Your private WhatsApp group chats could be a Google Search away from being compromised
The "Invite to Group via Link" feature allows groups to be indexed by Google and they are generally available across the internet. With some wildcard search terms you can easily find some… interesting… groups. All it takes is a simple Google search.
A journalist for DW News this week tweeted out a grim warning: "Your WhatsApp groups may not be as secure as you think they are."
The reason for his concern? Invite links for WhatsApp groups are being indexed by Google's search engine, meaning that if a link to your private group exists anywhere on the internet, anyone could potentially find the link and join your group with just a quick Google search.
Doing so is as simple as typing in "site:chat.whatsapp.com" into the search bar on Google. Once you do, you can see that Google has indexed up to 470,000 such links, meaning hundreds of thousands of groups could potentially be accessible this way.
Admittedly, some of these links could have been intended for public sharing by their group administrators, but as discovered by Vice News and some Twitter users, some of the groups indexed by Google almost certainly weren't meant to be public.
You can find groups belonging to NGOs and other organizations. Some of the indexed groups possibly also contain illegal material, with one Twitter user even identifying groups that seemingly pertain to child pornography.
WhatsApp has issued the following statement to Vice:
Group admins in WhatsApp groups are able to invite any WhatsApp user to join that group by sharing a link that they have generated. Like all content that is shared in searchable, public channels, invite links that are posted publicly on the internet can be found by other WhatsApp users. Links that users wish to share privately with people they know and trust should not be posted on a publicly accessible website.
However, as app reverse-engineer Jane Manchun Wong points out, WhatsApp could have avoided many of these groups being indexed by changing some of the settings associated with group invite links, such as by using the 'noindex' meta tag.
The issue had been pointed out to Facebook's bug bounty program by a researcher last year, but the company ruled that it did not warrant a bounty with a statement similar to the one given to Vice.
The reason for his concern? Invite links for WhatsApp groups are being indexed by Google's search engine, meaning that if a link to your private group exists anywhere on the internet, anyone could potentially find the link and join your group with just a quick Google search.
Doing so is as simple as typing in "site:chat.whatsapp.com" into the search bar on Google. Once you do, you can see that Google has indexed up to 470,000 such links, meaning hundreds of thousands of groups could potentially be accessible this way.
Admittedly, some of these links could have been intended for public sharing by their group administrators, but as discovered by Vice News and some Twitter users, some of the groups indexed by Google almost certainly weren't meant to be public.
You can find groups belonging to NGOs and other organizations. Some of the indexed groups possibly also contain illegal material, with one Twitter user even identifying groups that seemingly pertain to child pornography.
WhatsApp has issued the following statement to Vice:
Group admins in WhatsApp groups are able to invite any WhatsApp user to join that group by sharing a link that they have generated. Like all content that is shared in searchable, public channels, invite links that are posted publicly on the internet can be found by other WhatsApp users. Links that users wish to share privately with people they know and trust should not be posted on a publicly accessible website.
However, as app reverse-engineer Jane Manchun Wong points out, WhatsApp could have avoided many of these groups being indexed by changing some of the settings associated with group invite links, such as by using the 'noindex' meta tag.
The issue had been pointed out to Facebook's bug bounty program by a researcher last year, but the company ruled that it did not warrant a bounty with a statement similar to the one given to Vice.
AI Disclaimer: An advanced artificial intelligence (AI) system generated the content of this page on its own. This innovative technology conducts extensive research from a variety of reliable sources, performs rigorous fact-checking and verification, cleans up and balances biased or manipulated content, and presents a minimal factual summary that is just enough yet essential for you to function as an informed and educated citizen. Please keep in mind, however, that this system is an evolving technology, and as a result, the article may contain accidental inaccuracies or errors. We urge you to help us improve our site by reporting any inaccuracies you find using the "Contact Us" link at the bottom of this page. Your helpful feedback helps us improve our system and deliver more precise content. When you find an article of interest here, please look for the full and extensive coverage of this topic in traditional news sources, as they are written by professional journalists that we try to support, not replace. We appreciate your understanding and assistance.
