--- title: Schneier on Security | daily.dev description: German police have been exploiting the device-linking feature in WhatsApp Web and Signal Desktop to eavesdrop on suspects' messages without breaking... canonical: https://daily.dev/posts/schneier-on-security-d4lixmojq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Schneier on Security | daily.dev og:description: German police have been exploiting the device-linking feature in WhatsApp Web and Signal Desktop to eavesdrop on suspects' messages without breaking... og:url: https://daily.dev/posts/schneier-on-security-d4lixmojq og:image: https://api.daily.dev/og/posts/D4liXmOJQ.png og:image:alt: Schneier on Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Schneier on Security **[Schneier on Security](https://daily.dev/sources/schneier)** · 1 min read · 0 upvotes · 0 comments ## Summary German police have been exploiting the device-linking feature in WhatsApp Web and Signal Desktop to eavesdrop on suspects' messages without breaking encryption. By linking a police-controlled computer to a suspect's messaging account—through physical phone access, phishing intercepted verification codes, or SMS interception via telephone surveillance—law enforcement can receive messages as they arrive. This requires a form of user consent (via the linking code), since the attack abuses a legitimate multi-device feature rather than a cryptographic flaw. A proposed mitigation is a clearer UI showing all linked/connected devices so users can spot unauthorized links. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can police read WhatsApp or Signal messages without breaking the encryption? By exploiting the device-linking feature that lets a phone account connect to a desktop client like WhatsApp Web or Signal Desktop. Once a police-controlled computer is linked to a suspect's account, messages arrive there directly without needing to crack any cryptography. German Customs has used this technique, gaining the link via physical phone access, phishing verification codes, or SMS interception. _Developers building on E2E messaging protocols can follow device-linking security discussions on daily.dev._ ### What can messaging apps do to stop unauthorized device linking attacks? A proposed defense is giving users a clear, visible list of all devices currently linked to their account so they can immediately spot an unfamiliar connection. Since linking legitimately requires some form of user consent (a code or verification step), attackers rely on tricking or coercing that consent through phishing or interception rather than breaking encryption itself. _Security-minded developers can track proposals like device-visibility UI on daily.dev while designing account linking flows._ ## Similar posts on daily.dev - [WhatsApp accounts targeted in ‘GhostPairing’ attack](https://daily.dev/posts/whatsapp-accounts-targeted-in-ghostpairing-attack-ppg1senfn) · CSO Online · 1 upvotes · 0 comments - [Signal adds security warnings for social engineering, phishing attacks](https://daily.dev/posts/signal-adds-security-warnings-for-social-engineering-phishing-attacks-msp1wsl3v) · BleepingComputer · 0 upvotes · 0 comments - [Your Secure Messenger is Spying on You \(And You Can’t Turn It Off\)](https://daily.dev/posts/your-secure-messenger-is-spying-on-you-and-you-can-t-turn-it-off--x4aow21zn) · InfoSec Write-ups · 1 upvotes · 0 comments - [Signal Phishing and Russian Intelligence Targeting Messaging Apps](https://daily.dev/posts/signal-phishing-and-russian-intelligence-targeting-messaging-apps-cqkn6o6va) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#encryption](https://daily.dev/tags/encryption) [View this post on daily.dev](https://daily.dev/posts/schneier-on-security-d4lixmojq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Schneier on Security","url":"https://daily.dev/posts/schneier-on-security-d4lixmojq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/schneier-on-security-d4lixmojq"},"datePublished":"2026-09-29T11:08:04.697Z","dateModified":"2026-09-29T11:08:24.465Z","description":"German police have been exploiting the device-linking feature in WhatsApp Web and Signal Desktop to eavesdrop on suspects' messages without breaking...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"Schneier on Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Schneier on Security","logo":"https://media.daily.dev/image/upload/s--0aZDA7eZ--/f_auto/v1758461069/logos/schneier","url":"https://daily.dev/sources/schneier"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/schneier-on-security-d4lixmojq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"encryption","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Schneier on Security","item":"https://daily.dev/sources/schneier"},{"@type":"ListItem","position":3,"name":"Schneier on Security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/schneier-on-security-d4lixmojq#faq","mainEntity":[{"@type":"Question","name":"How can police read WhatsApp or Signal messages without breaking the encryption?","acceptedAnswer":{"@type":"Answer","text":"By exploiting the device-linking feature that lets a phone account connect to a desktop client like WhatsApp Web or Signal Desktop. Once a police-controlled computer is linked to a suspect's account, messages arrive there directly without needing to crack any cryptography. German Customs has used this technique, gaining the link via physical phone access, phishing verification codes, or SMS interception. Developers building on E2E messaging protocols can follow device-linking security discussions on daily.dev."}},{"@type":"Question","name":"What can messaging apps do to stop unauthorized device linking attacks?","acceptedAnswer":{"@type":"Answer","text":"A proposed defense is giving users a clear, visible list of all devices currently linked to their account so they can immediately spot an unfamiliar connection. Since linking legitimately requires some form of user consent (a code or verification step), attackers rely on tricking or coercing that consent through phishing or interception rather than breaking encryption itself. Security-minded developers can track proposals like device-visibility UI on daily.dev while designing account linking flows."}}]} ```