This morning, the Guardian published a story with an alarming headline: “WhatsApp backdoor allows snooping on encrypted messages.” If true, this would have massive implications for the security and privacy of WhatsApp’s one-billion-plus users. Fortunately, there’s no backdoor in WhatsApp, and according to Alec Muffett, an experienced security researcher who spoke to Gizmodo, the Guardian’s story is “major league fuckwittage.”
WhatsApp, acquired by Facebook in 2014 for $16 billion, implemented the gold standard for encrypted and secure messaging earlier last year—what’s called the Signal encryption protocol. If the Guardian’s story and accompanying headline were true, it would mean that someone had cracked what is universally considered to be the best publicly available encryption scheme. More than a billion people who depend on the Signal encryption protocol, used in multiple popular messaging apps, would suddenly be vulnerable to government surveillance or malicious snooping on their messages. Multiple security researchers have reacted to the Guardian piece this morning, essentially calling the piece ridiculous.
Fredric Jacobs, who was the iOS developer at Open Whisper Systems, the collective that designed and maintains the Signal encryption protocol, and who most recently worked at Apple:
“I characterize the threat posed by such reportage as being fear and uncertainty and doubt on a ‘anti-vaccination’ scale,” Muffett, who previously worked on Facebook’s engineering security infrastructure team, told Gizmodo. “It is not a bug, it is working as designed and someone is saying it’s a ‘flaw’ and pretending it is earth shattering when in fact it is ignorable.”
The supposed “backdoor” the Guardian is describing is actually a feature working as intended, and it would require significant collaboration with Facebook to be able to snoop on and intercept someone’s encrypted messages, something the company is extremely unlikely to do.
“There’s a feature in WhatsApp that—when you swap phones, get a new phone, factory reset, whatever—when you install WhatsApp freshly on the new phone and continue a conversation, the encryption keys get re-negotiated to accommodate the new phone,” Muffett told Gizmodo.
“Say that I am sending to you, and your phone is offline because your [battery] is flat, or you have no coverage, or something. Some messages ‘back up’ on my phone, waiting to talk to yours. The proposition is that this condition: backed up messages, combined with someone colluding with Facebook, WhatsApp to ‘fake’ the ‘person has a new phone’ condition, can lead to the backed-up messages being re-encrypted and sent to the new, fake or colluded phone.” Basically, what the Guardian is reporting as a “backdoor” is actually an already well-known way to exploit encrypted messaging systems that is extremely difficult to pull off.
Rest easy, WhatsApp users. There isn’t a backdoor, and there’s no need to worry that you messages aren’t secure. You might want to err on the side of caution, though. Last year, WhatsApp betrayed its longstanding commitment to privacy when it announced it will share user data with Facebook.
Correction 9:19am ET: Corrected spelling of Alec Muffett’s name.