WhatsApp with privacy? Privacy issues with IM E2EE in the Multi-device setting
summary
Finds and demos that WhatsApp’s multi-device implementation leaks mobile + up to 4 linked devices to any querier, including any user including blocked and non-contacts, by fetching per-device public keys via Web API or browser devtools. Shows how continuous polling reveals adds/removes, ties a delivered message to the specific sender device, and gives examples (one friend with four devices, a public figure with three). Proposes a contacts-only lockdown mode and deeper Sesame-replacement as fixes.
AI-written summary · about
chapters (13)
- 0:00WhatsApp privacy issues
- 1:32Signal Protocol E2EE
- 5:30Device ID privacy leaks
- 6:56Multi-Device feature
- 9:46Multi-Device E2EE risks
- 10:30Device tracking exploits
- 13:11API device info leaks
- 15:01Abusers and device tracking
- 18:24Meta’s solutions
- 19:09Lockdown mode safeguard
- 20:37Sesame algorithm replacement
- 21:42Research directions
- 23:09Summary
related talks
19mBuilding private products
19mPrivate Calling at WhatsApp
19mPrekey Pogo: Investigating Security and Privacy Issues in WhatsApp's Handshake Mechanism
29mPwning WhatsApp The Dark Side Of Web based Messaging Apps
32m(In)Secure Messaging Apps: A Lateral Movement Into Your Privacy
39mUsing WhatsApp as a Command Line ( Breaking out of the walled Garden)
01h 07mBuilding Rock-Solid Encrypted Applications
23mReverse Engineering WhatsApp Encryption for Chat Manipulation and More