Recent from talks
Reception and criticism of WhatsApp security and privacy features
Knowledge base stats:
Talk channels stats:
Members stats:
Reception and criticism of WhatsApp security and privacy features
This article provides a detailed chronological account of the historical reception and criticism of security and privacy features in the WhatsApp messaging service.
On May 20, 2011, an unidentified security researcher from the Netherlands under the pseudonym "WhatsappHack" published a method to hijack WhatsApp accounts using a flaw in the authentication process, to the Dutch websites Tweakers.net and GeenStijl. The method involved trying to log in to a person's account from another phone number and intercepting the verification text message that would be sent out. "WhatsappHack" provided methods to accomplish this on both Symbian and Android operating systems. One day after the publication of the articles, WhatsApp issued a patch to both the Android and Symbian clients.
In May 2011, another security hole was reported which left communication through WhatsApp susceptible to packet analysis. WhatsApp communications data was sent and received in plaintext, meaning messages could easily be read if packet traces were available.
In May 2012 security researchers noticed that new updates of WhatsApp sent messages with encryption, but described the cryptographic method used as "broken." In August of the same year, the WhatsApp support staff stated that messages sent in the "latest version" of the WhatsApp software for iOS and Android (but not BlackBerry, Windows Phone, and Symbian) were encrypted, but did not specify the cryptographic method.
On January 6, 2012, an unknown hacker published a website that made it possible to change the status of any WhatsApp user, so long as the phone number associated with the user's account was known. On January 9, WhatsApp reported that it had resolved the problem. In reality, WhatsApp's solution had been to block the website's IP address, which had allowed a Windows tool to be made that could accomplish the same thing. This problem has since been resolved by the institution of an IP address check on currently logged-in sessions.
On September 14, 2012, Heise Security demonstrated how to use WhatsAPI to hijack any WhatsApp account. Shortly afterward, WhatsApp threatened to initiate legal action against the developers of WhatsAPI, an open source project, and WhatsAPI temporarily took down their source code. This, however, did not address the underlying security failure and Heise Security claimed they had been able to successfully repeat the hacking of WhatsApp accounts. The WhatsAPI team has since resumed active development.
On March 31, 2013, the Saudi Arabia Communications and Information Technology Commission (CITC) issued a statement that mentioned possible measures against WhatsApp, among other applications, unless the service providers took serious steps to comply with monitoring and privacy regulations.[needs update]
In February 2014, the Schleswig-Holstein Data Protection Authority advised against using WhatsApp, as the service lacked privacy protection such as end-to-end client-side encryption technology. In late 2014, WhatsApp began its implementation of end-to-end encryption, which it finished in April 2016.
Hub AI
Reception and criticism of WhatsApp security and privacy features AI simulator
(@Reception and criticism of WhatsApp security and privacy features_simulator)
Reception and criticism of WhatsApp security and privacy features
This article provides a detailed chronological account of the historical reception and criticism of security and privacy features in the WhatsApp messaging service.
On May 20, 2011, an unidentified security researcher from the Netherlands under the pseudonym "WhatsappHack" published a method to hijack WhatsApp accounts using a flaw in the authentication process, to the Dutch websites Tweakers.net and GeenStijl. The method involved trying to log in to a person's account from another phone number and intercepting the verification text message that would be sent out. "WhatsappHack" provided methods to accomplish this on both Symbian and Android operating systems. One day after the publication of the articles, WhatsApp issued a patch to both the Android and Symbian clients.
In May 2011, another security hole was reported which left communication through WhatsApp susceptible to packet analysis. WhatsApp communications data was sent and received in plaintext, meaning messages could easily be read if packet traces were available.
In May 2012 security researchers noticed that new updates of WhatsApp sent messages with encryption, but described the cryptographic method used as "broken." In August of the same year, the WhatsApp support staff stated that messages sent in the "latest version" of the WhatsApp software for iOS and Android (but not BlackBerry, Windows Phone, and Symbian) were encrypted, but did not specify the cryptographic method.
On January 6, 2012, an unknown hacker published a website that made it possible to change the status of any WhatsApp user, so long as the phone number associated with the user's account was known. On January 9, WhatsApp reported that it had resolved the problem. In reality, WhatsApp's solution had been to block the website's IP address, which had allowed a Windows tool to be made that could accomplish the same thing. This problem has since been resolved by the institution of an IP address check on currently logged-in sessions.
On September 14, 2012, Heise Security demonstrated how to use WhatsAPI to hijack any WhatsApp account. Shortly afterward, WhatsApp threatened to initiate legal action against the developers of WhatsAPI, an open source project, and WhatsAPI temporarily took down their source code. This, however, did not address the underlying security failure and Heise Security claimed they had been able to successfully repeat the hacking of WhatsApp accounts. The WhatsAPI team has since resumed active development.
On March 31, 2013, the Saudi Arabia Communications and Information Technology Commission (CITC) issued a statement that mentioned possible measures against WhatsApp, among other applications, unless the service providers took serious steps to comply with monitoring and privacy regulations.[needs update]
In February 2014, the Schleswig-Holstein Data Protection Authority advised against using WhatsApp, as the service lacked privacy protection such as end-to-end client-side encryption technology. In late 2014, WhatsApp began its implementation of end-to-end encryption, which it finished in April 2016.
Recent media