I've had a big privacy concern lately regarding the safety of my Whatsapp account. Ever since my phone was stolen from me and returned by certain malicious individuals, I've had the weirdest feeling that they secretly "spy" on my Whatsapp messages. I've been told I've left "seen" on my friends' messages at times when I was almost certain I didn't use the phone. Other times I've had the weirdest feeling that they "know" the content of my messages, as they would nonchalantly just say something I texted recently they couldn't have known without, well, snooping on my messages. But as paranoid and insecure as I am, I cannot quite tell if it's just my overly active imagination playing on me, or if it's actually possible that my Whatsapp account's been hacked. I've attempted to solve this myself and I didn't have any luck since half of the information on the internet regarding this is either strongly claiming this is possible while the other one claims this is NOT possible, both with little or no evidence or explanation to suggest the either one. So, I understand how Whatsapp works:

1.) Your number is tied to your public key stored in the database

2.) Your public key is generated on your phone when you verify the account by OTP

3.) When you change your device, a new OTP is sent to your number and a new public key is generated. This public key is now valid, while the old one is no longer. Your account is not active on your old phone. (Because Whatsapp doesn't support more than one device per account at the time, except for Whatsapp web.)

Now, my main concern is, since the private key is generated locally (i.e. on your smartphone), is it possible to fool the app into generating the SAME public key as on your old phone, essentially fooling the database into thinking that only one device is connected to your account?

Internet claims this can be apparantly done by spoofing the MAC address and obtaining the confirmation code sent to the phone associated with the account that's being "hacked". Next step is to delete the confirmation code SMS off the phone to remove any proof.

Reasons why I think it's not possible:

1.) It would be a safety hole, actually you can easily figure out a MAC of a device if it's on your local network without even looking into the phone settings -> about. Your password would essentially be only as strong as your grip and any screen lock you have on (I've had none)

2.) It is possible that two devices by accident have the same MAC address

3.) I don't think Whatsapp would just so easily let people bypass their security features.

Reasons why I think it could be:

1.) A part of the internet says so

2.) My experiences (but keep in mind I tend to be a bit paranoid over security issues)


You must log in to answer this question.

Browse other questions tagged .