Private WhatsApp Groups Exposed On Google Search, But It’s A Feature [Update]

Update (24/02/2020, 7:00 PM IST): Initially, it seemed that WhatsApp didn’t give users even a single ray of hope after their private chats ended up on Google Search and on other search engines as well.

But according to an update posted by Jane Wong, the company was working quietly behind the curtain. Now, making a search for the said private chat invite links on Google brings nothing but an error message. Whatsapp has delisted the invitation links from Google by including the “noindex” meta tag.

The original post continues from here.

Google is indexing the invitations to the WhatsApp Group chats, including the links to join private groups as reported by Vice. As a result, the links are available for people all around the globe to join any discoverable group.

Your WhatsApp groups may not be as secure as you think they are.

The “Invite to Group via Link” feature allows groups to be indexed by Google and they are generally available across the internet. With some wildcard search terms you can easily find some… interesting… groups. pic.twitter.com/hbDlyN6g3q

— Jordan Wildon (@JordanWildon) February 21, 2020

Multimedia journalist Jordan Wildon tweeted and raised a question over WhatsApp’s security. He said that WhatsApp’s ‘Invite to Group via Link’ feature permits Google to index groups, which then become available all over the internet for everyone to join.

Vice discovered several private groups with the help of specific search queries. The result page consisted of a lot of groups meant for porn sharing. Once anyone joins the group, they have permission to view all the participants and their phone numbers.

Popular reverse engineering enthusiast Jane Manchun Wong said in her tweet that a misconfiguration from WhatsApp is allowing Google to index group invite links. She suggested that there are ways to deindex the invite links from Search.

A misconfiguration by WhatsApp enabled ~470k Group Invite links to be indexed by search engines

It should’ve been `Disallow`ed with robots.txt or with the `noindex` meta tag

thanks @JordanWildon for the tip https://t.co/CJxjJ5qyfh pic.twitter.com/FrW1I9Y8vs

— Jane Manchun Wong (@wongmjane) February 21, 2020

A WhatsApp spokesperson said that group admins can invite any user to join their group by sharing the invite link. Like all other content available on the open web, invite links posted on public platforms are also searchable. He concluded his statement by saying that admins should make sure that they share the group link with trusted people only.

Google’s Take

Google refused to comment on the scenario going on. However, Google official Danny Sullivan tweeted that search engines like Google index pages from the open web. The same thing happened in the case of invite links to WhatsApp groups.

He concluded by saying that WhatsApp as a website has allowed listing the invite links publically. Sullivan also added a link in his tweet, which redirected people to the Help Center to block content to be displayed from the Google search results.

So, it seems that things are designed this way, even if they pose a threat to users’ privacy. Users are advised not to share personal WhatsApp group links on public platforms until WhatsApp announces any under-the-hood changes.