Using Device Linking to Eavesdrop on WhatsApp and Signal

Modern messaging platforms, such as WhatsApp and Signal, enable users to synchronize their phone accounts with their computer desktops. Criminals are exploiting this feature to surreptitiously monitor communications. WhatsApp Web and Signal Desktop applications facilitate this capability, enabling individuals to access their accounts via alternative devices, such as laptops or desktop computers.

Germany’s Customs Office has been leveraging this functionality to establish a connection between a police-monitored computer and a suspect’s account. Once linked, messages can be forwarded to the police computer without the necessity of decrypting the messages, which are protected by encryption. Netzpoltik, a German online magazine, reports that law enforcement can gain access to these communications in two ways: either by physically accessing the suspect's phone or by intercepting verification codes through a state-approved phishing scam or by tapping into SMS messages via telephone surveillance. It is crucial to note that this process requires the user's consent.

To address this issue, it is proposed that a feature be implemented to display connected devices, allowing users to detect if a new device has been linked to their account.