Earlier on Friday, The Guardian reported that the Facebook-owned messaging service WhatsApp is vulnerable to interception, which means that WhatsApp messages could be read without its billion-plus users knowing about it. The reason is due to a security backdoor detected in the app’s end-to-end encryption protocol.
The Guardian reported, the system of service relies on unique security keys ‘that are traded and verified between users to guarantee communications are secure and cannot be intercepted by a middleman.’
While many security advocates around the world believe that creating a backdoor to access the messages is a threat to the privacy of the users, Facebook begs to differ. Tobias Boelter, a cryptography researcher at the University of California, believes that if the government asks WhatsApp to disclose users’ messaging history, it can effectively grant them access due to a change in the encryption keys.
WhatsApp told The Gaurdian, ‘We know the most common reasons this happens are because someone has switched phones or reinstalled WhatsApp.... In these situations, we want to make sure people's messages are delivered, not lost in transit.’
In a statement to Deccan Chronicle, WhatsApp said ‘We do not give governments a ‘backdoor’ into its systems and would fight any government request to create a backdoor. The design decision referenced in the online reports prevents millions of messages from being lost, and WhatsApp offers people security notifications to alert them to potential security risks. WhatsApp published a technical white paper on its encryption design, and has been transparent about the government requests it receives, publishing data about those requests in the Facebook Government Requests Report.’
In reply to the allegations with regards to the backdoor on the messaging app, WhatsApp's co-founder Brian Acton took to Reddit with the following statement.
“The Guardian’s story on an alleged “backdoor” in WhatsApp is false. WhatsApp does not give governments a “backdoor” into its systems. WhatsApp would fight any government request to create a backdoor. Since April 2016, WhatsApp messages and calls are end-to-end encrypted by default. WhatsApp also offers people a security notifications feature that alerts them when people change keys so that they can verify who they are communicating with.
‘Like everything else in WhatsApp, it’s designed to be simple. We built end-to-end encryption with encryption as the default so not a single one of our 1 billion users has to turn on encryption. This is also true for people who delete and re-install WhatsApp or for those who change their phones. For some people, this can be a frequent occurrence as people manage data charges and phone storage, or share devices with family members.
We want to make sure that people in these situations do not lose access to messages sent to them while they are in the midst of re-installing the app or changing their phones. Because a person's encryption key is changed when WhatsApp is installed on a new phone or re-installed on an old device, we make sure those messages can eventually be read using the new key.
You can choose to be notified using the “Show Security Notifications” setting. When you have turned this setting on, WhatsApp will notify you every time the person you're communicating with changes a key.
Of course, if you are concerned that you're communicating with someone who isn't who they say they are, there are things you can do. If you have “Show Security Notifications” enabled and receive a notification of a key change, send an initial message and wait for the blue checkmarks. You can then verify using a QR code or by comparing a 60-digit number.
We appreciate the interest people have in the security of their messages and calls on WhatsApp. We will continue to set the record straight in the face of baseless accusations about “backdoors” and help people understand how we’ve built WhatsApp with critical security features at such a large scale
Most importantly, we’ll continue investing in technology and building simple features that help protect the privacy and security of messages and calls on WhatsApp.”
