A simple Google search could reveal as many as 470,000 WhatsApp group invite links, according to reports. Once an individual finds an invitation, they can join the group and potentially find out members’ phone numbers. It is especially troubling that these invitations have been published online as the messaging app is supposed to facilitate the ability for users to communicate amongst each other in total privacy.
Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics
The ability for individuals to simply find an invite link on the internet and join a private WhatsApp group is horrifying. WhatsApp users will have very little control over this, and their personal data could be at risk should a threat actor decide to infiltrate a group chat. There is no reason for links to be made public, and the fact that they have could deal a major blow to WhatsApp’s reputation, with individuals deciding to use Signal or Telegram instead. These chat apps focus more on privacy and user security, so are ideal for users who value their privacy in messages.
While WhatsApp’s messaging may be encrypted in the middle, those who have been accepted into a group chat have the encryption key to read. Allowing potentially bad actors access to private group chats invalidates many of the platform’s claims to security, and could facilitate further crimes once these individuals have access to personal information.