• Off Topic

  • Undelivered WhatsApp messages sent to new device (design concern?)

mrket When you switch devices (for example) and your key changes, your client sends the server a new public key, which is then propagated by the server to clients you've been in contact with, which they then use to re-encrypt any undelivered messages, and then send those to the server to be delivered to you.

Ok... but...

What stops the WhatsApp staff from generating a new public key and sending it to their servers and reading any undelivered messages?

I am not a WhatsApp user, so I don't know how it's supposed to work, but shouldn't it be hard to re-key a user's account?

      de0u What stops the WhatsApp staff from generating a new public key and sending it to their servers and reading any undelivered messages?

      Probably nothing.
      If you steal someone's phone number, it is very likely you can steal their WhatsApp account too (most people probably aren't using a password as it's not required).
      However, once a new key is generated, the clients will send messages encrypted against that new key, which means your device can no longer receive new messages, so you'll figure it out sooner or later (if someone actually managed to access your account on their device, the WhatsApp client on your device will be automatically logged out, which will make it even more obvious).
      At the end of the day it's a proprietary service - you shouldn't send anything really sensitive through it.

        ryrona Quoting from another forum post.

        Would be good if OP would clarify whether messages that were sent to them and delivered to their previous session were also re-encrypted to their new session automatically. If it’s only undelivered messages it’s bad, but if the client goes back like a full day and resends previously delivered messages automatically to new sessions, it’s even worse as it would allow a malicious server to arbitrarily exfiltrate a day or so worth of messages from anyone they’d like. Undetected until after the fact.

          ryrona

          Very interesting observation. There probably still is encryption, but with keys available to Meta... Pretty crazy.

            • [deleted]

            • Post #12

            ryrona

            ryrona After having set up the phone, many hours later, I installed WhatsApp again

            The "public key" is kept on the server.
            The "private key" is kept on the device.
            This raises the following questions:

            1. How did the private keys survive a factory reset and a reinstall of the Whatsapp application?
            2. Are the private keys reproducible if the app is reinstalled on the same device?
            3. How does the private key generation algorithm work?

            How Signal Instant Messaging Protocol Works (& WhatsApp etc) - Computerphile
            https://youtu.be/DXv1boalsDI

                I don't use WhatsApp, nor do I know how it works exactly, but isn't it feasible that after logging in to a new device, contacts' clients are notified and they then send undelivered messages to the new device using new keys? If I'm right, then it's less of an issue, but still not a good feature for people who use WhatsApp for sensitive communications.

                To be extra clear, I'm just suggesting a possible explanation above without any knowledge or evidence that my suggestion is correct. I'm just trying to think of another explanation for why ryrona can get old messages.

                Either way, I'm not sure this behavior is by itself evidence that WhatsApp messages aren't end to end encrypted. WhatsApp is one of the most popular messaging apps in the world. I think Meta would be caught if they weren't using E2EE.

                GrapheneOS's official recommendations are Signal/Molly and SimpleX.

                  other8026 changed the title to WhatsApp messages delivered to new device (E2EE or design concern?) .

                  • [deleted]

                  • Post #15
                  • Edited

                  other8026

                  other8026 Either way, I'm not sure this behavior is by itself evidence that WhatsApp messages aren't end to end encrypted.

                  I don't think it brings into question whether or not the messages are end-to-end encrypted.

                  ryrona all messages that has been sent to me during the day are received, including some photos, and shows up just fine in the app

                  This statement brings into question how the public and private keys are derived and whether or not they are randomly created or created using an algorithm that is repeatable.

                  End-to-end encryption is one thing. Key derivation is a totally different story.

                        • [deleted]

                        • Post #16

                        ryrona
                        Ryrona, here is a test sequence for you to try.

                        Requirement
                        (2) x separate devices, each with a different phone number for Whatsapp. These devices will be referred to herein as Device 1 and Device 2.

                        Device 1 add Device 2 phone number as a contact.
                        Device 2 add Device 1 phone number as a contact.

                        Device 1 install Whatsapp.
                        Device 2 install Whatsapp.

                        Device 1 send a Whatsapp message to Device 2.
                        Device 2 send a Whatsapp message to Device 1.

                        Device 1 put in airplane mode with WiFi off.

                        Device 2 send a Whatsapp message to Device 1 and make a written note of the time sent.
                        Wait 5 minutes.
                        Device 2 send a Whatsapp message to Device 1 and make a written note of the time sent.
                        Wait 5 minutes.
                        Device 2 send a Whatsapp message to Device 1 and make a written note of the time sent.

                        Device 2 put in airplane mode with WiFi off.

                        Device 1 leave in airplane mode and factory reset the device.

                        Device 1 setup device and install Whatsapp.

                        Device 1 if you are able to read the messages that were sent by Device 2 this would be a red flag.

                        Device 2 turn off airplane mode.

                        Are any messages delivered to Device 1 from Device 2 after turning off airplane mode on Device 2?

                          other8026 isn't it feasible that after logging in to a new device, contacts' clients are notified and they then send undelivered messages to the new device using new keys?

                          Yes, that's how it works: https://signal.org/blog/there-is-no-whatsapp-backdoor/

                          when communicating with a contact who has recently changed devices or reinstalled WhatsApp, it might be possible to send a message before the sending client discovers that the receiving client has new keys. The recipient’s device immediately responds, and asks the sender to re-encrypt the message with the recipient’s new identity key pair. [...] The WhatsApp clients have been carefully designed so that they will not re-encrypt messages that have already been delivered. Once the sending client displays a “double check mark,” it can no longer be asked to re-send that message.

                              other8026 changed the title to Undelivered WhatsApp messages sent to new device (design concern?) .

                              I think the core issue here is that you are able to authenticate using just a phone number. If you go into WhatsApp Settings → Account, you can set a 6-digit PIN or Passkey to be used for logging in instead (just tried the Passkey and got an error though). That should be significantly more secure (in particular the passkey). Signal supports a PIN as well, but it can be a full passphrase if you like.

                              Titan_M2 Yes, that's how it works: https://signal.org/blog/there-is-no-whatsapp-backdoor/

                              Okay. That explains my observation totally. It is just I didn't expect they would ask senders to resend already sent but not yet delivered messages under new keys. Strictly speaking, that means some sensitive messages and media might get exposed, without the sender knowing beforehand, just after the fact, so seems like a very bad design choice. But since it is the design choice they have made, messages are still technically end-to-end encrypted between sender and recipient, just some might get exposed.

                                  ryrona It is just I didn't expect they would ask senders to resend already sent but not yet delivered messages under new keys.

                                  It's a reasonable UX for an app targeting the masses.

                                    3 months later