Eavesdropping Does Not Require Breaking Encryption

A computer you do not control can receive your private messages while the encryption works exactly as designed. Link that computer to the account, and the messaging app has another device to deliver to. The security problem is how it became a recipient.Bruce Schneier’s September 29 post draws attention to this use of device linking in WhatsApp and Signal. The underlying reporting from netzpolitik.org describes German authorities using messaging clients to monitor accounts without installing a surveillance implant. It also documents a case in which police used temporary access to phones to activate WhatsApp Web. Permission to inspect messages on a phone did not amount to informed permission for continuing access.Eavesdropping in cybersecurity includes intercepting traffic, but it also includes quietly collecting conversations through a compromised account, an additional device, or software already running where the messages are readable. Obtaining that position may require phishing or…