WhatsApp users can invite users to public groups by sharing invite links online. However, as it turns out, Google’s indexing algorithms are indexing these WhatsApp group invites, which show up in Google searches. A simple search with the ‘chat.whatsapp.com’ keywords serves thousands of results to public WhatsApp groups.
Your WhatsApp groups may not be as secure as you think they are.
— Jordan Wildon (@JordanWildon) February 21, 2020
The "Invite to Group via Link" feature allows groups to be indexed by Google and they are generally available across the internet. With some wildcard search terms you can easily find some… interesting… groups. pic.twitter.com/hbDlyN6g3q
Jordan Wildon, a multimedia journalist for Germany-based DW News discovered the results. He adds that one can look for varied groups based on some wildcard search terms, some of which may contain objectionable or sensitive content. Interestingly, another Twitter user responded to Wildon’s tweet with a response from Facebook from back in November 2019, acknowledging the fact that Google indexes these links, and that it is something that the social media giant cannot control.
I reported to facebook in early november pic.twitter.com/QB7pHsz5vu
— HackrzVijay 💻 (@hackrzvijay) February 21, 2020
Jane Manchun Wong, well known for reverse engineering app code to discover features, added in a tweet that this indexing was due to a misconfiguration for WhatsApp. She notes that the indexing should have been disallowed with robots.txt or with the `noindex` meta tag.
While Google has not provided a comment or a clarification yet, a WhatsApp spokesperson responded to Vice media group’s request for comment:
Group admins in WhatsApp groups are able to invite any WhatsApp user to join that group by sharing a link that they have generated. Like all content that is shared in searchable, public channels, invite links that are posted publicly on the internet can be found by other WhatsApp users. Links that users wish to share privately with people they know and trust should not be posted on a publicly accessible website
It is not clear as to if and when the indexing will stop, or if the suggestion from Wong indeed is the right solution. For the time being though, it is best for WhatsApp users to not share invite links in public forums or the like. Links sent via secure, encrypted services cannot be indexed or read and that would be the best option for sharing them.