Prefetching a webpage to generate it's preview should at least be optional, controlled through user settings.
“Someone was typing in a URL and WhatsApp was fetching it off my server”
41–50 of 69 posts
Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”
#42Earlier quoted context omitted.
Yes, Chrome does it as well, but I expect that as it's a web browser. I know the tradeoffs when browsing the web and expect that my requests will be visible across the Internet. That's just how web browsing works. However, WhatsApp is selling a solution that is meant to provide privacy. When I write a URL in an SMS, my phone does not try to preemptively retrieve it to display a preview. WhatsApp may be encrypting the…
> WhatsApp is selling a solution that is meant to provide privacy. Yep you are right. They even tout this in their Security Page. https://www.whatsapp.com/security/ > WhatsApp's end-to-end encryption ensures only you and the person you're communicating with can read what is sent, and nobody in between, not even WhatsApp. This is because your messages are secured with a lock, and only the recipient and you have the sp…
Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”
#43Earlier quoted context omitted.
Yes, I did know that. The difference is WhatsApp is selling encrypted-onboard privacy. Which is now, prima facie, a lie. Facebook has literally told courts they can't decrypt WhatApp traffic. I wonder if that court case in Brazil is still pending. By comparison, no one ever said "There's no way Google could read my search terms". A more accurate comparison would be regarding Allo.
You've got me angrily reading the article while asking myself if WatsApp would be stupid enough to lose that mostly won case. (It's in our supreme court, I hope they will announce it illegal to widely block a communication channel and to coerce companies into releasing broken crypto.) No, WatsApp didn't get informed of what URL you entered on the message. The site owner gets a notice, as does the user's ISP, and a lo…
Yeah but tbh, its still not e2e encrypted. It just means WhatsApp is ignorant.
So they are in the clear legally, but morally, its still dubious to do that given its effectively disclosing what is often a substantial portion of the conversation.
Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”
#44In order to produce the link preview, probably. As far as why it's character by character, I don't know, but that doesn't seem very sinister to me. Checking URLs letter by letter is sloppy, especially if you're not even trying to do auto completion, but it doesn't reveal any more information than a complete url could. Anyway, I would think they are expecting people to paste URLs in, not type them. I've written code t…
It's not sinister so much as that Whatsapp is sending the requests directly from the user's phone (not through a proxy, etc) which is exposing the end user's IP address and full user agent string to the website hosting the page. This information could be used to identify the end user which goes against Whatsapp's whole "Privacy and Security is in our DNA" thing. ( https://www.whatsapp.com/security/ ) See this tweet f…
Privacy. Facebook.
Pick one.
Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”
#45Did you all know that chrome does this too? May sound obvious but I always had assumed that nothing is sent until you press enter for some reason (yeah I know, search prediction would be impossible without that). But one day I was type in a path on a test URL and noticing my server getting hit on - every single letter.
Yeah, that link prediction stuff is one of the things I turn off immediately after installing a browser.
Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”
#46Earlier quoted context omitted.
You've got me angrily reading the article while asking myself if WatsApp would be stupid enough to lose that mostly won case. (It's in our supreme court, I hope they will announce it illegal to widely block a communication channel and to coerce companies into releasing broken crypto.) No, WatsApp didn't get informed of what URL you entered on the message. The site owner gets a notice, as does the user's ISP, and a lo…
Yeah but tbh, its still not e2e encrypted. It just means WhatsApp is ignorant. So they are in the clear legally, but morally, its still dubious to do that given its effectively disclosing what is often a substantial portion of the conversation.
The message contents are e2e encrypted.
And, transmitting an URL usually has no use beyond accessing it. They are doing what the user expects, it's just lacking some communication and power-user tools to override the default behavior.
Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”
#47Hi HN, op here.
I posted this not because I was angry on having a GET request sent to my server on a char by char basis. My main concerns were privacy related, since I posted this some additional things came to light:
1) This leaks the IP address of the person writing the msg
2) When property="og:image" is used it also leaks the User Agent and Android version [1]
3) When presented with invalid headers as a reply it can cause a crash on IOS, which mean this is a potential RCE vector [2]
4) It leaks the exact time an URL is typed into a chat
5) It's on by default, this is the default behavior in E2E encrypted conversations [3]
I don't use WhatsApp, I found this out by accident as I just have a habit to tail my logs. I know though that Signal doesn't do any of this pre-fetching. I am aware this is a 'feature' but there's no place for it when security is involved.
[1] https://twitter.com/0xjomo/status/874585822158352384 [2] https://twitter.com/dr4ys3n/status/874725257722179584 [3] https://mastodon.social/@rysiek/9146943
Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”
#48Did you all know that chrome does this too? May sound obvious but I always had assumed that nothing is sent until you press enter for some reason (yeah I know, search prediction would be impossible without that). But one day I was type in a path on a test URL and noticing my server getting hit on - every single letter.
Yes, Chrome does it as well, but I expect that as it's a web browser. I know the tradeoffs when browsing the web and expect that my requests will be visible across the Internet. That's just how web browsing works. However, WhatsApp is selling a solution that is meant to provide privacy. When I write a URL in an SMS, my phone does not try to preemptively retrieve it to display a preview. WhatsApp may be encrypting the…
Even if WhatsApp is not about privacy there seems to be a difference here.
Am I misunderstanding, or are these requests happening just because someone is typing a message that happens to contain some string that looks like a URL. At least with a browser, you are entering things that are supposed to ultimately result in HTTP requests.
Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”
#49Earlier quoted context omitted.
Yes, Chrome does it as well, but I expect that as it's a web browser. I know the tradeoffs when browsing the web and expect that my requests will be visible across the Internet. That's just how web browsing works. However, WhatsApp is selling a solution that is meant to provide privacy. When I write a URL in an SMS, my phone does not try to preemptively retrieve it to display a preview. WhatsApp may be encrypting the…
> WhatsApp is selling a solution that is meant to provide privacy. Yep you are right. They even tout this in their Security Page. https://www.whatsapp.com/security/ > WhatsApp's end-to-end encryption ensures only you and the person you're communicating with can read what is sent, and nobody in between, not even WhatsApp. This is because your messages are secured with a lock, and only the recipient and you have the sp…
I suppose that I'm not surprised. You can't audit WhatsApp's source code, and even if you could, you can't guarantee what you're putting on your device matches the source code. Yet another closed source, inherently untrustable system.
Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”
#50Earlier quoted context omitted.
Yes, Chrome does it as well, but I expect that as it's a web browser. I know the tradeoffs when browsing the web and expect that my requests will be visible across the Internet. That's just how web browsing works. However, WhatsApp is selling a solution that is meant to provide privacy. When I write a URL in an SMS, my phone does not try to preemptively retrieve it to display a preview. WhatsApp may be encrypting the…
Even if WhatsApp is not about privacy there seems to be a difference here. Am I misunderstanding, or are these requests happening just because someone is typing a message that happens to contain some string that looks like a URL. At least with a browser, you are entering things that are supposed to ultimately result in HTTP requests.
Some browsers may send what you type in the address bar to a search engine - I know that Chrome does. So again, I wouldn't be surprised if this is done - that's what web browsers do. They don't make a claim of providing privacy and security.