Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Collecting huge amounts of data with WhatsApp

lorankloeze.nl

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Collecting huge amounts of data with WhatsApp

#41

Post by the1337god »

jmanderley wrote: post #39
pearjuice wrote: post #12

It clearly says so in the WhatsApp settings what people can and cannot see. This is the modern day equivalent of cold calling a range of home numbers and see who answers. If you don't want that information to be public, disable it. Simple as that. This functionality is pretty much what made WhatsApp so easily accessible for anyone in the first place.

You can't disable the "online" status display when you're active in WhatsApp. Their settings page doesn't indicate this. So it's still possible to profile your contacts even with everything set to "maximum privacy".

Yes, but this article does not discuss that. It's only about the scraping of information.

Re: Collecting huge amounts of data with WhatsApp

#42

Post by arjie »

chinathrow wrote: post #34
arjie wrote: post #21

Man, my public GitHub profile ties my email address to my photograph. And that stuff is also in each of my public commits. With modern Android's anti-spam features, I can even dodge spam calls to my phone, so this is not a problem for me.

> With modern Android's anti-spam features, I can even dodge spam calls to my phone, so this is not a problem for me. With those modern anti-spam features, you leak all call details to those providers. Read up their ToS.

I'm all right with this. I also use Google Voice, so giving call details to the people I'm getting my calls through is not something I would be worried about. Even if I weren't, I trust Google.

Re: Collecting huge amounts of data with WhatsApp

#43

Post by detstrat »

topranks wrote: post #23

Seems to me that Whatsapp should be able to rate-limit these requests and work to secure the interface so only the legit website can actually pull the info? The initial website display comes from a QR code you can on your phone, which the website then gets authorized by. Could they not then limit queries to that account? I could be way off the mark, but it seems to me like the worst of this could be mitigated quite e…

WhatsApp does monitor their network and API calls being performed. This way they ban spammers and fake clients going on the WhatsApp network. I suspect they use some form of Machine learning to filter out the non-users and when you're identified: you're getting banned. This means that you can no longer use your phone number and need a new SIM. So this story isn't feasable for "huge amounts of data". You might be able to download a few 100k of profile picutures but you will get banned.

Re: Collecting huge amounts of data with WhatsApp

#44

Post by fastball »

antirez wrote: post #22

If you think there is no problem, you are wrong. The blog post does not show all the information leaks that this implies. Example: I can modify the script to monitor all the numbers I've in my phone, so that based on the online/offline status in a few weeks I can be able to guess who is having conversations together, discovering cheatings, work affairs, ... EDIT: Practical example. After collecting enough data about…

But that's literally the only correlation you can make: "these people are chatting".

If you think two people talking with each other outside of "state secrets type shenanigans" is a big deal, you're wrong.

There are much easier, much more accurate ways to discover "cheating" than online times for WhatsApp...

Re: Collecting huge amounts of data with WhatsApp

#45

Post by detstrat »

I don't get why people make such a big problem about this.

First of all, the privacy issues from WhatsApp have been discussed many times before. Yes, the default option "public" is bad, and just like making your profile picture on facebook "public" means anyone can scrape it. The fact that its a mobile app doesn't make it different from a website.

Secondly; people in the comments talk about the fact that you cannot control your precense in WhatsApp, and yes that is indeed a serious privacy problem which has been discussed before, but this article mentions nothing about that.

Third; WhatsApp monitors their network for non-user clients (to prevent spam and non-official clients). You may be able to request profile pictures of 500 people, but what about 1 million? Iterating over such a large set will likely cause a ban of your WhatsApp account, which means you need to spent another 10 bucks on a SIM card which will make it unfeasable to exploit.

Source: 4 years of experience with chat-bots on the WhatsApp network. I got a lot of SIM cards banned from WhatsApp by experimenting how far I could go. Not only sending messages, but also scraping.

Re: Collecting huge amounts of data with WhatsApp

#46

Post by detstrat »

sdoering wrote: post #18
bartj3 wrote: post #7

When you give your phone number to LinkedIn you're not surprised either if people will find your job title, photo and name based on your phone number right? I'd think most people are pretty aware of how public the Whatsapp info is.

If I ask the semi- and non-technical people within my rech, I find that the majority is shocked by the described possibility. Sadly not shocked enough to even change the privacy settings. Or - beware - deleting WA.

Why do people think "public" does not mean the same as "public" on a website? Essentially there is nothing different here..

Re: Collecting huge amounts of data with WhatsApp

#47

Post by codedokode »

detstrat wrote: post #45

I don't get why people make such a big problem about this. First of all, the privacy issues from WhatsApp have been discussed many times before. Yes, the default option "public" is bad, and just like making your profile picture on facebook "public" means anyone can scrape it. The fact that its a mobile app doesn't make it different from a website. Secondly; people in the comments talk about the fact that you cannot c…

> Iterating over such a large set will likely cause a ban of your WhatsApp account, which means you need to spent another 10 bucks on a SIM card which will make it unfeasable to exploit.

Such limitations can be bypassed. For example one can use botnet of hacked Android phones or buy thousands of SIM cards in bulk or maybe even some virtual phone numbers.

Re: Collecting huge amounts of data with WhatsApp

#48

Post by cryptarch »

jmanderley wrote: post #38
cryptarch wrote: post #5

Just checked if I was affected and happily I found I'd set every possible setting to private or disabled. I figure five eyes already had this information. I think they would have tools to decrypt all communications from any app, by using rooted phones that scan their own memory for common crypto libraries and then extract the keys. On the initial run it would not know where to look, and the phone would be set up to g…

You are affected: There's no way to disable the "online" status display when the app is opened in WhatsApp.

Oh, that's a very misleading by Facebook.

I have "Status privacy" and "Last seen" set to no one, I assumed that included "If I am online right now".

Re: Collecting huge amounts of data with WhatsApp

#49

Post by julioneander »

cryptarch wrote: post #5

Just checked if I was affected and happily I found I'd set every possible setting to private or disabled. I figure five eyes already had this information. I think they would have tools to decrypt all communications from any app, by using rooted phones that scan their own memory for common crypto libraries and then extract the keys. On the initial run it would not know where to look, and the phone would be set up to g…

If there was a way of tricking the app to think it is always online, the real status could be obfuscated. WhatsApp probably uses some Android and iOS API to know when it's open, tapping into that could confuse the app and make the online status pretty useless.

LineageOS (previously CyanogenMod) had a Privacy Blocker or something like that, which you could block specific apps access to major APIs like Media Access, Phone ID Access, etc. It's been a while since I last used that, don't know if it still exists, but it sure helped my paranoia. It was fun seeing apps trying to access all sorts of stuff on my phone just to see them being denied access.

Nice Death Grips reference btw.

Re: Collecting huge amounts of data with WhatsApp

#50

Post by exhilaration »

erbdex wrote: post #26
vultour wrote: post #24

Earlier quoted context omitted.

But you are voluntarily giving that info away if you use WA and don't change your privacy settings. The 'last online' feature is quite important IMO, and if you're concerned about this then disable it. Edit: On the other hand it would perhaps be better to have it on 'Contacts only' as the default, but you could still monitor your colleagues as they probably have you in their contacts anyway.

Whatsapp has no setting to disable the "online" flag when i have opened the app, and a bunch of things mentioned can be built on top of just this. I think this shows how some seemingly trivial data points on an individual level can allow one to build something way more than the sum of parts at a mass surveillance level.

I believe you're looking for Settings > Account > Privacy > Status > Only Share with...

And select no contacts on that screen. This is on the Android app, I'm not familiar with the web version.

Post reply on HN