Viber images and videos were not encrypted during transit or storage, company says “issue has already been resolved”
Here we go again: Viber mobile messenger app leaves user data unencrypted — Viber, a mobile messenger app that allows users to make phone calls …
Context & Ripple Effects
Viber's admission that images and videos moved through its system unencrypted landed with unusually broad pickup for a single-vendor disclosure — CNET, The Register, SC Magazine, Softpedia, The Hacker News and Android Community all carried it on or about April 27, 2014, a signal that messenger encryption had become a standing beat for the security press. The company's framing matters as much as the flaw: it acknowledged both transit and storage exposure while insisting the 'issue has already been resolved,' a fix-first-disclose-later posture typical of how consumer messengers handled crypto gaps at this point.
There is no earlier coverage of Viber in the archive, so this disclosure stands alone rather than as an escalation — which makes the company's own confirmation the load-bearing fact here, not a pattern of repeat findings.
First-order effects
- Every image or video a user sent before the fix was readable in transit and at rest, so Viber's 'resolved' claim covers future traffic only — past shared media must be treated as potentially exposed, and the company gave no window for how long the gap persisted.
- Viber now owns a documented encryption gap in a market where privacy claims were becoming a selling point, and its response — patch quietly, then confirm under press questioning — sets the terms of how users and reviewers judge it.
Second-order effects
- Rival mobile messengers face pressure to state plainly whether their own media attachments are encrypted, because a competitor's disclosed gap invites the same question of every app in the category.
- Security reviewers and trade outlets gain a template: test media handling, not just message text, since Viber's flaw lived specifically in the attachment path that marketing copy rarely mentions.
Third-order effects
- If the pattern holds, default-on encryption of all content types — text plus media plus metadata — becomes the baseline expectation for consumer messengers, with vendors who disclose late paying a credibility cost that outlasts the technical fix.
The trend: Consumer messaging apps are being pushed toward encrypting everything by default, with attachment media emerging as the next gap security researchers probe after text.