A newly discovered WhatsApp big could potentially reveal all your archived messages to other users. This is possible when a user with a new or different SIM card, inserts it on a mobile phone of another user's phone.
The issue was recently highlighted by Amazon employee, Abby Fuller. However, a similar issue has existed with WhatsApp since 2014 when iAfrikan's Tefo Mohapi revealed that it was possible to read deleted WhatsApp messages, including those of other users.
"Yes it was a new device. No it wasn't second hand. It was not a second hand SIM. Yes I'm sure they weren't my messages, or groups that I was added to. Yes they were in plaintext. I am sure it's my phone number. It was not restored from a backup,” said Fuller in a tweet.
WhatsApp privacy concerns
What is worrying is that, according to WhatsApp documentation, a user's message history on specific phone number and device is (supposed to be) destroyed after the phone number associated with the WhatsApp account is not used for 45 days.
“Remember to delete your old account. However, if you didn’t delete your account and no longer have access to your old phone, don’t worry. If the new owner of your old number activates WhatsApp on a new phone after 45 days, all of your account information tied to that phone number will be completely deleted,” explains WhatsApp in its support documentation.
However, in the case of Fuller and others who have reported the same bug, her number had been in use on this specific mobile phone for over 45 days. Yet, the old user's archived messages could still be retrieved in plain text and read.
At the time of publishing, WhatsApp had not responded to questions from iAfrikan however, previously assured us of the messaging app's " end-to-end encryption. The recent big however raises questions about this, essentially, defeating the whole purpose of encryption if any user's old messages can be read in plain text, and not encrypted.
There seems to be inconsistencies between what WhatsApp says in its documentation and how their app works.
WhatsApp has not yet offered an official statement on the matter.
Cover image credit: Derick Anies/Unsplash