Is WhatsApp Safe? A Cybersecurity Expert‘s Risk Assessment

WhatsApp is the world‘s most popular mobile messaging app, with over 2 billion monthly active users as of 2024, according to Statista. Owned by Meta (formerly Facebook), WhatsApp allows users to send texts, voice messages, photos, videos, and files to contacts for free using an internet connection rather than cellular data. The app also supports voice and video calls.

One of WhatsApp‘s main selling points is its end-to-end encryption, which the company claims makes it a secure and private way to communicate. However, WhatsApp has faced scrutiny over its data sharing practices with parent company Meta, as well as vulnerabilities that could allow hackers or spyware to infiltrate the app. In this article, I‘ll provide a cybersecurity expert‘s assessment of how safe and secure WhatsApp really is to use. I‘ll explain how WhatsApp‘s encryption works, analyze recent security incidents, and provide tips for maximizing your privacy and safety on the app.

How WhatsApp‘s Encryption Works

WhatsApp implemented end-to-end encryption in 2016 using the Signal protocol developed by Open Whisper Systems. With end-to-end encryption, messages are encrypted on the sender‘s device and can only be decrypted by the recipient‘s device. The encryption keys are stored on users‘ devices rather than WhatsApp‘s servers. This means even WhatsApp employees cannot read the contents of messages sent through the app.

WhatsApp‘s encryption covers text messages, voice messages, photos, videos, files, and voice/video calls sent within the app. However, it does not extend to backups of WhatsApp chat histories stored on Google Drive or iCloud. Those backups are not encrypted by WhatsApp and could be vulnerable if a user‘s cloud storage account gets hacked.

According to a WhatsApp white paper, the Signal protocol uses Curve25519, AES-256, and HMAC-SHA256 to secure messages:

• Curve25519 for key exchange
• AES-256 in CBC mode for encryption
• HMAC-SHA256 for message authentication

The Signal protocol employs perfect forward secrecy through ephemeral message keys that are deleted after each message is decrypted. This means if an attacker hacks your phone, they cannot use keys found there to go back and decrypt previously intercepted messages.

While WhatsApp‘s encryption is theoretically very robust from a technical perspective, the app has still suffered some notable security incidents over the years.

Recent WhatsApp Security Incidents

In 2019, WhatsApp revealed that an attacker had used a vulnerability in the app‘s voice calling feature to install spyware on users‘ phones simply by calling them. The spyware, called Pegasus, was developed by Israeli company NSO Group and could access a phone‘s messages, camera, and microphone. WhatsApp sued NSO Group and issued a patch, but did not disclose how many users had been affected.

WhatsApp also made headlines in early 2022 when researchers discovered phishing links that looked like official WhatsApp verification messages being used to hijack accounts. Victims were tricked into sharing their verification codes, allowing attackers to register their WhatsApp number on a new device. WhatsApp banned over 2 million accounts for this kind of activity.

While no app is 100% secure, these incidents show that WhatsApp‘s encryption does not make it immune to hacks, malware, or social engineering attacks. A vulnerability in WhatsApp‘s code or a user being tricked into giving up sensitive info can still compromise privacy.

WhatsApp Privacy Policy Concerns

In January 2021, WhatsApp pushed a major privacy policy update that caused widespread user backlash and led many to switch to rival apps like Signal and Telegram. The updated policy, which went into effect for most users in May 2021, expanded the data WhatsApp shares with parent company Facebook for business interactions taking place on the app.

While WhatsApp cannot read message contents due to end-to-end encryption, it does collect a fair amount of metadata including users‘ phone numbers, profile names and photos, IP addresses, device information, and behavioral data on how they interact with the app. This metadata can be analyzed and combined with Facebook data for ad targeting.

Many privacy advocates argue WhatsApp‘s policy unfairly forces users to agree to invasive data collection practices if they want to keep using the app. WhatsApp defends the changes as necessary to enable business messaging features and argues that 1-on-1 chats are not affected. Still, the privacy policy controversy has sparked debate about whether WhatsApp can really be considered a secure and private messenger given its ownership by data-hungry Meta.

Risks of Using WhatsApp for Business

For all its popularity, WhatsApp is still primarily a consumer app and may not be the best choice for sensitive business communication. While encrypted 1-on-1 chats are relatively secure, WhatsApp lacks enterprise-grade features and centralized controls offered by platforms like Slack or Microsoft Teams.

WhatsApp has over 100 million users in its Business app, but companies should be aware of certain risks:

• Employees using personal WhatsApp accounts for work can blur lines between private and professional communication
• Company has limited ability to monitor WhatsApp communication for data leaks or inappropriate behavior
• Lack of tools to retain and archive WhatsApp chats for compliance purposes
• Risk of employees taking sensitive data/conversations with them if they leave the company

There have been corporate espionage cases of attackers social engineering their way into companies‘ WhatsApp group chats to steal confidential info. For maximum security, it‘s best to keep work communication on company-managed platforms.

WhatsApp Safety Best Practices

While no app can guarantee 100% security, there are steps you can take as a user to make WhatsApp safer:

1. Enable two-factor authentication (2FA): Go to Settings > Account > Two-Step Verification and set up a PIN that will be required periodically to log in.

2. Turn on security notifications: Enable alerts under Settings > Account > Security that will notify you if your encryption key changes, indicating a possible account takeover.

3. Verify contacts‘ identities: If you get a message from an unknown number claiming to be someone you know, verify it‘s really them through another method before engaging. Scammers may try to impersonate your contacts.

4. Beware of phishing links: Don‘t click on suspicious links sent in WhatsApp messages, even if they appear to come from a contact. Hover over links to preview the URL and make sure it‘s legit.

5. Avoid sending sensitive data: Even though WhatsApp uses encryption, it‘s best not to send highly confidential data, financial details, or personal ID info through the app if possible. Save that for more secure channels.

6. Limit privacy settings: WhatsApp allows you to control who can see your profile photo, status, and when you were last online. Set these to "My Contacts" rather than "Everyone." Go to Settings > Account > Privacy.

7. Update the app regularly: Make sure you‘re always running the latest version of WhatsApp to get security patches and bug fixes. Turn on auto-updates for your device.

8. Secure your device: Since WhatsApp messages are decrypted on your device, you also need to keep your phone itself secure. Use a strong passcode, keep your operating system updated, and consider installing mobile antivirus software.

WhatsApp vs. Competitors

While WhatsApp is the biggest mobile messaging app, it‘s far from the only option. Competitors like Signal, Telegram, iMessage, Facebook Messenger, and others also offer some form of encryption. Here‘s how WhatsApp compares on security:

As shown above, Signal collects the least metadata and is run by a non-profit, making it popular among the privacy-conscious. Meanwhile Telegram‘s encryption is not enabled by default. WhatsApp‘s encryption is solid but it harvests a lot of metadata for Facebook. Apple‘s iMessage is also secure but only works between Apple devices.

Conclusion

So in the final assessment, is WhatsApp safe to use? For most casual users, it is a reasonably secure way to chat thanks to strong end-to-end encryption. However, the app‘s data sharing with Meta may give more privacy-minded users pause. WhatsApp‘s past security incidents also show that its encryption does not make it totally hack-proof.

No app is immune to all threats, but WhatsApp users can significantly boost their security by being cautious about what they share, keeping the app updated, and following other cybersecurity best practices. For ultra-sensitive communication, consider using an even more locked-down app like Signal.

Ultimately, the security of your chats is only as strong as the security of your device and the caution of the person on the other end. So pick your messaging apps and conversation partners wisely. Stay safe out there!