Image used with permission by copyright holderThanks to “misinterpretations, mistakes and misunderstandings at several stages of the reporting and editing process,” The Guardian published a story that dramatically overinflated the potential impact of a security flaw in the popular WhatsApp messaging application — and after half a year of investigating, the British news agency has finally put out a mea culpa.
Security concerns were under the microscope in December 2016, when the social media giant was accused of misleading European regulators in advance of its $22 billion acquisition of the messaging app, while WhatsApp users were displeased to find that their information was being shared with Facebook. That relationship grew more complicated after a report from the Guardian in early January, which detailed the discovery in WhatsApp of “a security backdoor that can be used to allow Facebook and others to intercept and read encrypted messages.” But was that report accurate? A group of security researchers penned an open letter a week later asking the Guardian to retract its story, calling it “the equivalent of putting ‘VACCINES KILL PEOPLE’ in a blaring headline over a poorly contextualized piece.”
Recommended Videos
The crux of the debate: WhatsApp told users last April that it had implemented end-to-end encryption for all messages sent through its platform, but the Guardian’s report suggested that the app neglected to mention a caveat: Facebook can intercept your messages. And if Facebook can do it, then so too can a government agency.
Please enable Javascript to view this content
On Wednesday, six months after the controversial Guardian report, the news agency acknowledged flaws in its reporting, admitting that it was wrong to make such claims.
“The Guardian ought to have responded more effectively to the strong criticism the article generated from well-credentialed experts in the arcane field of developing and adapting end-to-end encryption for a large-scale messaging service,” wrote Paul Chadwick, the Guardian’s fourth readers’ editor (a quirky British title for a reader advocate).
The alleged backdoor was brought to light by Tobias Boelter, a cryptography and security researcher at the University of California, Berkeley. “If WhatsApp is asked by a government agency to disclose its messaging records, it can effectively grant access due to the change in keys,” he told the Guardian at the time.
Image used with permission by copyright holder
The supposed backdoor, the Guardian had explained, had to do with WhatsApp’s encryption, which depends upon a generated set of unique security keys, using the Signal protocol. These keys are traded and verified between users to ensure that their messages are protected.
However, WhatsApp apparently could generate new encryption keys for offline users without the prior knowledge of either the sender or receiver, and then have the sender re-encrypt messages with new keys to resend them. This process would essentially let WhatsApp intercept and read messages.
Boelter’s findings were further verified by Steffen Tor Jensen, head of information security and digital countersurveillance at the European-Bahraini Organisation for Human Rights. He noted at the time that “WhatsApp can effectively continue flipping the security keys when devices are offline and resending the message, without letting users know of the change till after it has been made, providing an extremely insecure platform.”
WhatsApp was indignant from the start, telling Digital Trends via email in January:
The Guardian posted a story this morning claiming that an intentional design decision in WhatsApp that prevents people from losing millions of messages is a “backdoor” allowing governments to force WhatsApp to decrypt message streams. This claim is false.
WhatsApp does not give governments a “backdoor” into its systems and would fight any government request to create a backdoor. The design decision referenced in the Guardian story prevents millions of messages from being lost, and WhatsApp offers people security notifications to alert them to potential security risks. WhatsApp published a technical white paper on its encryption design, and has been transparent about the government requests it receives, publishing data about those requests in the Facebook Government Requests Report.
A group of security experts corroborated WhatsApp’s story shortly thereafter. Zeynep Tufekci took the charge on the open letter, which insists, “The behavior described in your article is not a backdoor in WhatsApp. This is the overwhelmingconsensus of the cryptography and security community,” as it is of Tufekci’s cosigners.
Moreover, the security experts criticized the lack of outside sources cited by the Guardian. “If you had contacted independent security researchers, many of whom, including the EFF, have written pieces calling your story irresponsible, they could have explained the issue to you and suggested how to report it responsibly,” the letter reads. “Your story notably lacks quotes, responses, or explanations by security experts in the field. Instead, it hinges on the claims of a single well-meaning graduate student.”
The Guardian issued its initial response in late January:
We ran a series of articles highlighting and discussing a verified vulnerability in WhatsApp and its potential implications. WhatsApp was approached prior to publication and we included its response in the story, as well as a follow up comment which was received post-publication. While we stand by our reporting we have amended the article’s use of the term ‘backdoor’ in line with the response and footnoted the articles to acknowledge this. We are aware of Zeynep Tufekci’s open letter and have offered her the chance to write a response for the Guardian. This offer remains open and we continue to welcome debate.
The original article has been amended with the conclusions of the Guardian’s comprehensive review. The news agency also took the opportunity to highlight the strength of its journalism, following up its apology with a request for contributions. “The Guardian’s independent, investigative journalism takes a lot of time, money and hard work to produce,” the article notes.
Update: Added The Guardian’s official retraction in June.
WhatsApp now lets you send self-destructing voice messages
If you’re on WhatsApp and regularly make use of the view once feature for photo and video messages, then you might be interested to learn that the feature has now been expanded to voice messages.
WhatsApp’s view once feature does what it says, deleting a message after it’s been viewed a single time. It’s been available for photos and videos since 2021, but now you can also send voice messages that can only be played once before they, too, disappear from the app.
WhatsApp used to be one of my favorite apps. Now, I can’t stand it
For the best part of the last decade, WhatsApp has been my primary means to stay in touch with friends, family, peers at work, and even strangers. Texting is not as prevalent in my country, India, as it is in the U.S. for reasons such as the sheer dominance of Android users (as well as the diminutive share of iOS, and therefore, iMessage users), capped carrier costs for SMS-based messaging, and the poor understanding of RCS.
WhatsApp, on the other hand, is more widely used here than any other communication medium, primarily because it's free and allows the exchange of a multitude of types of media without being limited by national borders. People of all ages use and love it -- and they collectively send enough messages to clog up the internet.
Lapse app: what you need to know about the new Instagram killer
It seems like new apps don't create much excitement nowadays, but one app has caught people's attention recently. It's called Lapse, and it's a photo-sharing app that is currently only available through invitation.
The app was created to allow you to share photos with friends, not with followers, in fun new ways. Friends versus followers might seem a bit confusing, but it becomes clearer once you understand how the app operates.
