Available on WhatsApp since 2017, the delete messages for everyone feature does not prevent the person on the other end of the line from seeing the message even after deletion. The content sent can be saved on the sender’s computer or smartphone in different ways.
Worse, the application does not prevent users from this possibility. The Google Chrome extension Wa Web Plus, of Turkish origin, for example, provides the option of recovering text messages deleted by contacts while the user is online on WhatsApp Web.
Wanted by Sheet, WhatsApp claims that this extension violates the app’s policies. “We are studying the necessary actions. WhatsApp is not compatible with unofficial applications or extensions, as we cannot validate the security measures implemented by them.”
The extension also does not explain by what means it allows snooping on deleted messages, but it states, on its website, that it does not save users’ messages.
The tool’s privacy information states that the program accesses data saved in the browser and processes it locally on the computer, without sending it to other servers.
According to information from the Google Chrome extension store, WA Web Plus was reviewed by Google programmers.
Still, the application represents a risk to the privacy of those who choose to use it, assesses the public interest technologist at the Aaron Swartz Lucas Lago Institute, also a master at the USP Polytechnic School. To work, this extension stores everything the user sends and the people behind the application can manipulate this information in different ways.
“Installing this extension is potentially exposing all of your WhatsApp conversations to developers.”
The Notification History app available in the Google app store, Play Store, works in a similar way: it records the text of all messages received from cell phone notifications, although it cannot access images and audio.
“It’s a nightmare from a security point of view and it amazes me that Google keeps this in their store,” says Lago.
In the digital programming library GitHub, there is also a code registered under the name What’s Hidden that shows in detail how to retrieve messages. The program accesses content directly via the WhatsApp server through QRCode verification (the same one used to access WhatsApp Web). In this case, the application also accesses images, videos and audios.
The creator of this code himself claims that he is not a trustworthy person. “Consider that this application will have full access to your account. However, this project is at least open source and can be understood differently than obscure applications for Android and Google Chrome.”
Downloading extensions and applications from unknown sources always poses a risk of device contamination by malicious programs and data leakage.
The information area about the WhatsApp message deletion feature also informs that people who use the application on Apple devices can keep copies of the media files received in the Photos app, even after the interlocutor deletes them.
WhatsApp also prevents the user from receiving a notification if it is not possible to delete their message for everyone.
For those who want to avoid misunderstandings on the messaging platform at any cost, there are no options other than taking extra care when sending messages and ensuring that the text reaches the correct sender.
WhatsApp announced the delete feature for everyone in 2017, years ago. At the time, the user had around seven minutes to delete the message. Since 2022, this deadline has been extended to around two days after sending.
Group administrators can also delete messages sent by other participants. They also have about two days to trigger the appeal.
In the questions and answers section of the application, WhatsApp states that it is not possible to recover messages deleted by an administrator, although it is possible to do so with the help of WA Web Plus and other extensions and applications.