This WhatsApp error can publish your information on Google

Everything is in Google. And maybe your personal data too. Can you imagine that a simple search on this engine would return your phone number? Well, they have discovered that thanks to WhatsApp groups this assumption is not far from reality. The WhatsApp group invitation system may be putting your privacy at risk because of Google. Or WhatsApp. We explain it here.

It was the researcher Jane Manchun Wong who raised the alarm on Twitter.Their reverse engineering techniques usually uncover new functions of social networks and applications such as WhatsApp or Instagram, but on this occasion they have demonstrated a dangerous practice of the most widely used messaging application in the world. And it comes hand in hand with WhatsApp groups. Or more specifically, the function sending invitations to one of these groups

A misconfiguration by WhatsApp enabled ~470k Group Invite links to be indexed by search engines

It should've been `Disallow`ed with robots.txt or with the `noindex` meta tag

thanks @JordanWildon for the tip https://t.co/CJxjJ5qyfh pic.twitter.com/FrW1I9Y8vs

- Jane Manchun Wong (@wongmjane) February 21, 2020

Google indexes everything

WhatsApp group administrators can invite other users to join by generating a link to that group.The problem is where that link is shared. And it is that, if it ends up being published on an Internet page, the indexing or “documentation” system captures it and makes it traceable In other words, in the words of a WhatsApp spokesperson to Vice: Like all content that is shared on public search channels, other WhatsApp users can find invite links that are posted on the Internet. That is, if it is on the Internet, it can be searched and found.

After testing, Vice was able to find references and these links to private groups on Google. They have even been able to access one of them and discover and collect the phone numbers of the 48 participants. Do not forget that, once inside the group, in the information screen of the group, you can check who the members are and their phone numbers Even if you don't you know of nothing Therein lies the danger of this practice.

In addition, it must be taken into account that the participants of a group do not know if the administrator or administrators have shared this link or group invitation link on any web page. There is no type of notification that alerts the user to, for example, leave the group and stop exposing their phone number to anyone looking for the reference “chat.whatsapp.com ” on Google But action is already being taken.

WhatsApp has taken a step forward

Despite the fact that WhatsApp's initial statements to Vice showed what had happened as normal, researcher Manchun Wong has discovered that they have indeed set to work to solve this problem. In one of her investigations, she has verified that WhatsApp, and not Google, has begun to use tools such as the “noindex” label in the group invitation linksSomething that would prevent Google spiders, as its Internet indexing system is popularly known, from collecting and making this data accessible. But the problem is still there.

In fact the search results of these links to groups are still present in other engines that have copied the data from Google. In other words, you can continue searching on pages like DuckDuckGo for this type of invitations to WhatsApp groups and find some of them. So it is a first step but not the final one to end this WhatsApp security problem.

It's great to see WhatsApp taking steps to fix the oversight. It's only the first steps though, because, as an open web,

the search results are still listed on other search engines like Yandex, Bing and DuckDuckGo pic.twitter.com/hTth6HciEe

- Jane Manchun Wong (@wongmjane) February 22, 2020

How to protect yourself

WhatsApp groups are still a practical but risky utility for privacy. Both for not being able to control the information that is shared, and for not knowing who is invited to said gathering. All this without forgetting the main key to all of this: our telephone number is always shown to the rest of the participants Even when they are not our direct contacts.

What can we do? Simple: avoid groups that are not safe, where we know all participating members. And leave the rest as soon as possible to stop sharing our phone number happily with the rest.

There is another even more definitive option: totally block yourself from WhatsApp groups. The application allowed, with a new measure launched a few months ago, to prevent anyone from adding us to a new group.Thus, first we would be presented with an invitation that we can reject if we do not want to participate. To do this you must open WhatsApp, display the menu with the three points and access the Settings. Here, click on Account and enter the Privacy space. This is where you will find the Groups submenu, where you must choose the option My contacts, except… If you mark the entire list of contacts, WhatsApp will prevent strangers and also acquaintances who introduce you to groups. Not without first letting you know by means of a notification that you can reject if you are not interested.

Beware of WhatsApp groups

Hopefully WhatsApp will solve these problems in the future. You have already shown interest by reacting quickly to Google's indexing blocks. However, there are many loose fringes regarding the privacy and security of the groups.We cannot forget another of the major problems of this function: harassment

Groups continue to be a formula to reconnect with a person who has blocked us on WhatsApp You just have to give the number phone a third party (C) and create a group with him (A) and with us (B). In this way, even though number A has blocked number B, thanks to the group formed by C we can once again have direct contact. Hence, protecting yourself from groups with the aforementioned trick is key when it comes to ensuring our privacy. However, it is a concept that is somewhat unknown to most WhatsApp users, who do not configure the security and privacy aspects of this application at any time. Or, at least, not those that go beyond protecting the profile photo. But the problem is still there: we need to manage our phone numbers to use WhatsApp. And this always puts us at risk.