WhatsApp Dismisses Claims of Group Chat Security Breach
WhatsApp is pushing back against a report by German researchers that suggests encrypted group chats on the platform can be compromised. The company, along with Moxie Marlinspike — developer of the Signal protocol upon which WhatsApp is based — denies the claim that a server-side attacker could silently infiltrate a group conversation.
The controversy arose from a paper published by researchers at Ruhr University Bochum titled “More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema.” The researchers assert that a WhatsApp server, or an entity capable of breaking transport layer security (TLS), could add unauthorized members to group chats and manipulate message flow without detection.
Concerns Over Government Pressure and Server Exploits
The researchers’ findings raise concerns about the potential for governments to coerce WhatsApp into granting access to encrypted group chats, or for attackers with server access to exploit these alleged flaws. The paper claims a compromised server could reorder, delay, or suppress group messages — effectively monitoring conversations in real time.
One alarming point made in the paper is that a rogue server could suppress alerts notifying members when a new participant joins — enabling silent infiltration. However, both WhatsApp and Marlinspike dispute this.
“All group members will see that the attacker has joined. There is no way to suppress this message,”
WhatsApp and Signal Highlight Built-In Safeguards
WhatsApp issued a public statement in response: “We’ve looked at this issue carefully. Existing members are notified when new people are added to a WhatsApp group.” The company emphasized that even with admin control, attackers cannot hide their presence in a group.
Furthermore, Marlinspike clarified that attackers cannot view previous messages because end-to-end encryption protects historical content with keys they do not possess.
Expert Opinions and Underlying Limitations
Matthew Green, a cryptographer at Johns Hopkins University, weighed in, noting that group management in WhatsApp relies heavily on centralized servers. Unlike Signal, which assigns a random 128-bit group ID that isn’t exposed even to the server, WhatsApp servers manage group roles and lack message signing for admin actions.
“The flaw here is obvious: since the group management messages are not signed by the administrator, a malicious WhatsApp server can add any user it wants into the group,” Green explained. “This means the privacy of your end-to-end encrypted group chat is only guaranteed if you actually trust the WhatsApp server.”
Proposed Fixes and WhatsApp’s Track Record
The German researchers proposed implementing signed group management messages to ensure only legitimate administrators can authorize participant changes. WhatsApp declined to comment on whether these recommendations would be adopted.
Nevertheless, WhatsApp has a history of resisting government efforts to compromise user encryption. The company supported Apple’s refusal to unlock an iPhone for the FBI, and a Facebook employee was once jailed in Brazil for not complying with court orders to create a service backdoor. WhatsApp has also rejected the UK government’s calls to weaken encryption.