How WhatsApp's ‘View Once’ Feature Isn't as Secure as You Think

WhatsApp’s View Once feature is designed to make photos, videos, and voice messages disappear after they’re opened, but it shouldn’t be treated as foolproof privacy. Recipients may still be able to capture or preserve content using another device or other workarounds, and once something has been shared, you lose some control over it. View Once is useful for reducing how long sensitive content stays in a chat, but it is not a guarantee that the content can never be saved or seen again.

Key takeaways

• View Once media disappears from the chat after it has been opened, but that doesn’t make it impossible to preserve.
• Don’t use View Once for highly sensitive information that could cause harm if copied or shared.
• Only send private content to people you trust, even when using disappearing or one-time-view features.
• Bitdefender Mobile Security (Android & iOS) can help protect against malicious links and scams on WhatsApp, but it cannot control what a recipient does with content you voluntarily send.

A recent cybersecurity development puts WhatsApp user privacy in the spotlight, as one of the popular messaging app’s features has been shown to have a significant flaw.

WhatsApp ‘View Once’ Bypassed by Researchers

WhatsApp boasts a privacy-focused feature meant to make photos, videos, voice messages and other media content viewable only once by the recipient. However, security experts discovered that a flaw in WhatsApp’s web app could render the feature useless.

Tal Be’ery and the Zengo X Research Team have pointed out that this privacy setting could be easily bypassed on platforms other than the mobile app, such as WhatsApp Web. The researchers have shown that, with simple modifications, users could permanently bypass the ephemeral nature of “View Once” media, making it not only fail to disappear, but also allowing them to save it, redisplay it, or forward it to others.

WhatsApp Web Handles Temporary Content as Regular Media

The technical issue stems from the fact that “View Once” media are handled like regular media, with only a simple flag preventing further viewing. However, attackers could alter this flag from “true” to “false,” rendering the media accessible indefinitely.

Threat actors could exploit this vulnerability using either patched mobile clients or web extensions that modify the genuine WhatsApp Web experience.

Despite the serious privacy implications, the problem persists mainly due to WhatsApp’s lack of a robust Digital Rights Management (DRM) system that could enforce stricter access control and verification mechanisms.

DRM Mechanism Among Proposed Fixes

Researchers proposed two possible fixes: implementing a comprehensive DRM mechanism that includes hardware verification, or restricting “View Once” messages solely to the primary devices, such as mobile phones, which would reduce, but not eliminate, the risk.

The second suggested fix would eliminate the “View Once” feature from companion linked devices (primarily web and desktop apps), but it would only defeat extensions and wouldn’t eliminate the issue from patched mobile clients.

WhatsApp Has Yet to Address the Vulnerability

WhatsApp has yet to disclose plans to address this vulnerability, leaving many users questioning the reliability of privacy features in popular communication apps. In light of these findings, users should remain cautious about sending sensitive information through “View Once” until WhatsApp provides a solution to ensure true privacy protection.

It’s also crucial for people to understand the risks associated with digital communication tools and take steps to safeguard their personal data. Our guide on digital privacy can provide essential strategies to protect your sensitive data from being exposed to intrusions.

Frequently Asked Questions (FAQs)

Is WhatsApp View Once secure?

It improves privacy, but it is not completely secure. View Once content disappears after opening, yet recipients may still preserve it using another device or other workarounds.

Is it possible to see View Once on WhatsApp again?

Normally, no. Once View Once media has been opened, it disappears from the chat and cannot be reopened through WhatsApp.

Can you tell if someone opened a View Once message on WhatsApp?

Yes, in many cases WhatsApp will show that the View Once item has been opened. However, this may depend on privacy settings such as read receipts.