WhatsApp is rolling out a limited public beta test, which will bring multi-device capability to the platform. This will let users access the service on their phone and up to four other non-phone devices simultaneously.
WhatsApp says users will be able to access their messages on these other devices, even if their main phone’s battery has died. This will mark a change from the current setup where the phone remains the primary device for connectivity to continue on other devices.
Currently, WhatsApp linked to one account number only works on the phone. Users have the option of accessing it on their desktop via WhatsApp Web, but it is dependent on the phone for the connection to continue. With the new public beta, all of this will change.
In a blog post on the Facebook engineering site, the company says in the new multi-device support, “each companion device will connect to your WhatsApp independently while maintaining the same level of privacy and security through end-to-end encryption…”
WhatsApp has “developed new technologies to maintain end-to-end encryption” even as data such as contact names, chat archives, starred messages will sync across devices. According to the post, the company had to “rethink WhatsApp’s architecture and design,” in order to enable this.
How to get WhatsApp multi-device feature?
The feature has not yet rolled out to those using stable builds of WhatsApp so you might not be able to use this. According to the company’s blog post, the company plans to “test the experience with a small group of users from the existing beta program.”
It adds that they will continue “optimising performance and adding a few additional features before slowly rolling it out more broadly.” It is not clear if all Android and iOS beta users will get the feature.
So how does WhatsApp multi-device support work?
At the moment the primary device is the “only device capable of end-to-end encrypting messages for another user, initiating calls, etc.” Companion devices such as your desktop or laptop, are simply mirroring the content of WhatsApp on your phone and using their own user interface (UI).
Under the new system, the phone will no longer be the primary device and the user data will remain “seamlessly and securely synchronised and private,” according to the blog.
With multi-device support, each will now have its own identity key. This marks a change from the existing system where a user is identified by “single identity key from which all encrypted communication keys were derived,” the blog notes.
The post adds that the WhatsApp server will maintain a mapping between each person’s account and all their device identities. When someone wants to send a message, they get their device list keys from the server.
What about end-to-end encryption, user privacy?
WhatsApp says it is using client-fanout approach for this, where “the WhatsApp client sending the message encrypts and transmits it N number of times to N number of different devices — those in the sender and receiver’s device lists.” The message is “individually encrypted using the established pairwise encryption session with each device.”
Further, messages are not stored on the server after they are delivered, and WhatsApp continues to use the same scalable Sender Key encryption scheme from the Signal Protocol. Further all calls and videos calls, including group ones will remain end-to-end encrypted.
WhatsApp says they have tried to address the challenges of a compromised server being used to eavesdrop on a user’s conversations by adding devices to their account. One, they have extended security codes to “now represent the combination of all of someone’s device identities.” So these codes can be used by their contacts to verify the devices to which messages being sent to.
The second step is a technology called Automatic Device Verification, which will be rolled out later. The post explains, “this system allows for devices to automatically establish trust between each other in a way that someone needs to compare another user’s security code only if that user reregisters their entire account, rather than each time they link a new device to their account.”
Users will also get additional control and protections over which devices are linked to their account. First, everyone will continue to be required to link new companion devices by scanning a QR code from their phone. This process now requires biometric authentication before linking where people have enabled this feature on compatible devices.
Finally, people will be able to see all the companion devices linked to their account as well as when they were last used, and will be able to log out of them remotely if needed.
The new feature will “synchronise message history as well as other application state data (such as contact names, whether a chat is archived, or if a message is starred) across devices.” This data will remain end-to-end encrypted between devices.
The post explains that when a companion device is linked, “the primary device encrypts a bundle of the messages from recent chats and transfers them to the newly linked device.”
The key for this is delivered to the new device. “After the companion device downloads, decrypts, unpacks, and stores the messages securely, the keys are deleted. From that point forward, the companion device accesses the message history from its own local database,” adds the blog.
For other application data such as contact number or when a user stars a message, the “WhatsApp server securely stores a copy of each application state that all of someone’s devices can access.” WhatsApp says all of this data “is end-to-end encrypted with constantly changing keys known only to that person’s devices.”
