votes
2answers
17k views

Why is whatsapp using 6 digit codes for verification?

My question is kind a simple. Why does whatsapp use 6 digit codes to verify the device? They could also use 5 or 7+ digits and or alphanumeric characters. Are there any reasons they chose exactly 6?
5
votes
2answers
480 views

A site supports Public key length of 256 bits while best practice is 1024+ - what does this mean?

Given that this is asymmetric cryptography with private/public key, I am not sure if reduced bit length is breakable easier than longer keys. I understand that the key population is reduced (hence ...
5
votes
3answers
3k views

Can a Government Intelligence Agency See *Who* I Am Messaging On WhatsApp

I have not been able to find this answer, because most of the talk is about the content of communications, but my question is: Can a government intelligence agency somehow see who I am communicating ...
5
votes
1answer
236 views

Can WhatsApp, Signal or Telegram be hacked through a SIM SWAP attack?

In Cuba the telecoms/ISP monopoly, Etecsa, works with the political police to spy on dissidents, journalists and others. A common attack in Cuba is therefore SIM Swapping which is easy for them. It is ...
5
votes
1answer
298 views

How can WhatsApp be listed on the EFF secure application toolset when it's not opensource? [closed]

I see this EFF tool guide, proposing WhatsApp as one of "our pick of the best, most secure applications" source. How can WhatsApp be trusted as a secure application when it is not open-source (...
5
votes
2answers
6k views

Whatsapp access to Google Drive

I am very concerned today as I discovered whatsapp has access to my google drive. Does this mean whatsapp can steal my google drive data with this access or is it restricted only to a specific folder?...
5
votes
2answers
24k views

Is it possible to identify the source of message in whatsapp?

Is it possible to identify the real source of message in whatsapp? Scenario : Texting whatsapp message to a group,one of the group member forwards it to another and it goes on atlast one day it ...
5
votes
1answer
331 views

Can WhatsApp recover Google Drive backups if the phone is not connected to the original Google account?

Last week Brazilian news outlets reported a scam involving WhatsApp where an attacker could get access to an WhatsApp account by activating the target phone number on a different device in control of ...
5
votes
1answer
267 views

Wasn't WhatsApp messages already encrypted?

According to this article, which was written in 2014, WhatsApp had partnered with Open Whisper System to make its (text based) messages encrypted. So what's the big change now that Whatsapp's ...
4
votes
4answers
938 views

Whatsapp is adding passwords: what is the threat model that they want to protect their users from?

Whatsapp has announced that they are introducing 2FA to their service. Normally, services rely on a password (what you know), and adding 2FA means that they require an additional code sent via SMS to ...
4
votes
3answers
5k views

How are whatsapp calls banned even with VPN in countries like UAE

As you may know, some countries are blocking access to whatsapp calls, but users usually overcome that with a VPN service, but today even with that powerful internet anonymity solution, ISPs and ...
4
votes
2answers
4k views

Can someone hack my phone by sending me a file (e.g. PDF) via Whatsapp?

My work requires (and depends on) Whatsapp for daily sharing of files with many people (PDF, PowerPoint, Word, Images, Web links...), and I was wondering if it is possible that someone can hack our ...
4
votes
2answers
51k views

Sniffing WhatsApp chat using Wireshark

Suppose two persons are using WhatsApp on Android. How can I see the communication between them if I have Wireshark running on a PC listening on network interface card? I know the communication ...
4
votes
4answers
2k views

Why does WhatsApp not encrypt Google Drive backups?

WhatsApp has end-to-end encryption, promising privacy to users. However, it becomes useless if backups to Google Drive are unencrypted. Our supposedly private data goes to the control of Google. No ...
4
votes
2answers
540 views

How does master secret calculates in encryption protocol used by WhatsApp?

I have read the algorithm behind WhatsApp encryption in this document. I can not understand how the initiator calculates a master secret. The initiator calculates a master secret as: master_secret = ...
4
votes
4answers
13k views

Why does whatsapp use phone number instead of username for identification? [closed]

This feature of whatsapp looks like a bad practice refering to the privacy of their users, I guess it has received critics about that and even though it's nowadays an old application it continues the ...
4
votes
1answer
2k views

Open source WhatsApp client [closed]

As a follow up to Whatsapp encryption keys discussion and from WhatsApp security whitepaper, it seems that most of the components to a fully secure end-to-end encryption are already there but what ...