{"id":13286,"date":"2020-02-21T20:09:18","date_gmt":"2020-02-21T19:09:18","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=13286"},"modified":"2020-12-13T06:44:56","modified_gmt":"2020-12-13T05:44:56","slug":"private-whatsapp-gruppeneinladungen-im-google-index","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2020\/02\/21\/private-whatsapp-gruppeneinladungen-im-google-index\/","title":{"rendered":"Private WhatsApp Group Invits in Google Search Index"},"content":{"rendered":"<p><img decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline;\" src=\"https:\/\/web.archive.org\/web\/20201105150152\/https:\/\/i55.imgup.net\/WhatsApp012eb9.jpg\" align=\"left\" \/>[<a href=\"https:\/\/www.borncity.com\/blog\/2020\/02\/21\/private-whatsapp-gruppeneinladungen-im-google-index\/\" target=\"_blank\" rel=\"noopener noreferrer\">German<\/a>]Imagine having a very private conversation with your family via WhatsApp group, where only people are invited to join. And then the whole world can find the group invitation and and join the group, and having the phone numbers of the group members.<\/p>\n<p><!--more--><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/vg02.met.vgwort.de\/na\/26b797822b3e4761b53bf5d5c7e143fd\" alt=\"\" width=\"1\" height=\"1\" \/>Personally, I have banned WhatsApp since the European GDPR came into effect for privacy reasons. So I can only test a little, but I think there is enough information for readers.<\/p>\n<h2>The WhatsApp Groups and the Google Search Index<\/h2>\n<p>WhatsApp has private groups to chat in that you can only join with invitations (invites). A link with an invitation is sent to potential participants. Jordan Wildon, a journalist, happened to notice that the invitation links appear in Google searches. He recently posted the <a href=\"https:\/\/twitter.com\/JordanWildon\/status\/1230829082662842369\" target=\"_blank\" rel=\"noopener noreferrer\">following<\/a> tweet.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p dir=\"ltr\" lang=\"en\">Your WhatsApp groups may not be as secure as you think they are.<\/p>\n<p>The \"Invite to Group via Link\" feature allows groups to be indexed by Google and they are generally available across the internet. With some wildcard search terms you can easily find some\u2026 interesting\u2026 groups. <a href=\"https:\/\/t.co\/hbDlyN6g3q\">pic.twitter.com\/hbDlyN6g3q<\/a><\/p>\n<p>\u2014 Jordan Wildon (@JordanWildon) <a href=\"https:\/\/twitter.com\/JordanWildon\/status\/1230829082662842369?ref_src=twsrc%5Etfw\">February 21, 2020<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Google apparently indexes these WhatsApp invitation links for private groups so that they are searchable. A simple search in Google using terms like:<\/p>\n<blockquote><p>\"Whats\" site:https: \/\/ chat[.]whatsapp[.]com<\/p><\/blockquote>\n<p>brings the collected invitations to the Google search page. The tweet <a href=\"https:\/\/twitter.com\/bensonmachariah\/status\/1230838986610028544\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a> makes further suggestions. Vice picked up the story <a href=\"https:\/\/www.vice.com\/en_us\/article\/k7enqn\/google-is-letting-people-find-invites-to-some-private-whatsapp-groups\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a> and inspected a WhatsApp group. The group claimed in the description that it was intended for a United Nations accredited NGO organization.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" title=\"WhatsApp Group member with telephone number\" src=\"https:\/\/video-images.vice.com\/test-uploads\/_uncategorized\/1582293414193-Image-from-iOS-1.png?resize=1050:*\" alt=\"WhatsApp Group member with telephone number\" width=\"373\" height=\"636\" \/>(Source: Vice)<\/p>\n<p>After joining, the editor could view a list of all 48 participants and their telephone numbers. The screenshot above shows the overview of the list of participants in this WhatsApp group, where the names and phone numbers of the members appear.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p dir=\"ltr\" lang=\"en\">Gets even worse, invite links to CP groups.<br \/>\nHow is this shit not taken down yet!<a href=\"https:\/\/twitter.com\/WhatsApp?ref_src=twsrc%5Etfw\">@WhatsApp<\/a> <a href=\"https:\/\/twitter.com\/Facebook?ref_src=twsrc%5Etfw\">@Facebook<\/a> <a href=\"https:\/\/t.co\/2XtFnvDF4o\">pic.twitter.com\/2XtFnvDF4o<\/a><\/p>\n<p>\u2014 johan Liebert (@johan_lieber) <a href=\"https:\/\/twitter.com\/johan_lieber\/status\/1230877328449761280?ref_src=twsrc%5Etfw\">February 21, 2020<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>A search seems to provide explosive insights that could also be revealing for prosecutors. A Google request from Vice remained unanswered. A Facebook spokesperson said<\/p>\n<blockquote><p>Group admins in WhatsApp groups are able to invite any WhatsApp user to join that group by sharing a link that they have generated. Like all content that is shared in searchable, public channels, invite links that are posted publicly on the internet can be found by other WhatsApp users. Links that users wish to share privately with people they know and trust should not be posted on a publicly accessible website.<\/p><\/blockquote>\n<p>A user already reported this in November 2019 to Facebook, according to the tweet below. So they know about it.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p dir=\"ltr\" lang=\"en\">It seems Facebook acknowledged this after <a href=\"https:\/\/twitter.com\/hackrzvijay?ref_src=twsrc%5Etfw\">@hackrzvijay<\/a> alerted them, suggesting that admins can invalidate the link.<\/p>\n<p>In the app, I could only generate a new link (which invalidates the old one), but couldn't disable it altogether.<a href=\"https:\/\/t.co\/AlPtuRxjbN\">https:\/\/t.co\/AlPtuRxjbN<\/a><\/p>\n<p>\u2014 Jordan Wildon (@JordanWildon) <a href=\"https:\/\/twitter.com\/JordanWildon\/status\/1230856479806279682?ref_src=twsrc%5Etfw\">February 21, 2020<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Only the WhatsApp user community seems clueless. Addendum: The same applies to Telegram, as the following tweet suggests.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p dir=\"ltr\" lang=\"en\">Same goes for telegram? <a href=\"https:\/\/t.co\/ytS30E56zX\">pic.twitter.com\/ytS30E56zX<\/a><\/p>\n<p>\u2014 Onkar Soundankar (@onkarsoundnkr77) <a href=\"https:\/\/twitter.com\/onkarsoundnkr77\/status\/1230843464427851776?ref_src=twsrc%5Etfw\">February 21, 2020<\/a><\/p><\/blockquote>\n<p><script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>But there are private groups in Telegram that are not searchable.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>[German]Imagine having a very private conversation with your family via WhatsApp group, where only people are invited to join. And then the whole world can find the group invitation and and join the group, and having the phone numbers of &hellip; <a href=\"https:\/\/borncity.com\/win\/2020\/02\/21\/private-whatsapp-gruppeneinladungen-im-google-index\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,1547],"tags":[117,69,431],"class_list":["post-13286","post","type-post","status-publish","format-standard","hentry","category-security","category-software","tag-google","tag-security","tag-whatsapp"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/13286","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=13286"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/13286\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=13286"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=13286"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=13286"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}