5 ms·

How to Bypass WhatsApp Web's Locked Chat Feature

75 points by loncat4215 2y ago

thimabi 2y ago
I think my expectations for a feature called “locked chats” are somewhat different from those of WhatsApp. What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks? In this case, I think WhatsApp should have done better — or refrained from adding this feature at all.
- GrantMoyer 2y ago
  > What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks? Amusingly, these two questions apply just as well to almost all physical locks in the material world. I suppose that makes WhatsApp's "lock" analogy apt.
  - drdaeman 2y ago
    However, we should consider that this is about online privacy features, which is a fairly hot topic nowadays. And it kind of feels that we got drape curtains* instead of a lock - and I think it's not exactly what people would reasonably expect for a feature like this? Or do they clarify that it's a weak protection somewhere? ___ *) I mean, it can be unlocked by literally opening JS console and typing one command. That's a gate latch at best.
- 0xcoffee 2y ago
  Personally I use it to hide chats from my girlfriend who has access to my phone.
  - jonathanlydall 2y ago
    I totally get that hiding things from partners is a not uncommon thing. Speaking as someone who has lived with my wife for over 10 years and where we can each access each other’s phones (for reasons of administrative convenience), neither of us have ever “snooped” on each other. So when I hear of people taking advantage of features to hide chats from their partner it makes me wonder about the psychological health of either the relationship, one, or both of the partners. There are absolutely psychologically unhealthy controlling partners who “snoop” on their partners unreasonably dictating what is and isn’t allowed. And at the same time there are also unfaithful partners who are having the kind of conversations with other people that they really shouldn’t when they’re in a committed relationship. Only other reason I can think to hide chats are risqué group chats with friends posting arguably inappropriate content, but again, if your partner is snooping on this and then getting controlling, that’s not really healthy. Finally, I will admit I sometimes use incognito mode on my web browser at times (but never for conversations), so perhaps I’m a bit of a hypocrite.
    - lewisleclerc 2y ago
      I'm curious, for what reasons do you use incognito?
      - jonathanlydall 2y ago
        Aside from technical troubleshooting reasons, never for “social” interactions. For all other times, all I will say is that your guess is probably correct.
    - j6zauas4gz 2y ago
      > So when I hear of people taking advantage of features to hide chats from their partner it makes me wonder about the psychological health of either the relationship, one, or both of the partners. I am the exact opposite and would wonder about the psychological health of either the relationship or both of the partners if they have so intertwined themselves that they no longer feel the need to keep any aspect of their identities private from each other. > Only other reason I can think to hide chats The number of reasons are as numerous as there are relationships. I literally just finished sending my mother a message about a joint gift to my father in a group chat that I would not want my father to see, since it would spoil his Christmas present. I have several chat groups that contain information that I am legally not allowed to let my partner, or anyone else for that matter, see. And thats not even getting into all the different levels of confidentially that friends talking amongst friends reasonably might expect when sharing stories of their personal lives with each other.
  - yownie 2y ago
    sounds like a super healthy relationship.
- loncat4215 2y ago
  > In this case, I think WhatsApp should have done better — or refrained from adding this feature at all. At least they should encrypt the messages instead of making it seems like it's encrypted. AFAIK, in the mobile WhatsApp, locked chats will get wiped without screen lock or secret code. They make it seem like it's practically impossible to recover the messages without doing real crypto stuff on the locked chats' messages.
aperezalbela 2y ago
"Trying something?"
- loncat4215 2y ago
  ;)
netsharc 2y ago
Semi-related: On the old F1 website, they'd post the lap and sector times of drivers during an F1 session (practice, qualifying, race). First it was a Java app which had all the data, and then they got fancy and wrote it in JavaScript, and enshittified it: if you don't subscribe to their premium... website offering?.. you just get colored sectors whenever the driver's finished that sector (yellow as they've passed it, green if it's the fastest time they've driven through this sector, purple if it's the fastest of anyone, in the current session). I was wondering if they still had the sector times and just hid it on the frontend, and it was the case. There was an if-block that was called during initialization that checked if user was premium. Adding a breakpoint and adding a condition to set premium = true got me the sector times! And then they changed their app to use Unity and WASM, and it's all Assembly-esque in the developer tool.
- jillyboel 2y ago
  Yep, this is why I'm not a fan of WASM. It's going to make debugging/reversing webapps much, much harder while that has always been one of the charms of the web.
  - weikju 2y ago
    Also makes learning from other sites much harder, which I think is another fundamental appeal of the web.
- jwrallie 2y ago
  It’s always good to take a look, many things are decided on the client side, and developer tools are part of the browsers anyway. The other day I wanted to make reservations for a service to send my luggage from the airport to my house in Japan, and the form was giving me errors. Searching for the error string around I realized there was a timeout set on the client side, so I increased it and could slowly but smoothly fill in all the information that required a server check. I guess they never bothered to debug their system when accessing it from the other side of the world. All it needed was a few extra milliseconds for the requests to arrive in time.
beders 2y ago
It is a good reminder for front-end devs that security-through-obscurity is not sufficient. It never has. Reminds me of a security company that claimed they could force a watermark onto any content in their web-front-end. Turns out it was a canvas overlay you could just simple delete from the HTML. LOL.
- klysm 2y ago
  This is such a problem in security - executives don’t know that and will buy all sorts of security theatre bullshit
- Neywiny 2y ago
  I used a tool in school that outputted svgs with watermarks. So I proved that if I ever wanted to, though I never needed to, I could just delete that element. Trivial.
RandomDistort 2y ago
A lot of WhatsApp's features are enforced client-side, which means on Web they just break with DevTools. I've done some research into this (haven't published it) but also can't get Facebook's bug bounty report tool to work (whenever I create a facebook account it gets autobanned) so I haven't been able to report them either. I wonder if stuff like this would be eligible, I don't see why it wouldn't.
- loncat4215 2y ago
  > A lot of WhatsApp's features are enforced client-side, which means on Web they just break with DevTools. This is true. IIRC, there is also a "bug", I think it's unfixable due to WhatsApp's nature at the time, where you can send a message with a tampered quoted reply. It's also done in the DevTools by modifying the quoted message ID to something that doesn't exist. > I wonder if stuff like this would be eligible, I don't see why it wouldn't. I just reported it, let's see if it's eligible
  - RandomDistort 2y ago
    Ok, can you let me know if they say it's valid, as if it is considered valid I'll try again with investigating and reporting some issues I found.
rini17 2y ago
Is there also a bypass for the silly insufficient disk space error in whatsapp web, other than reloading the page?
- loncat4215 2y ago
  I've never experienced that, it does sound like a silly problem
  - rini17 2y ago
    It's this, not limited to opera. And various recommended settings did not help. It was previously possible to just delete the dialog box from DOM and continue, no more. https://superuser.com/questions/1856709/whatsapp-web-your-computer-does-not-have-enough-space-for-whatsapp-to-run-ple https://superuser.com/questions/1856709/whatsapp-web-your-co...
IG_Semmelweiss 2y ago
hugged to death : 503 Service Unavailable I turned off VPN.No dice.
- loncat4215 2y ago
  I'm sorry. It's online now.
unixfox 2y ago
https://web.archive.org/web/20241206210921/https://lcat.dev/post.php?id=3cf8e1b9-e5e3-4a6d-af27-12720c5b2d54 https://web.archive.org/web/20241206210921/https://lcat.dev/...

75 points by loncat4215 2y ago

I think my expectations for a feature called “locked chats” are somewhat different from those of WhatsApp. What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks? In this case, I think WhatsApp should have done better — or refrained from adding this feature at all.

GrantMoyer 2y ago
> What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks? Amusingly, these two questions apply just as well to almost all physical locks in the material world. I suppose that makes WhatsApp's "lock" analogy apt.
- drdaeman 2y ago
  However, we should consider that this is about online privacy features, which is a fairly hot topic nowadays. And it kind of feels that we got drape curtains* instead of a lock - and I think it's not exactly what people would reasonably expect for a feature like this? Or do they clarify that it's a weak protection somewhere? ___ *) I mean, it can be unlocked by literally opening JS console and typing one command. That's a gate latch at best.
0xcoffee 2y ago
Personally I use it to hide chats from my girlfriend who has access to my phone.
- jonathanlydall 2y ago
  I totally get that hiding things from partners is a not uncommon thing. Speaking as someone who has lived with my wife for over 10 years and where we can each access each other’s phones (for reasons of administrative convenience), neither of us have ever “snooped” on each other. So when I hear of people taking advantage of features to hide chats from their partner it makes me wonder about the psychological health of either the relationship, one, or both of the partners. There are absolutely psychologically unhealthy controlling partners who “snoop” on their partners unreasonably dictating what is and isn’t allowed. And at the same time there are also unfaithful partners who are having the kind of conversations with other people that they really shouldn’t when they’re in a committed relationship. Only other reason I can think to hide chats are risqué group chats with friends posting arguably inappropriate content, but again, if your partner is snooping on this and then getting controlling, that’s not really healthy. Finally, I will admit I sometimes use incognito mode on my web browser at times (but never for conversations), so perhaps I’m a bit of a hypocrite.
  - lewisleclerc 2y ago
    I'm curious, for what reasons do you use incognito?
    - jonathanlydall 2y ago
      Aside from technical troubleshooting reasons, never for “social” interactions. For all other times, all I will say is that your guess is probably correct.
  - j6zauas4gz 2y ago
    > So when I hear of people taking advantage of features to hide chats from their partner it makes me wonder about the psychological health of either the relationship, one, or both of the partners. I am the exact opposite and would wonder about the psychological health of either the relationship or both of the partners if they have so intertwined themselves that they no longer feel the need to keep any aspect of their identities private from each other. > Only other reason I can think to hide chats The number of reasons are as numerous as there are relationships. I literally just finished sending my mother a message about a joint gift to my father in a group chat that I would not want my father to see, since it would spoil his Christmas present. I have several chat groups that contain information that I am legally not allowed to let my partner, or anyone else for that matter, see. And thats not even getting into all the different levels of confidentially that friends talking amongst friends reasonably might expect when sharing stories of their personal lives with each other.
- yownie 2y ago
  sounds like a super healthy relationship.
loncat4215 2y ago
> In this case, I think WhatsApp should have done better — or refrained from adding this feature at all. At least they should encrypt the messages instead of making it seems like it's encrypted. AFAIK, in the mobile WhatsApp, locked chats will get wiped without screen lock or secret code. They make it seem like it's practically impossible to recover the messages without doing real crypto stuff on the locked chats' messages.

aperezalbela 2y ago

"Trying something?"

loncat4215 2y ago
;)

netsharc 2y ago

Semi-related: On the old F1 website, they'd post the lap and sector times of drivers during an F1 session (practice, qualifying, race). First it was a Java app which had all the data, and then they got fancy and wrote it in JavaScript, and enshittified it: if you don't subscribe to their premium... website offering?.. you just get colored sectors whenever the driver's finished that sector (yellow as they've passed it, green if it's the fastest time they've driven through this sector, purple if it's the fastest of anyone, in the current session). I was wondering if they still had the sector times and just hid it on the frontend, and it was the case. There was an if-block that was called during initialization that checked if user was premium. Adding a breakpoint and adding a condition to set premium = true got me the sector times! And then they changed their app to use Unity and WASM, and it's all Assembly-esque in the developer tool.

jillyboel 2y ago
Yep, this is why I'm not a fan of WASM. It's going to make debugging/reversing webapps much, much harder while that has always been one of the charms of the web.
- weikju 2y ago
  Also makes learning from other sites much harder, which I think is another fundamental appeal of the web.
jwrallie 2y ago
It’s always good to take a look, many things are decided on the client side, and developer tools are part of the browsers anyway. The other day I wanted to make reservations for a service to send my luggage from the airport to my house in Japan, and the form was giving me errors. Searching for the error string around I realized there was a timeout set on the client side, so I increased it and could slowly but smoothly fill in all the information that required a server check. I guess they never bothered to debug their system when accessing it from the other side of the world. All it needed was a few extra milliseconds for the requests to arrive in time.

beders 2y ago

It is a good reminder for front-end devs that security-through-obscurity is not sufficient. It never has. Reminds me of a security company that claimed they could force a watermark onto any content in their web-front-end. Turns out it was a canvas overlay you could just simple delete from the HTML. LOL.

klysm 2y ago
This is such a problem in security - executives don’t know that and will buy all sorts of security theatre bullshit
Neywiny 2y ago
I used a tool in school that outputted svgs with watermarks. So I proved that if I ever wanted to, though I never needed to, I could just delete that element. Trivial.

RandomDistort 2y ago

A lot of WhatsApp's features are enforced client-side, which means on Web they just break with DevTools. I've done some research into this (haven't published it) but also can't get Facebook's bug bounty report tool to work (whenever I create a facebook account it gets autobanned) so I haven't been able to report them either. I wonder if stuff like this would be eligible, I don't see why it wouldn't.

loncat4215 2y ago
> A lot of WhatsApp's features are enforced client-side, which means on Web they just break with DevTools. This is true. IIRC, there is also a "bug", I think it's unfixable due to WhatsApp's nature at the time, where you can send a message with a tampered quoted reply. It's also done in the DevTools by modifying the quoted message ID to something that doesn't exist. > I wonder if stuff like this would be eligible, I don't see why it wouldn't. I just reported it, let's see if it's eligible
- RandomDistort 2y ago
  Ok, can you let me know if they say it's valid, as if it is considered valid I'll try again with investigating and reporting some issues I found.

rini17 2y ago

Is there also a bypass for the silly insufficient disk space error in whatsapp web, other than reloading the page?

loncat4215 2y ago
I've never experienced that, it does sound like a silly problem
- rini17 2y ago
  It's this, not limited to opera. And various recommended settings did not help. It was previously possible to just delete the dialog box from DOM and continue, no more. https://superuser.com/questions/1856709/whatsapp-web-your-computer-does-not-have-enough-space-for-whatsapp-to-run-ple https://superuser.com/questions/1856709/whatsapp-web-your-co...

IG_Semmelweiss 2y ago

hugged to death : 503 Service Unavailable I turned off VPN.No dice.

loncat4215 2y ago
I'm sorry. It's online now.

unixfox 2y ago

https://web.archive.org/web/20241206210921/https://lcat.dev/post.php?id=3cf8e1b9-e5e3-4a6d-af27-12720c5b2d54 https://web.archive.org/web/20241206210921/https://lcat.dev/...