WhatsApp

2009–2014

WhatsApp, was incorporated in 2009 by Brian Acton and Jan Koum, both former employees of Yahoo!. After Koum and Acton left Yahoo! in September 2007, the duo traveled to South America as a break from work. At one point they applied for jobs at Facebook but were rejected. For the rest of the following years Koum relied on his $400,000 savings from Yahoo!. In January 2009, after purchasing an iPhone and realizing that the App Store would soon create an industry of apps, Koum started visiting his friend Alex Fishman in West San Jose where the three would discuss "... having statuses next to individual names of the people", but this was not possible without an iPhone developer. Fishman found a Russian developer on RentACoder.com, Igor Solomennikov, and introduced him to Koum. Koum named the app "WhatsApp" to sound like "what's up". On February 24, 2009, he incorporated WhatsApp Inc. in California. However, because early versions of WhatsApp often crashed or got stuck at a particular point, Koum felt like giving up and looking for a new job, upon which Acton encouraged him to wait for a "few more months".

In June 2009, Apple launched push notifications, allowing users to be pinged when they were not using an app. Koum changed WhatsApp so that when a user's status is changed, everyone in the user's network would be notified. WhatsApp 2.0 was released with a messaging component and the number of active users suddenly increased to 250,000. Acton was still unemployed and managing another startup, and he decided to join the company. In October 2009, Acton persuaded five former friends in Yahoo! to invest $250,000 in seed funding, and Acton became a co-founder and was given a stake. He officially joined on November 1. After months at beta stage, the application eventually launched in November 2009 exclusively on the App Store for the iPhone. Koum then hired a friend who lived in Los Angeles, Chris Peiffer, to develop the BlackBerry version, which arrived two months later.

WhatsApp was switched from a free to paid service to avoid growing too fast, mainly because the primary cost was sending verification texts to users. In December 2009, the ability to send photos was added to WhatsApp for the iPhone. By early 2011, WhatsApp was one of the top 20 apps in Apple's U.S. App Store.

In April 2011, Sequoia Capital was the only venture investor in WhatsApp and paid approximately $8 million for more than 15 percent of the company, after months of negotiation with Sequoia partner Jim Goetz.

By February 2013, WhatsApp had about 200 million active users and 50 staff members. Sequoia invested another $50 million, and WhatsApp was valued at $1.5 billion.

In a December 2013 blog post, WhatsApp claimed that 400 million active users use the service each month. As of April 22, 2014, WhatsApp had over 500 million monthly active users, 700 million photos and 100 million videos were being shared daily, and the messaging system was handling more than 10 billion messages each day. On August 24, 2014, Koum announced on his Twitter account that WhatsApp had over 600 million active users worldwide. At that point WhatsApp was adding about 25 million new users every month, or 833,000 active users per day. With 65 million active users representing 10% of the total worldwide users, India has the largest number of consumers.

Facebook era (2014–present)

On February 19, 2014, months after a venture capital financing round at a $1.5 billion valuation, Facebook announced it was acquiring WhatsApp for US$19 billion, its largest acquisition to date. At the time, the acquisition was the largest purchase of a venture-backed company in history. Sequoia Capital received an approximate 50x return on its initial investment. Facebook, which was advised by Allen & Co, paid $4 billion in cash, $12 billion in Facebook shares, and an additional $3 billion in restricted stock units granted to WhatsApp's founders (advised by Morgan Stanley), Koum and Acton. Employee stock was scheduled to vest over four years subsequent to closing. The transaction was the largest purchase of a company backed by venture capitalists to date. Days after the announcement, WhatsApp users experienced a loss of service, leading to anger across social media.

The acquisition caused a considerable number of users to move, or try out other message services as well. Telegram claimed to have seen 8 million additional downloads of its app. Line claimed to have seen 2 million new users for its service.

At a keynote presentation at the Mobile World Congress in Barcelona in February 2014, Facebook CEO Mark Zuckerberg said that Facebook's acquisition of WhatsApp was closely related to the Internet.org vision. According to a TechCrunch article, Zuckerberg's vision for Internet.org was as follows: "The idea, he said, is to develop a group of basic internet services that would be free of charge to use – 'a 911 for the internet.' These could be a social networking service like Facebook, a messaging service, maybe search and other things like weather. Providing a bundle of these free of charge to users will work like a gateway drug of sorts – users who may be able to afford data services and phones these days just don’t see the point of why they would pay for those data services. This would give them some context for why they are important, and that will lead them to paying for more services like this – or so the hope goes."

On May 9, 2014, the government of Iran announced that it had proposed to block the access to WhatsApp service to Iranian residents. "The reason for this is the assumption of WhatsApp by the Facebook founder Mark Zuckerberg, who is an American Zionist," said Abdolsamad Khorramabadi, head of the country's Committee on Internet Crimes. Subsequently Iranian president Hassan Rouhani issued an order to the Ministry of ICT to stop filtering WhatsApp.

Just three days after announcing that WhatsApp had been purchased by Facebook, Koum said they were working to introduce voice calls in the coming months. He also advanced that new mobile phones would be sold in Germany with the WhatsApp brand, as their main goal was to be in all smartphones.

In August 2014, WhatsApp was the most globally popular messaging app, with more than 600 million active users. By early January 2015, WhatsApp had 700 million monthly active users with over 30 billion messages being sent every day. In April 2015, Forbes predicted that between 2012 and 2018, the telecommunications industry will lose a combined total of $386 billion because of OTT services like WhatsApp and Skype. That month, WhatsApp had over 800 million active users. By September 2015, the user base had grown to 900 million, and by February 2016 it had grown to one billion.

As of November 30, 2015, the Android client for WhatsApp started making links to another messenger called Telegram unclickable and uncopyable. This is an active block, as confirmed by multiple sources, rather than a bug, and the Android source code which recognises Telegram URLs has been identified. URLs with "telegram" as domain-name are targeted actively and explicitly – the word "telegram" appears in the code. This functioning risks being considered anti-competitive, and has not been explained by WhatsApp.

On January 18, 2016, WhatsApp's founder Jan Koum announced that the service would no longer charge their users a $1 annual subscription fee in an effort to remove a barrier faced by some users who do not have a credit card to pay for the service. He also explained that the app would not display any third party advertisement and instead would bring new features such as the ability to communicate with business organizations.

By June 2016, more than 100 million voice calls are made per day on WhatsApp according to a post on the company's blog.

On November 10 2016, WhatsApp has started rolling out two-step verification feature for users on Android beta. This feature will add more security to your account, officials said. After enabling this feature, users will also get an option to add their email address for further protection.

On February 24 2017, (WhatsApp's 8th birthday) WhatsApp launches new Status feature that offering similar to Snapchat

Platform support

After months at beta stage, the application eventually launched in November 2009 exclusively on the App Store for the iPhone. In January 2010, support for BlackBerry smartphones was added, and subsequently for Symbian OS in May 2010 and for Android OS in August 2010. In August 2011 a beta for Nokia's non-smartphone OS Series 40 was added. A month later support for Windows Phone was added, followed by BlackBerry 10 in March 2013. In April 2015, support for Samsung's Tizen OS was added. An unofficial port has been released for the MeeGo-based Nokia N9 called Wazapp, as well as a port for the Maemo-based Nokia N900 called Yappari.

The oldest device capable of running WhatsApp is the Symbian-based Nokia N95 released in March 2007.

In August 2014, WhatsApp released an update to its Android app, adding support for Android Wear smartwatches.

In 2014 an unofficial open source plug-in called whatsapp-purple was released for Pidgin, implementing its XMPP and making it possible to use WhatsApp on a Windows or Linux PC. WhatsApp responded by automatically blocking phone numbers that connected to WhatsApp using this plug-in.

On January 21, 2015, WhatsApp launched WhatsApp Web, a web client which can be used through a web browser by syncing with the mobile device's connection.

On February 26, 2016, WhatsApp announced they would cease support for BlackBerry (including BlackBerry 10), Series 40 and Symbian, as well as some older versions of Android, Windows Phone and iOS, by the end of 2016. This has since been extended to June 30, 2017.

WhatsApp Web

WhatsApp was officially made available for PCs through a web client, under the name WhatsApp Web, in late January 2015 through an announcement made by Koum on his Facebook page: "Our web client is simply an extension of your phone: the web browser mirrors conversations and messages from your mobile device—this means all of your messages still live on your phone". The WhatsApp user's handset must still be connected to the Internet for the browser application to function. All major desktop browsers are supported except for Microsoft Internet Explorer. WhatsApp Web's user interface is based on the default Android one.

As of January 21, 2015, the desktop version was only available to Android, BlackBerry and Windows Phone users. Later on, it also added support for iOS, Nokia Series 40, and Nokia S60 (Symbian).

An unofficial derivative called WhatsAppTime has been developed, which is a standard Win32 application for PCs and supports notifications through the Windows notification area. There are similar solutions for macOS, such as the open-source ChitChat and multiple wrappers available in the App Store.

Windows and Mac

On May 10, 2016, the messaging service was introduced for both Windows and macOS operating systems. Similar to the WhatsApp Web format, the app, which will be synced with a user's mobile device, is available for download on the website. It supports OS versions of Windows 8 and OS X 10.9 and higher.

Technical

WhatsApp uses a customized version of the open standard Extensible Messaging and Presence Protocol (XMPP). Upon installation, it creates a user account using one's phone number as the username (Jabber ID: [phone number]@s.whatsapp.net).

WhatsApp software automatically compares all the phone numbers from the device's address book with its central database of WhatsApp users to automatically add contacts to the user's WhatsApp contact list. Previously the Android and Nokia Series 40 versions used an MD5-hashed, reversed-version of the phone's IMEI as password, while the iOS version used the phone's Wi-Fi MAC address instead of IMEI. A 2012 update now generates a random password on the server side.

Some Dual SIM devices may not be compatible with WhatsApp, though there are some workarounds for this.

In January 2015, WhatsApp introduced a voice calling feature; this helped WhatsApp to attract a completely different segment of the user population. On November 14, 2016, Whatsapp added video calling feature for users across Android, iPhone, and Windows Phone devices.

Multimedia messages are sent by uploading the image, audio or video to be sent to an HTTP server and then sending a link to the content along with its Base64 encoded thumbnail (if applicable).

WhatsApp follows a 'store and forward' mechanism for exchanging messages between two users. When a user sends a message, it first travels to the WhatsApp server where it is stored. Then the server repeatedly requests the receiver acknowledge receipt of the message. As soon as the message is acknowledged, the server drops the message; it is no longer available in database of server. WhatsApp server keeps the message only for 30 days in its database when it is not delivered (when the receiver is not active on WhatsApp for 30 days).

End-to-end encryption

On November 18, 2014, Open Whisper Systems announced a partnership with WhatsApp to provide end-to-end encryption by incorporating the encryption protocol used in Signal into each WhatsApp client platform. Open Whisper Systems said that they had already incorporated the protocol into the latest WhatsApp client for Android, and that support for other clients, group/media messages, and key verification would be coming soon after. WhatsApp confirmed the partnership to reporters, but there was no announcement or documentation about the encryption feature on the official website, and further requests for comment were declined. In April 2015, German magazine Heise Security used ARP spoofing to confirm that the protocol had been implemented for Android-to-Android messages, and that WhatsApp messages from or to iPhones running iOS were still not end-to-end encrypted. They expressed the concern that regular WhatsApp users still could not tell the difference between end-to-end encrypted messages and regular messages. On April 5, 2016, WhatsApp and Open Whisper Systems announced that they had finished adding end-to-end encryption to "every form of communication" on WhatsApp, and that users could now verify each other's keys. Users were also given the option to enable a trust on first use mechanism in order to be notified if a correspondent's key changes. According to a white paper that was released along with the announcement, WhatsApp messages are encrypted with the Signal Protocol. WhatsApp calls are encrypted with SRTP, and all client-server communications are "layered within a separate encrypted channel". The Signal Protocol library used by WhatsApp is open-source and published under the GPLv3 license.

Cade Metz, writing in Wired, said "WhatsApp, more than any company before it, has taken encryption to the masses."

Security concerns

On May 20, 2011, an unconfirmed security researcher from the Netherlands under the pseudonym "WhatsappHack" published, to the Dutch websites Tweakers.net and GeenStijl, a method by which WhatsApp accounts could be hijacked. The researcher noticed a flaw in the authentication process, which allowed the researcher to hijack an account by trying to login with another phone number and intercepting the verification SMS text message that, under specific conditions, remained in the outbox of the Symbian phone after the WhatsApp client would attempt to send it to itself. On Android, the verification message could be obtained through reading the "radio" with a tool named "logcat". The researcher would then copy and send the intercepted verification message to the real number of the phone, using an SMS gateway to spoof the "sender" phone number to the number the researcher tried to maliciously login with. This method worked, and WhatsApp issued a patch within one day after publication of the articles, to both the Android and Symbian clients. WhatsApp did have a security mechanism, by design, which would disable the account on the phone of the original owner of the phone number, when they had a WhatsApp account.

In May 2011, another security hole was reported which left communication through WhatsApp susceptible to packet analysis. WhatsApp communications were not encrypted, and data was sent and received in plaintext, meaning messages could easily be read if packet traces were available.

In May 2012 security researchers noticed that new updates of WhatsApp no longer sent messages as plaintext, but the cryptographic method implemented was subsequently described as "broken". In August 2012 the WhatsApp support staff said that messages were encrypted in the "latest version" of the WhatsApp software for iOS and Android (but not BlackBerry, Windows Phone, and Symbian), without specifying the cryptographic method.

On January 6, 2012, an unknown hacker published a website that made it possible to change the status of an arbitrary WhatsApp user, as long as the phone number was known. To make it work, it only required a restart of the app. According to the hacker, it was only one of many security problems in WhatsApp. On January 9, WhatsApp reported that it had resolved the problem, although the only measure actually taken was to block the website's IP address. As a reaction, a Windows tool was made available for download providing the same functionality. This problem has since been resolved in the form of an IP address check on currently logged-in sessions.

German Tech site The H demonstrated how to use WhatsAPI to hijack any WhatsApp account on September 14, 2012. Shortly after, a legal threat to WhatsAPI's developers was alleged, characterized by The H as "an apparent reaction" to security reports, and WhatsAPI's source code was taken down for some days. The WhatsAPI team has since returned to active development.

On December 1, 2014, Indrajeet Bhuyan and Saurav Kar, both 17 years old, demonstrated the WhatsApp Message Handler Vulnerability, which allows anyone to remotely crash WhatsApp just by sending a specially crafted message of 2kb in size. To escape the problem, the user who receives the specially crafted message has to delete his/her whole conversation and start a fresh chat, because opening the message keeps on crashing WhatsApp unless the chat is deleted completely. In early 2015, after WhatsApp launched a web client that can be used from the browser, Bhuyan also found that it had two security issues that compromised user privacy: the WhatsApp Photo Privacy Bug and the WhatsApp Web Photo Sync Bug.

On March 2, 2016, WhatsApp introduced its document-sharing feature, initially allowing users to share PDF files with their contacts. However, WhatsApp's default state of automatically downloading attachments raised some concerns in the press about risk and security once support for document sharing expanded beyond PDF files.

On January 13, 2017, The Guardian newspaper reported that security researcher Tobias Boelter had found that WhatsApp's policy of forcing re-encryption of initially undelivered messages, without informing the recipient, constituted a serious loophole whereby WhatsApp could disclose, or be compelled to disclose, the content of these messages. WhatsApp and Open Whisper Systems officials disagreed with this assessment. A follow-up article by Boelter himself explains in greater detail what he considers to be the specific vulnerability.

Terrorism concerns

In December of 2015, it was reported that Islamic State terrorists had been using WhatsApp to plot the November 2015 Paris attacks.

In March 2017, U.K. Secretary of State Amber Rudd said encryption capabilities of messaging tools like WhatsApp are unacceptable, as news reported that Khalid Masood used the application several minutes before perpetrating the 2017 Westminster attack. Rudd publicly called for police and intelligence agencies to be given access to WhatsApp and other encrypted messaging services to prevent future terror attacks.

Privacy concerns

A major privacy and security problem has been the subject of a joint Canadian-Dutch government investigation. The primary concern was that WhatsApp required users to upload their mobile phone's entire address book to WhatsApp servers so that WhatsApp could discover who, among the users' contacts, was available via WhatsApp. While this was a fast and convenient way to quickly find and connect the user with contacts who were also using WhatsApp, it meant that their address book was then mirrored on the WhatsApp servers, including contact information for contacts who were not using WhatsApp. This information, which consisted solely of phone numbers without any additional information such as the name of the contact, was stored in hashed, though not salted, form. Late 2015, the Dutch government released a press-statement claiming that WhatsApp had changed its hashing method, making it much harder to reverse, and thus now fully complies with all rules and regulations.

A user does not need to send a friend request to send messages to another user, due to the contact discovery mentioned above.

In November 2014, WhatsApp introduced a feature named Read Receipts which alerts senders when their messages are read by recipients. Within a week, WhatsApp introduced an update allowing users to disable this feature so that message recipients do not send acknowledgements.

In February 2015, a Dutch university student named Maikel Zweerink published an app that set out to prove that anyone could track a WhatsApp user's status and also keep an eye of their changing profile pictures, privacy settings or status messages regardless of their privacy settings.

In August 2016, WhatsApp announced that it will start sharing account information with Facebook, consisting of the phone number of the account owner and aggregated analytical data. The address books and metadata of users are not shared. According to WhatsApp, this account information is shared to "track basic metrics about how often people use our services and better fight spam on WhatsApp. And by connecting your phone number with Facebook's systems, Facebook can offer better friend suggestions and show you more relevant ads if you have an account with them.". This means that Facebook can target advertisements on the Facebook Platform better by making links between users based on the phone numbers, and make "friend suggestions" to its users based on WhatsApp's data. User data will not be shared with advertisers, and is only used internally on the Facebook services. WhatsApp emphasizes the content of user messages is still kept private thanks to its end-to-end encryption, which means WhatsApp cannot read the content of chats. However, users are given the choice to opt out of sharing this data with Facebook for advertisement purposes. In October 2016, Article 29 Working Party stated that it has serious concerns regarding the manner in which the information relating to the updated Terms of Service and Privacy Policy was provided to users and consequently about the validity of the users’ consent.

Security and privacy

On March 31, 2013 the Saudi Arabian Communications and Information Technology Commission (CITC) issued a statement regarding possible measures against WhatsApp, among other applications, unless the service providers took serious steps to comply with monitoring and privacy regulations.

In February 2014, the public authority for data privacy of the German state of Schleswig-Holstein advised against using WhatsApp, as the service lacked privacy protection such as end-to-end client side encryption technology. WhatsApp started implementing end-to-end encryption in late 2014 and finished in April 2016.

From April 5, 2016, end-to-end encryption for all users' communications, including file transfers and voice calls, is supported for users of the latest client, encryption being enabled by default. It uses Curve25519 for key exchange, HKDF for generation of session keys (AES-256 in CBC mode for encryption and HMAC-SHA256 for integrity verification) and SHA512 for generating the two 30 digit finger prints of both users' identity keys so they can verify each other as needed. Even the company would be unable to decrypt users' communications. Amnesty International and security professionals praised the move; the US Federal Bureau of Investigation criticised it as threatening the work of law enforcement. Telegram, another messaging service, is reported by the BBC to be used by "Islamic State" extremists.

WhatsApp is not the only messaging service that provides end-to-end encryption; among others, Threema, Wickr, Signal, Silent Phone, and Line also provide such encryption by default. iMessage and Viber provide it under special circumstances. Telegram provides end-to-end encryption as an opt-in feature, but does not support end-to-end encrypted group messaging.

As of April 5, 2016, WhatsApp has a score of 6 out of 7 points on the Electronic Frontier Foundation's "Secure Messaging Scorecard". It has received points for having communications encrypted in transit, having communications encrypted with keys the provider doesn't have access to, allowing users to verify contacts' identities, having past messages secure if the encryption keys are stolen, having completed a recent independent security audit, and having the security designs properly documented. It is missing a point because the code is not open to independent review.

Brazilian court orders

On December 17, 2015, mobile providers in Brazil were ordered to block WhatsApp for 48 hours. The ban was ordered for the service's failure to cooperate with criminal court orders in July and August 2015. The following morning, however, a judge from the appeals court ordered that the ban be lifted for being an unreasonable response, recommending that the company be fined instead. Following the ban, but prior to its reversal, Facebook CEO Mark Zuckerberg responded by stating that he was "stunned that our efforts to protect people's data would result in such an extreme decision by a single judge to punish every person in Brazil who uses WhatsApp. We hope the Brazilian courts quickly reverse course." The competing service Telegram reported that 1.5 million Brazilians had downloaded its app while the WhatsApp ban was in place.

On March 1, 2016, Diego Dzodan, Facebook's vice-president for Latin America was arrested in Brazil for not cooperating with an investigation in which WhatsApp conversations were requested. On March 2, 2016, at dawn the next day, Dzodan was released because the Court of Appeal held that the arrest was disproportionate and unreasonable.

On May 2, 2016, mobile providers in Brazil were ordered to block WhatsApp for 72 hours for the service's second failure to cooperate with criminal court orders. Once again, the block was lifted following an appeal, after nearly 24 hours.

Business model

In response to the Facebook acquisition in 2014, Slate columnist Matthew Yglesias questioned whether the company's business model of charging users $1 a year was viable in the United States in the long term. It had prospered by exploiting a "loophole" in mobile phone carriers' pricing. "Mobile phone operators aren't really selling consumers some voice service, some data service, and some SMS service", he explained. "They are selling access to the network. The different pricing schemes they come up with are just different ways of trying to maximize the value they extract from consumers." As part of that, carriers sold SMS separately. That made it easy for WhatsApp to find a way to replicate SMS using data, and then sell that to mobile customers for $1 a year. "But if WhatsApp gets big enough, then carrier strategy is going to change", he predicted. "You stop selling separate SMS plans and just have a take-it-or-leave-it overall package. And then suddenly WhatsApp isn't doing anything." The situation may have been different in countries other than the United States.

On January 18, 2016, WhatsApp's founder Jan Koum announced that the service would no longer charge their users a $1 annual subscription fee in an effort to remove a barrier faced by some users who do not have a credit card to pay for the service. He also explained that the app would not display any third party advertisement and instead would bring new features such as the ability to communicate with business organizations.

Competition and shares

Competing with a number of Asian-based messaging services (like WeChat (468 million active users), Viber (209 million active users) and LINE (170 million active users)), WhatsApp handled ten billion messages per day in August 2012, growing from two billion in April 2012, and one billion the previous October. On June 13, 2013, WhatsApp announced that they had reached their new daily record by processing 27 billion messages. According to the Financial Times, WhatsApp "has done to SMS on mobile phones what Skype did to international calling on landlines."

In April 2014, WhatsApp crossed half-a-billion user mark.

In May 2014, WhatsApp crossed 50 million monthly active users in India, which is also its largest country by the number of monthly active users.

In October 2014, WhatsApp crossed 70 million monthly active users in India, which is 10% of its total user base (700 MM).

In February 2017, WhatsApp crossed 200 million monthly active users in India.

As of February 2017, WhatsApp has over 1.2 billion users globally.

WhatsApp-related scams

In May 2016, some WhatsApp users were reported to have been tricked into downloading a third-party application called WhatsApp Gold. The application was part of a scam that infected the users' phones with malware. Another appliacation called "GB Whatsapp" is also considered as a related scam. A message that promises to allow access to their WhatsApP friends' conversations, or their contact lists, has become the most popular hit against anyone who uses the application in Brazil. Since December, 2016, more than 1.5 million people have clicked and lost money