Google is indexing invite links to private WhatsApp groups

WhatsApp's private links aren't so private any more

Google has indexed thousands of invite links to WhatsApp private groups, meaning all of those groups can be found in a Google search by using the right search terms.

Jordan Wildon, a multimedia journalist for German outlet Deutsche Welle, reported the error last week.

"Your WhatsApp groups may not be as secure as you think they are," he wrote on Twitter.

WhatsApp is one of the most popular messaging platforms in the world. It is particularly popular in India, the UK, France and Spain. Earlier this month, the platform announced it had reached the milestone of 2 billion users.

Private chat groups on WhatsApp are usually only accessible through an invite link. The group creators (admins) send this link to all users whom they want to be a participant in their private chat group. After a user clicks on the link, they become a member of the group.

However, Google's indexing of invite links allows anyone to access those URLs and join private groups on WhatsApp.

Once a user joins a private group, they can see all members of the group and their phone numbers.

Reverse app engineer Jane Manchun Wong tweeted that she had found nearly 470,000 group invite links on Google by doing a simple search for the "chat.whatsapp.com" URL.

Facebook,WhatsApp's parent company, has been aware of the issue since November 2019, according to Twitter user 'Hackrzvijay', who said he had alerted the company about the flaw in the expectation of receiving some sort of bug bounty. However, the company said the flaw was actually an 'intentional product decision'.

Google's public search liaison, Danny Sullivan, said the search engine was working as intended when indexing WhatsApp invite links.

Sullivan said if WhatsApp did not want those links to be indexed, it should use a 'norobots.txt' or a 'noindex' meta tag to stop it happening.

In a statement to Vice, a WhatsApp spokesperson said that it was the responsibility of the group admins and users not to post invite URLs on a publicly accessible website.

"Like all content that is shared in searchable, public channels, invite links that are posted publicly on the internet can be found by other WhatsApp users," the spokesperson said.

"Links that users wish to share privately with people they know and trust should not be posted on a publicly accessible website."