Using Device Linking to Eavesdrop on WhatsApp and Signal
Germany's Customs Office eavesdrops on WhatsApp and Signal by linking suspects' accounts to police computers via physical access, phishing, or SMS interception.
Germany's Customs Office has used WhatsApp Web and Signal Desktop device-linking to connect a police-controlled computer to suspects' accounts, receiving messages without breaking end-to-end encryption. According to Netzpolitik, access is gained through physical access to a phone, interception of verification codes via a state-sanctioned phishing attack, or SMS interception via telephone surveillance. Schneier argues the technique depends on user consent lapses and calls for apps to display connected devices so users notice unauthorized links.
- Device linking delivers messages to a police computer without breaking end-to-end encryption.
- Access requires physical phone access, phishing verification codes, or SMS interception via telephone surveillance.
- Schneier urges apps to display connected devices so users notice unauthorized linking.
Full article180 words · extracted from schneier.com · click to collapse
Modern messaging apps allow users to link their phone accounts to their computer desktop. Eavesdroppers are taking advantage of this capability:
Apps such as WhatsApp Web and Signal Desktop allow people to use their accounts on other devices, such as laptops or desktop computers.
Germany’s Customs Office has been using these features to connect a police-controlled computer to a suspect’s account.
Once connected, messages can be delivered to that computer without the police having to crack the encryption protecting them.
Netzpoltik details that police are able to gain access in this way either through physical access to someone’s phone or by intercepting verification codes via a state-sanctioned phishing attack or intercepting SMS messages via telephone surveillance.
That last paragraph is important. Making this work requires user consent.
What we want is a feature that displays connected devices, so users could notice if a new device gets connected to their account.
Tags: eavesdropping, law enforcement, police, Signal, WhatsApp
Sidebar photo of Bruce Schneier by Joe MacInnis.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.schneier.com/blog/archives/2026/09/using-device-linking-to-eavesdrop-on-whatsapp-and-signal.html