Researcher Jonathan Zdziarski claims that the popular messaging service WhatsApp does not delete messages that users send to archive.
The app promises to protect user privacy thanks to end-to-end encryption and the ability to archive, clear and delete messages from your phone.
Researcher points out security flaw in WhatsApp
Zdziarski found that the app stores a “forensic trace” of your messages even if they “deleted, cleared or archived” on Apple devices. As a result the messages are not completely removed from your device. In fact enough information is left behind that the original chat can be reconstructed into its “original form” if the right person gained access to your device.
The app makes a great play of its security credentials and recently introduced end-to-end encryption. As such it would be normal for users to expect that their messages completely disappear from their phone after being deleted.
WhatsApp is in fact keeping a memory of chats that would allow law enforcement or other people to recover messages using forensic tools.
Privacy at risk due to data backup
“Simply preserving deleted data on a secure device is not usually a significant issue, but when that data comes off the device as freely as WhatsApp’s database does, it poses rather a serious risk to privacy,” said Zdziarski.
WhatsApp data is stored in an unencrypted form on your iOS device, and encryption only covers data being sent between devices. The app automatically backs up the unencrypted data on the iCloud, whether or not you have sync enabled.
If someone gains access to the device or a computer associated with it they would be able to read the messages. This is a particular risk if you don’t have password protection on your backups.
“Law enforcement can potentially issue a warrant with Apple to obtain your deleted WhatsApp logs, which may include deleted messages,” said Zdziarski. “The core issue here is that ephemeral communication is not ephemeral on disk.”
How can you protect your data?
If you want to get rid of all of the information, you need to delete the WhatsApp app. Zdiarski maintains that the flaw does not put every WhatsApp user at immediate risk, but developers should think about his discovery when working on software updates.
“The design choices they make when developing a secure messaging app has critical implications for journalists, political dissenters, those in countries that don’t respect free speech, and many others,” he said. “A poor design choice could result in innocent people – sometimes people crucial to liberty – being imprisoned.”
WhatsApp parent company Facebook releases 70% of data requested by the UK government, and that includes WhatsApp data. This could include unencrypted messages as well as data that users believed they had deleted permanently.
Zdiarski points out that other messaging apps have similar flaws. Apple iMessage “leaves a lot” of traces on your device, according to the researcher.
If you are looking for an app that will protect your privacy, it’s worth considering Signal as it “leaves virtually nothing” on the phone. Wickr offers a powerful form of encryption that makes messages a lot more secure.
“Other apps would do well to respect the size of the forensic footprint they’re leaving,” said Zdziarski. Privacy remains an important concern for users, and developers should take this into account.
