WhatsApp’s privacy woes show how messaging app tries to balance security and ease of use

WhatsApp has become popular worldwide thanks to its powerful encryption technology. But making this type of secure messaging approachable and user-friendly can pose some problems.

An article published Friday by the Guardian suggests that WhatsApp has a “security backdoor” that could allow the app, its parent company Facebook Inc., or others to intercept encrypted communications. Privacy advocates quoted in the story said this flaw could be used by the government to spy on chats.

The issue revolves around what’s called an encrypted key, which is used to verify the identity of the user with whom you’re chatting. If that user goes offline — whether by closing the app, getting a new phone or running out of battery power — before receiving messages you have sent, WhatsApp will automatically retransmit the messages with a new key. This switch is supposed to ensure the privacy of conversations, but WhatsApp does so without notifying the sender.

It’s a strategy that reduces the number of notifications WhatsApp users receive, but it could also give hackers an opportunity to tap into communications without anyone knowing.

WhatsApp said Friday that the retransmission policy was a “design decision” to prevent messages from being lost in transit and described related privacy concerns as overblown.

“WhatsApp does not give governments a ‘backdoor’ into its systems and would fight any government request to create a backdoor,” the company said.

Justin Cappos, a professor in New York University’s computer science and engineering department, said the issue boils down to a user interface problem. The company has streamlined the messaging process, he said, so that users don’t automatically receive notifications every time a key changes, unlike another private messaging app called Signal. The process improves user experience, but privacy advocates see a downside.

“It’s very common in security systems that you get fatigued by error messages if they’re too frequent,” he said. “Users tend to tune them out.”

WhatsApp allows users to change settings to see warnings whenever an encryption key changes, but such notifications only show up after sending messages, Cappos said. To improve the system, he suggested adding an option so that users get warnings before messages are sent.

Though WhatsApp and others could intercept a small number of undelivered messages, Cappos said he would not consider it a major threat to user privacy.

“I understand why WhatsApp did what they did, and I think that there’s a bit of room for improvement, but I don’t consider this a serious vulnerability or limitation in WhatsApp,” he said.

[email protected]

@smasunaga

ALSO

Liberty is depicted as a black woman on new $100 gold coin

EPA moves to preserve gas mileage requirements before Trump takes office

SpaceX set to launch 10 satellites Saturday in first flight since September explosion