Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Someone was typing in a URL and WhatsApp was fetching it off my server”

twitter.com

Post reply on HN
Print view View original

51–60 of 69 posts

Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”

#51

Post by cuckcuckspruce »

marcosdumay wrote: post #32
killjoywashere wrote: post #27

Earlier quoted context omitted.

Yes, I did know that. The difference is WhatsApp is selling encrypted-onboard privacy. Which is now, prima facie, a lie. Facebook has literally told courts they can't decrypt WhatApp traffic. I wonder if that court case in Brazil is still pending. By comparison, no one ever said "There's no way Google could read my search terms". A more accurate comparison would be regarding Allo.

You've got me angrily reading the article while asking myself if WatsApp would be stupid enough to lose that mostly won case. (It's in our supreme court, I hope they will announce it illegal to widely block a communication channel and to coerce companies into releasing broken crypto.) No, WatsApp didn't get informed of what URL you entered on the message. The site owner gets a notice, as does the user's ISP, and a lo…

WhatsApp is probably the last entity that I would be worried about reading my message. WhatsApp is trying to sell you a promise where nobody, other than the recipient, can know the content of your messages. Having the owner of a site whose URL is included in a WhatsApp message in real time as it is compose breaks that promise - now the site owner and many more people (DNS server operators, both ISPs at the very least) have information about the content of that message.

Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”

#52

Post by Kpourdeilami »

emilfihlman wrote: post #23
tinus_hn wrote: post #19

Earlier quoted context omitted.

The app obviously can see the messages, this happens on the clients.

Yeah, just tested. I assumed Whatsapp would fetch serverside but no and thus expose client IPs. Telegram seems to proxy the requests. So Whatsapp wins with crypto here.

Wouldn't using a proxy also break the E2E? Whoever operates that proxy can see all the requests

Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”

#54

Post by jszymborski »

jwilk wrote: post #18
emilfihlman wrote: post #17

E: Disregard. Whatsapp is doing exactly what they should be doing. Telegram seems to proxy the requests. Why is no one saying anything about end to end crypto? Whatsapp shouldn't be able to see my messages, isn't that what they say themselves?

The 4th comment is: doing a GET request over the internet is already violating e2e

not if it's over TLS/SSL...

Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”

#55

Post by jjnoakes »

jszymborski wrote: post #54
jwilk wrote: post #18

Earlier quoted context omitted.

The 4th comment is: doing a GET request over the internet is already violating e2e

not if it's over TLS/SSL...

When both e's in e2e are the parties of the conversation, and the TLS connection is too a third party, then yes it is a violation of their claim.

Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”

#56

Post by jszymborski »

jjnoakes wrote: post #55
jszymborski wrote: post #54

Earlier quoted context omitted.

not if it's over TLS/SSL...

When both e's in e2e are the parties of the conversation, and the TLS connection is too a third party, then yes it is a violation of their claim.

I'm going to have to disagree with that. The TLS connection is not part of the conversation... it has no ability to intercept messages, encrypted or otherwise.

It's merely just another e2e communication between the client and another party, albeit through another protocol.

Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”

#57

Post by jjnoakes »

jszymborski wrote: post #56
jjnoakes wrote: post #55

Earlier quoted context omitted.

When both e's in e2e are the parties of the conversation, and the TLS connection is too a third party, then yes it is a violation of their claim.

I'm going to have to disagree with that. The TLS connection is not part of the conversation... it has no ability to intercept messages, encrypted or otherwise. It's merely just another e2e communication between the client and another party, albeit through another protocol.

But it reveals part of what was typed in the e2e chat to the third party... tls or not is irrelevant to that point.

Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”

#59

Post by jszymborski »

jjnoakes wrote: post #57
jszymborski wrote: post #56

Earlier quoted context omitted.

I'm going to have to disagree with that. The TLS connection is not part of the conversation... it has no ability to intercept messages, encrypted or otherwise. It's merely just another e2e communication between the client and another party, albeit through another protocol.

But it reveals part of what was typed in the e2e chat to the third party... tls or not is irrelevant to that point.

True, I overlooked that. Thanks for taking the time to point that out :)

Re: “Someone was typing in a URL and WhatsApp was fetching it off my server”

#60

Post by saghm »

marcosdumay wrote: post #46
fictioncircle wrote: post #43

Earlier quoted context omitted.

Yeah but tbh, its still not e2e encrypted. It just means WhatsApp is ignorant. So they are in the clear legally, but morally, its still dubious to do that given its effectively disclosing what is often a substantial portion of the conversation.

The message contents are e2e encrypted. And, transmitting an URL usually has no use beyond accessing it. They are doing what the user expects, it's just lacking some communication and power-user tools to override the default behavior.

I'm not sure that's what a user would expect; if anything, I'd think users would expect the opposite, that internet requests potentially with identifying information are not being sent to third parties based on what they've typed into the box without hitting send.
Post reply on HN