WhatsApp: Random group chats are open to everyone - I end up in a hentai group
Many invitation links to WhatsApp groups are publicly visible. The group links can be manipulated. That's how I end up at anime porn.
Until recently, anyone could search for and join other people's WhatsApp groups using a simple link in Google. With other search engines, you can still use this feature today to join other people's groups.
This is possible because of the WhatsApp group invitation links. The links are designed to give colleagues easy access to your group. The fact that a link is enough to join a group is intentional on WhatsApp's part. What is less intentional is that these links are suddenly circulating on the internet.
Anybody who has such a link can join any group.
What happened
Journalist Jordan Wildon discovered by chance that the partial link "chat.whatsapp.com" can be used to search for other people's groups in Google and, logically, these groups can also be easily joined thanks to the link displayed.
The links of around half a million groups were indexed and visible on Google. The links can still be found on other search engines, such as the Russian Yandex.
This is not new
Twitter user HackrzVijay responded to Wildon's tweet. He reported the problem to Facebook last November. The company replied that the easily accessible links were a deliberate product decision. And that Facebook could not control what the search engines would index. You can find the tweet with Facebook's response here
The problem with the links: Once you have the group link, it has always been the case that you can join WhatsApp groups. This is because WhatsApp employees a blacklist approach. This means that WhatsApp only determines who is blocked. But anyone who is not on a blacklist can join. In other words, access is granted by default. Indexing in search engines simply exacerbates the existing problem.
The opposite would be better and, above all, safer; the whitelist approach. No one can join here unless they are authorised. Google Docs, for example, works with the whitelist approach system. This allows you to set who can view or edit documents with the link.
The link manipulation or how I ended up in the hentai group
With the Russian search engine Yandex you can still find many chats at the moment - but mainly Russian or Indonesian ones. The links on the first few pages no longer work. And if you click on too many links, Yandex quickly realises this and classifies you as a robot. This means that you have to fill in a captcha every time. So it's rather uninteresting.
That's why I tried to change the links. That works surprisingly well.
I have no idea about scripts or systematically changing links, I just fiddled around in the editor. The front part of the link is always the same and at the back you can set the language. 22 characters can be changed.
I change a few links and then enter them in the browser. You can quickly see whether there is an active group under the link.
Suddenly I come across another active group. Out of habit, I click on "Join" without looking closely at the purpose of the group. A second look shows me that I have joined a very active hentai cosplay group from Brazil with 94 participants.
Of course, I don't see the chat before I join the group, but the profile pictures of the members and the group description are more than enough for me. I quickly leave the group again. That's it for tinkering with the links, I've seen enough.
What you can do as a group admin
If you are the administrator of a group and don't want other users trampling on your group, it's best to reset the group link. You can do this by displaying the link in the group settings and then clicking on "Reset link" at the bottom.
With the newly created link, you can at least be sure that it cannot be found by a search engine.
The link cannot be deactivated. For sensitive topics, however, it should be clear that you should not use a WhatsApp chat anyway. <p
Testing devices and gadgets is my thing. Some experiments lead to interesting insights, others to demolished phones. I’m hooked on series and can’t imagine life without Netflix. In summer, you’ll find me soaking up the sun by the lake or at a music festival.