Google has been found to be indexing WhatsApp invite links – so anyone who has posted direct links to their chat group on the world wide web could inadvertently be exposing their private details to the entire internet.
The issue was recently highlighted by Jordan Wilson, a journalist at DW News. Broadcasting the news via Twitter, he posted a screenshot demonstrating the plethora of group links he’d managed to find online via a simple Google search:
Your WhatsApp groups may not be as secure as you think they are.
The "Invite to Group via Link" feature allows groups to be indexed by Google and they are generally available across the internet. With some wildcard search terms you can easily find some… interesting… groups. pic.twitter.com/hbDlyN6g3q
— Jordan Wildon (@JordanWildon) February 21, 2020
As a brief explainer, WhatsApp has an “invite to group via link” feature in the group settings page, which only a group admin can access. Clicking on this will generate a link that you can ping over to other individuals – anyone with access to this link could then join your chat, see your number, and look at all your public WhatsApp details.
Problems arise when these links are shared outside of private messaging, for example on message boards or forums.
Because Google is indexing these WhatsApp links, it makes them very easy to track down. A simple Google search of “chat.whatsapp.com” throws up an immeasurable number of invites to private groups.
Most of these are porn chat groups, which means that the details of both organisers and other participants are exposed on the internet. This is worrying in itself – but a quick scroll through the results has thrown up some extremely sinister results.
Joseph Cox from Vice’s Motherboard managed to gain access to a United Nations NGO chat group. Others claim to have found group chats with disturbing names that relate to child pornography and far-right organisations.
New: Google is letting anyone find invite links to some private WhatsApp groups. Here is one we joined that is supposed to be for United Nations NGOs judging by its description. Can see members and get numbers https://t.co/TzWjqQmm2P pic.twitter.com/jda25POc0h
— Joseph Cox (@josephfcox) February 21, 2020
Responding to Trusted Reviews‘ request for comment, WhatsApp reinforced the fact that links can only be found if they’re posted on the open internet, on a publicly accessible website.
Anyone who’s worried can revoke a link (if they’re the admin) or leave a group. The company also says that everyone’s numbers are shown as default because this lets users see who will receive their message.
The company also issued the following statement:
“Group admins in WhatsApp groups are able to invite any WhatsApp user to join that group by sharing a link that they have generated. Like all content that is shared in searchable, public channels, invite links that are posted publicly on the internet can be found by other WhatsApp users.
“Links that users wish to share privately with people they know and trust should not be posted on a publicly accessible website.”
When pressed about the groups discovered with names relating to child pornography, a WhatsApp spokesperson responded by saying that the company has a zero-tolerance policy around child sexual abuse and bans users immediately if they are found sharing content that exploits or endangers children.
They also stated that WhatsApp bans approximately 250,000 accounts each month suspected of sharing exploitative images of children and that the company relies on all available unencrypted information to detect and prevent this kind of abuse.
Related: How to turn on WhatsApp dark mode
In addition to this, the spokesperson pointed out that links may not necessarily even be active. After it removes a group, the link may remain in Google’s cache for a long time, but effectively be dead.
Google did not immediately respond to a request for comment. We’ll update this story if the company gets in touch.
Editorial independence
Editorial independence means being able to give an unbiased verdict about a product or company, with the avoidance of conflicts of interest. To ensure this is possible, every member of the editorial staff follows a clear code of conduct.
Professional conduct
We also expect our journalists to follow clear ethical standards in their work. Our staff members must strive for honesty and accuracy in everything they do. We follow the IPSO Editors’ code of practice to underpin these standards.
Editorial independence
Editorial independence means being able to give an unbiased verdict about a product or company, with the avoidance of conflicts of interest. To ensure this is possible, every member of the editorial staff follows a clear code of conduct.
Professional conduct
We also expect our journalists to follow clear ethical standards in their work. Our staff members must strive for honesty and accuracy in everything they do. We follow the IPSO Editors’ code of practice to underpin these standards.
