Discussion
On iOS and macOS, WhatsApp stores chat databases unencrypted in an app group container accessible to apps from the same developer. So all Meta apps on the same iPhone (e.g., Facebook) can read WA chats in plaintext without permission, and users wouldn't be notified.
This is a demo we prepared recently to show a macOS bug that allowed unrestricted access to protected app containers. WhatsApp stores data at rest without encryption.
@mysk Interesting exchange on, dare I say it, X: 🧵
This is misleading. While it is true that WhatsApp's database is not encrypted on the device, it is stored in a secure container that only the app can access. If there are system-level exploits that allow another app or process to access its contents, it is up to the operating system to fix them.
The claim that other Meta apps can access the WhatsApp database is incorrect. The database is in a shared container to enable WhatsApp to easily migrate data to WhatsApp Business. Other Meta apps, such as Facebook and Instagram, cannot access this container.
Specifically, containerURLForSecurityApplicationGroupIdentifier:@"http://group.net.whatsapp.WhatsApp.shared" returns NULL if called from Facebook, Instagram, Messenger, Edits, and other Meta apps. Only WhatsApp Business can access that container to migrate data to WhatsApp Messenger. Similarly, WhatsApp cannot access the containers of other Meta apps, such as those of Facebook (http://group.com.facebook.Facebook) and Instagram (http://group.com.burbn.instagram). However, Edits can access Instagram's shared container.
As a result, WhatsApp's data is isolated within its own app group container. Cross-app access is not possible under normal system permissions
You need to log in to see that page.
Install bonfire.cafe
Get the full app experience
