14 DAY TRIAL // WhatsApp turning to end-to-end encryption has turned it into a major target for spammers, but without being able to see what people are texting each other, WhatsApp had to find alternative ways to take them down.
During the USENIX Enigma security conference, WhatsApp engineer Matt Jones explained that they had to develop new approaches to detect spam without relying on content at all, TechCrunch reports.
“If you have well-instrumented behavioral features, it’s totally possible to detect spam without any access to message content in an end-to-end encrypted world,” Jones said.
So, how does WhatsApp do it? Well, some of the solutions they found are pretty logical - they’ll look at how many messages a user is sending and will flag them as spam if there’s a really high number of messages per minute. But that’s not all, because it’s not exactly the most fool-proof method out there.
How does it work
Jones explained that WhatsApp takes into account a lot of data when deciding whether someone is a spammer or not. For instance, the list includes data related to the Internet Service Provider, the phone number attached to the account, the phone network being used. They’re all compared to previous spam reports, and if the ISP’s data or the phone prefix have been previously associated with spammers, it’s likely that user will get flagged.
One of the most important elements to this algorithm, however, is whether an individual is reported as spam by other users. Once someone is reported for spam, the company will look back at its pattern of actions and add that incident to the database, thus enriching the algorithm and helping the company better fight against unwanted messages.
WhatsApp then bans users based on these models. The ban can be appealed if a mistake was made, but in the past few months, the number of incorrect bans has dropped by half. At the same time, spam was cut by three-quarters, so that’s quite important. This is all a learning process, of course, but it’s a battle WhatsApp has chosen to take on once it adopted end-to-end encryption.