Germany’s Customs Office Used Linked Devices to Read Chats
Germany’s Customs Office has been linking police-controlled desktops to suspects’ WhatsApp and Signal accounts, according to Schneier on Security, letting messages arrive on the police machine without breaking end-to-end encryption. The report says this was done through the apps’ own device-linking feature, with access gained either by physical access to a phone or by intercepting verification codes.
The mechanism is ordinary but important: once a second computer is approved as a linked device, the app treats it like one of the user’s own endpoints and forwards future messages there too. That shifts the trust problem away from cryptography and toward the phone, the verification code, and the linked-device list.
For anyone using WhatsApp or Signal in a setting where a phone can be handled by someone else or a code can be intercepted, the exposure is not a cracked cipher but an added trusted endpoint. What remains open is how often this technique is used and how visible the extra link is to the account holder.
Using Device Linking to Eavesdrop on WhatsApp and Signal - Schneier on Security
Eavesdroppers are taking advantage of this capability: Apps such as WhatsApp Web and Signal Desktop allow people to use their accounts on other devices, such as laptops or desktop computers.