Your Secure Messaging App Is Leaking Your Location. Here's What That Means

That little check mark confirming your message was delivered might be doing a lot more than you think. Security researchers at the University of Vienna have uncovered a fundamental flaw in WhatsApp and Signal that allows precise location tracking using nothing more than a phone number. The vulnerability, which cannot be fully patched, raises serious questions about privacy in the digital age and who might be watching.

How a Single Check Mark Secretly Broadcasts Your Location

When you send a message on WhatsApp or Signal, your phone needs confirmation that your text actually arrived. One check mark means your message reached the server, while a second appears the moment it hits the recipient's device. The split-second delay between sending and receiving that delivery confirmation is known as the Round-Trip Time (RTT), and that tiny gap is where the vulnerability lives.

Unlike a read receipt, which only fires when a message is manually opened, a delivery receipt triggers automatically, even if the incoming text is filtered straight to a spam folder. By simply measuring how long it takes that invisible receipt to return, an attacker can harvest a surprising amount of data about your device, habits, and location.

We just need their phone number. This is basically as invisible as it can be.

That's Max Guenther, a security researcher at the University of Vienna, describing the attack to me. Carrying it out requires no specialized hardware or insider knowledge, just a basic script to analyze RTT trends, tools that are already publicly accessible on platforms like GitHub.

As Guenther points out, even microscopic timing variations tell a story: We get a response from the target back, and we can measure the time in between. We can measure the time it takes for the receipt to come to us, and it is shorter, for example, when the device is unlocked or being used right now than when it's in standby or just in locked mode.

Over time, these split-second data points paint a surprisingly vivid picture. By analyzing RTT patterns, an attacker can deduce whether you're actively using your phone, estimate your approximate location, and identify static networks. A work phone connected to office Wi-Fi, for instance, produces an ultra-consistent RTT compared with a personal phone switching between cellular towers, giving bad actors an invisible tool for continuous surveillance.

The Dilemma: Core Delivery Features Prevent a Full Patch

Guenther and his fellow researchers reported the vulnerability to both WhatsApp and Signal. They detailed their full findings in two papers, Careless Whisper and Prekey Pogo, and each platform acknowledged the vulnerability. Meta awarded a $7,000 payout for the find, while Signal couldn't offer any compensation as a nonprofit organization.

The problem is that these vulnerabilities cannot be fixed.

Delivery receipts provide a core function across all SMS platforms, making complete remediation impossible in the short term. Meta and Signal looked into the issue and put preventive measures in place, such as rate limiting, which reduces the frequency at which spam messages can be received, to stop some spam messages from coming through. However, this fix only slows down the attack.

I reached out to Meta and Signal for comment regarding the vulnerability, but did not receive a response from either company.

Who Is Actually at Risk?

Guenther's research focused solely on WhatsApp and Signal due to their widespread use and robust infrastructure, but these aren't the only apps to watch out for. I assume all of the messengers, at least like a lot of them, have similar issues because it's a fundamental problem, Guenther notes. Since all platforms rely on delivery receipts, it's likely that the issue exists in some capacity across most SMS platforms.

Luckily, the average user isn't likely to be targeted by such a narrow exploit, which functions like a zero-click attack in that it targets a specific individual or company. You're at higher risk if you're a prominent figure or handle sensitive data. However, the existence of such a widespread security gap carries severe privacy implications. Unless this flaw is addressed, well-funded organizations could exploit it to track dissidents, journalists, activists, and others. Likewise, stalkers and abusers could exploit the threat to keep tabs on victims.

So while you probably don't need to worry about this particular flaw, you should still take steps to protect yourself online. As the research shows, no platform is free of vulnerabilities.

What Can You Do to Protect Your Privacy?

While this specific vulnerability can't be fully fixed, there are steps you can take to reduce your exposure. Keep your apps updated, be mindful of the permissions you grant, and consider using a VPN to mask your network traffic. For those in high-risk roles, such as journalists or activists, additional layers of security like burner phones or encrypted email services may be worth considering.

Is Your Location Really at Risk on WhatsApp and Signal?

Yes, but the risk is relative. The attack requires a targeted approach and specific technical knowledge, so the average user is unlikely to be a victim. However, the fact that such a fundamental flaw exists in the world's most popular messaging apps is a reminder that no platform is completely secure.

Why Can't WhatsApp and Signal Fix This Vulnerability?

Because the vulnerability is tied to the core delivery receipt system that all messaging apps rely on. Removing or fundamentally altering that system would break the basic functionality of the apps. Rate limiting and other measures can slow down the attack, but they can't eliminate it entirely.