# There's No Backdoor in WhatsApp. Just a Weakness That Could Be Exploited

DevFeed: [There's No Backdoor in WhatsApp. Just a Weakness That Could Be Exploited](<https://devfeed.tech/articles/there-s-no-backdoor-in-whatsapp-just-a-weakness-that-could-be-exploited-24966.md>)

Original publisher: [Read original article](<https://codeahoy.com/2017/01/17/theres-no-backdoor-in-whatsapp-just-a-weakness-that-could-be-exploited/>)

Author: umer

Published: 2017-01-17T00:00:00Z

Content type: opinion

Language: en

Sources: [Code Ahoy - Articles](<https://devfeed.tech/sources/code-ahoy-articles.md>)

Topics: [Messaging](<https://devfeed.tech/topics/messaging.md>), [End-to-End Encryption](<https://devfeed.tech/topics/end-to-end-encryption.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [App](<https://devfeed.tech/topics/app.md>)

Tags: [encryption](<https://devfeed.tech/tags/encryption.md>), [messaging](<https://devfeed.tech/tags/messaging.md>), [privacy](<https://devfeed.tech/tags/privacy.md>), [private-key](<https://devfeed.tech/tags/private-key.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [public-key](<https://devfeed.tech/tags/public-key.md>), [server](<https://devfeed.tech/tags/server.md>), [signal](<https://devfeed.tech/tags/signal.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [whatsapp](<https://devfeed.tech/tags/whatsapp.md>)

## AI overview

The article examines claims that WhatsApp contains a backdoor and explains a potential weakness in its end-to-end encryption implementation. It describes how a server could substitute a contact's public key, potentially enabling a third party to intercept messages, while also presenting a defense of WhatsApp from the creators of the Signal protocol.

## Source excerpt

Last week, Guardian ran a story claiming that a backdoor built into WhatsApp can allows its parent company, Facebook, to read user messages despite advertising end-to-end encryption and complete privacy: Facebook claims that no one can intercept WhatsApp messages, not even the company and its staff, ensuring privacy for its billion-plus users. But new research shows that the company could in fact read messages due to the way WhatsApp has implemented its end-to-end encryption protocol. Open Whisper Systems, the nonprofit behind Signal protocol that powers WhatsApp's end-to-end message encryption, came to WhatsApp's defense and fired back at the Guardian story: Today, the Guardian published a story falsely claiming that WhatsApp's end to end encryption contains a "backdoor." ... The way this story has been reported has been disappointing. There are many quotes in the article, but it seems that the Guardian put very little effort into verifying the original technical claims they've made. So what really happened? Tobias Boelter, who "discovered the vulnerability", followed up to further explain and support the backdoor/vulnerability theory and why it matters: ... [WhatsApp] encrypted messaging works using secret and public keys. Every user has both a secret key known only to them, and a public key. A user's public key can be used to encrypt messages which can then only be made readable again with the associated secret key. Okay, so public key encrypts and private key decrypts. Public key is publicly available to anyone, while private key stays private. Let's continue. A difficult problem in secure communication is getting your friend's public keys. Apps such as WhatsApp and Signal make the process of getting those [public] keys easy for you by storing them on their central servers and allowing your app to download the public keys of your contacts automatically. The problem here is that the WhatsApp server could potentially lie about the public keys. Instead of giving you yo