WhatsApp & leaks

WhatsApp & leaks

Context:

• Television news channels have shared leaked WhatsApp chats of film actors. This has led to concerns whether communication over platforms such as WhatsApp is secure or not. Also, these events have prompted Facebook-owned WhatsApp to come out with a statement on its use of end-to-end encryption to secure user messages.

Does WhatsApp have access to chats?

• Since the year 2016, WhatsApp has installed an end-to-end encryption system.
• It claims that it ensures nobody apart from those communicating with each other over the platform can read what is sent, not even WhatsApp.
• Governments across the world see end-to-end encryption as a huge issue when it comes to law enforcement.
• While WhatsApp says it responds to requests from law enforcement agencies “based on applicable law and policy,” it is not clear what kind of data it would have to share.
• News reports have mentioned that these could be in the nature of metadata such as mobile number, IP address, location, and so on.

How is WhatsApp designed to ensure such secure communication?

• WhatsApp uses the encryption protocol developed by Open Whisper Systems (a project known best for its Signal app) which also uses the same open-source framework to ensure privacy.
• Many closed messaging applications now use the Signal protocol.
• Each and every WhatsApp chat has a security code used to verify that calls and the messages that are sent to that chat are end-to-end encrypted.

What is the technology behind this?

• The technology that forms the basis for this is called the ‘Diffie-Hellman key exchange’.
• In a 1976 Whitfield Diffie and Martin E. Hellman saw the futility of the old ways of sharing a key securely in the emerging digital world.
• They proposed a way for secure communication via a method of a shared secret key, and that too when the communication is over a not-so-secure channel.
• It is all about math and is designed in a way that a third party eavesdropping on an exchange finds it computationally infeasible to arrive at the secret key from the information overheard.

Can’t those who have access to the server read messages?

• End-to-end encryption removes this vulnerability.
• WhatsApp also says it does not store messages on its servers once they are delivered.

Can leaks still happen?

• End-to-end encryption cannot prevent leaks from happening if a third party has access to a device which contains these messages.
• Encryption also does not help in cases wherein the sender or the receiver of a message shares it with others, a member of a group shares it with others, or messages are stored in a different format on a different application or platform open to others.
• Through mobile phone cloning technique, data and cellular identity of a device can be copied into a new phone. This can be done with the help of an app and without access to the phone that needs to be cloned. In the process, the transfer of the International Mobile Equipment Identity can also happen.

What are the other vulnerabilities?

• Bugs that lead others to control a user’s phone are an example of such vulnerabilities.
• For instance, last year, WhatsApp revealed that surveillance technology developed by Israel’s NSO Group had been used to spy on about 1,400 people across the world, including civil rights activists and journalists in India.