On Friday, sparking concern over an app advertised as putting an emphasis on privacy, the Guardian newspaper reported that WhatsApp – the Facebook-owned mobile messaging service, is vulnerable to interception. As per the report said that WhatsApp messages could be read without its billion-plus users knowing due to a security backdoor in the way the company has implemented its end-to-end encryption protocol.
The report said that the system relies on unique security keys which are traded and verified between users to guarantee communications are secure and cannot be intercepted by a middleman. But WhatsApp can force the generation of new encryption keys for offline users unbeknown to the sender and recipient of the messages.
A cryptography researcher at the University of California – Tobias Boelter told the Guardian that if WhatsApp is asked by a government agency to disclose its messaging records, it can effectively grant access due to the change in keys. Boelter further said that he had reported the backdoor vulnerability to Facebook in the month of April 2016 and was told that Facebook was already aware of the issue but that it was not actively being worked on.
In a statement, the company said that it provided a simple, fast, reliable and secure service. There was a way of notifying users when the security of the contact code had changed.
Further, the company said that we know the most common reasons this happens are because someone has switched phones or reinstalled WhatsApp. In these situations, we want to make sure that the messages of people are delivered, not lost in transit.
However, the Guardian said that it had verified that the security backdoor still exists. The head of information security and digital counter-surveillance at the European-Bahraini Organisation for Human Rights – Steffen Tor Jensen said that WhatsApp can effectively continue flipping the security keys when devices are offline and re-sending the message, without letting users know of the change till after it has been made, providing an extremely insecure platform.
The social networking site – Facebook bought WhatsApp in the year 2014 but it continues to operate as a separate app.
