In plain words
Imagine you have a house with many doors, and each door represents a device like your phone or computer. Normally, when you lock one door, like your phone, it stays locked. But if you give someone a key to link your phone to another device, like a computer, they can use that key to unlock the computer door and see what's inside, even if the phone door is still locked. This is similar to what's happening with messaging apps like WhatsApp and Signal when you link your account to another device.
What's broken
The issue here is that when you link your messaging app account to another device, like a computer, you're essentially giving that device a key to access your account. This means that if someone else, like a hacker or the police, can get access to that linked device, they can read your messages without having to break the encryption¹ that protects them.
How it actually works
Here's how it works: when you link your phone to another device, like a computer, using a feature like WhatsApp Web or Signal Desktop, you're creating a connection between the two devices. This connection allows messages to be sent to both devices. If someone can get control of the linked device, they can use this connection to read messages sent to your account, even if they can't access your phone directly. This is because the linked device is essentially trusted by the messaging app to receive messages, so it doesn't need to break the encryption¹ to read them.
Proof of concept
It's not clear from the source if there's a public proof-of-concept² that demonstrates this issue, but the fact that Germany's Customs Office has been using this method to access suspects' accounts shows that it's a real and viable technique.
Is it real
It appears that this technique is being used in the real world, as evidenced by Germany's Customs Office using it to access suspects' accounts. However, it's not clear how widespread this practice is or if there are any limiting factors that might prevent it from being used more broadly.
What to do
To protect yourself from this issue, you should be cautious when linking your messaging app account to another device, and make sure you understand the risks involved. You may also want to consider using features like two-factor authentication³ to add an extra layer of security to your account.
Terms
- ¹ encryption
- , a way of scrambling data so it can't be read without the right key
- ² proof-of-concept
- , a demonstration that a security flaw is real and can be exploited
- ³ two-factor authentication
- , a security feature that requires a user to provide two different types of verification, like a password and a code sent to their phone, to access an account