"Reliable message exchange. Simple. Sure. "Really, WhatsApp? Contrary to what the instant messaging giant claims on its home page, your groups may not be really private when you use the application. So neither do your numbers.
In a few Google searches, Vice journalists were able to access discussion groups hosted by Facebook encrypted messaging, they reveal in an article published on February 21. 470,000 private conversation invitation links were still available on Google on Friday. Since then, the American giant seems to have cleaned up.
JUST IN: Google appears to have removed indexing of WhatsApp links.
Other major search engines appear to still be indexing chat links. pic.twitter.com/D07MQBQsEY
But these private groups are always visible when using other search engines: Bing listed 697,000 results this Saturday afternoon. Yahoo had the same number.
Simply enter the WhatsApp domain name -site: chat.whatsapp.com- in the search engine to access all invitations to indexed private groups. By adding certain keywords, Numerama was able to join a conversation concerning the Europe Ecology-The Greens party in Île-de-France and thus access the telephone numbers of several political figures.
Whose fault is it ?
The links for these private discussions are generated when the group administrator clicks on the "Invite to join the group via link" option. It is this link which, if published via a site referenced by a search engine, a social network for example, can then become public.
When you create a group conversation on WhatsApp and generate a link, it is accessible to all who click on it. But few people know that these links are also indexed by search engines. pic.twitter.com/Y7DcKnjYQy
- Marie Turcan (@TurcanMarie) February 21, 2020Whose fault is it? Not to Google, according to its communications officer, Danny Sullivan, who explains on Twitter: “Search engines like Google and others list web pages. That's what's going on here. This is no different from any case where a site allows URLs to be listed publicly. "
Newsletter - The essentials of the news
Every morning, the news seen by Le ParisienI'm registering
Your email address is collected by Le Parisien to allow you to receive our news and commercial offers. Find out more
Asked about this bug by an Indian cybersecurity researcher in November 2019, Facebook replied that it was not really a "flaw". "The fact that the links are accessible to all is an intentional decision" of the group. "Unfortunately, we cannot control everything that search engines, like Google and others, choose to index. "
I reported to facebook security in early November 2019 but they said intended behavior .... pic.twitter.com/V7HzjZZzCI
- HackrzVijay 💻 (@hackrzvijay) February 21, 2020In its response to Vice Friday, WhatsApp again warns Internet users. "Links that users want to share privately with people they know and trust should not be published on a publicly accessible website. "
