WhatsApp ‘Delete for Everyone’ Doesn’t Delete Media Files Sent to iPhone Users

Mistakenly sent a picture to someone via WhatsApp that you shouldn’t have?

Well, we’ve all been there, but what’s more unfortunate is that the ‘Delete for Everyone’ feature WhatsApp introduced two years ago contains an unpatched privacy bug, leaving its users with false sense of privacy.

WhatsApp and its rival Telegram messenger offer “Delete for Everyone,” a potentially life-saving feature on which millions of people today rely to escape the awkwardness of sending messages/pictures/videos to the wrong person.

As the name indicates, the ‘Delete for Everyone‘ feature has been intended to unsend mistakenly sent inappropriate messages—including photos and videos—from the recipient’s phone, or all members of a group.

In the case of WhatsApp, the feature is only available within 1 hour, 8 minutes, and 16 seconds of sending a message you want to delete.

However, it turns out that WhatsApp ‘Delete for Everyone’ feature doesn’t delete media files sent to iPhone users (with default settings) as it does from the Android devices, leaving them saved on the recipient’s iOS device even if the messenger chat screen displays you, “This message has been deleted.”

According to Shitesh Sachan, an application security consultant, who found this privacy issue and shared his findings exclusively with The Hacker News, the feature for WhatsApp for iOS has not been designed to delete received media files saved in the iPhone’s Camera Roll.

On the other hand, if you use ‘Delete for Everyone’ against an Android user, WhatsApp will delete the sent media files from the recipient device’s gallery as well.

#Telegram messenger patches a #privacy flaw in its “delete for everyone” feature that was not actually deleting shared images from the recipients’ devices stored under “/Telegram/Telegram Images/” folder; instead was only deleting it from the chat screen.https://t.co/JNgfUsNYYL

— The Hacker News (@TheHackersNews) September 9, 2019

It concerns because WhatsApp by default automatically saves all images/videos you receive via WhatsApp to your iPhone’s Camera Roll or Android’s Media Gallery, which otherwise can be turned OFF from the app’s settings, but very few people care about it.

Earlier this week, a similar privacy flaw was disclosed in the “Delete for Everyone” feature of the Telegram messenger, which the company patched immediately to keep the feature useful in situations for which it has primarily been designed.

However, when Sachan reported this issue to WhatsApp, the company refused to address the issue, saying:

“The functionality provided via “Delete for Everyone” is intended to delete the message and there is no guarantee that the media (or message) will be permanently deleted—the implementation focuses around the message presence in WhatsApp.”

WhatsApp Security team also argued that the “recipients may see your message before it’s deleted or if deletion wasn’t successful,” but the feature was not even designed to save you from out-of-the-hand scenarios where recipients move or save the media file manually or screenshot the chat.

Though WhatsApp said “there is no guarantee a message or the attachments will be deleted,” the company said it might make changes to this functionality and its implementation in the future.