Live data from Hacker News

Tracking friends and strangers using WhatsApp

robertheaton.com

41–50 of 159 posts

Re: Tracking friends and strangers using WhatsApp

#41
post #5
post #2

I suspect a fairly small percentage of users is active enough that you get usable hourly data.

I agree with you, whatsapp is not like Tinder or Facebook you don't open it every 2 minutes to check if there is something new.

I live in Colombia, before then Mexico, and yes you do check on it every 2 minutes everyone does, at least in Latin America

Re: Tracking friends and strangers using WhatsApp

#42
post #30
post #13

Earlier quoted context omitted.

That depends on the country. In the US, people still tend to text a lot, but in most of Europe, Whatsapp totally replaced texting.

Is this because of their still-utterly-broken roaming model? (supposedly to be remedied soon)

It's probably a combination of high cost of texts at the time when Whatsapp became popular, no limit (or much larger limit) to the size of texts, a reasonable probability of texts not arriving or arriving late and a "fuck telcos for squeezing millions of euros from their users for no other reason than to turn massive profits from texting" attitude.

Re: Tracking friends and strangers using WhatsApp

#43
post #34

A few weeks ago there was a similar discussion, and I commented the following: If you think there is no problem, you are wrong. The blog post does not show all the information leaks that this implies. Example: I can modify the script to monitor all the numbers I've in my phone, so that based on the online/offline status in a few weeks I can be able to guess who is having conversations together, discovering cheatings,…

The thing is, this method works pretty well if people are chatting in real time, if you wait like 10 minutes to answers messages, it is much more difficult to create the links.

Moreover if people are using all the time Whatsapp, it is again much more difficult to do.

But I agree with you, there are many situations where these could work

Re: Tracking friends and strangers using WhatsApp

#45
post #39
post #24

Earlier quoted context omitted.

There's another startup idea.

The idea being you incentive WhatsApp users to install your app that then harvests all their contacts and collates the "last seen" info on all of them. If they delete your app, you setup a proxy to imitate their device and continue the monitoring. Have a privacy policy that is super strong but has a couple "loopholes" that one can drive a truck through. Is that the idea? Seems doable if you're not too risk averse, ha…

You wouldn't need an app or other WhatsApp users beyond your distributed proxy accounts. You'd be running the monitoring through these proxies.

Creating an app with the sole purpose of backdooring WhatsApp on a user's phone seems like it'd open you up to a lot of lawsuits. Ethically its a mite more questionable, but the original article is still unethical in that you're monitoring people without consent.

Like I said above, I'd do this just so that they'd crack down on it. It's still a "means justify the ends" argument, however, so you have to be quite comfortable with moral relativism.

Re: Tracking friends and strangers using WhatsApp

#46
post #30
post #13

Earlier quoted context omitted.

That depends on the country. In the US, people still tend to text a lot, but in most of Europe, Whatsapp totally replaced texting.

Is this because of their still-utterly-broken roaming model? (supposedly to be remedied soon)

Soon was June 2017. But I doubt it has anything to do with roaming. Maybe more people paid per SMS for a longer time than in the US? I know I still do; I could add unlimited messages to my monthly contract for 1 EUR or so, but what's the point.

Re: Tracking friends and strangers using WhatsApp

#47
People avoid thinking too much about things that are working as advertised. How many people wonder about how exactly their cars work or the global financial system works yet they are impacted by both of these. They may reserve curiosity for other things depending on their interests.

And here the problem begins, a lot of software engineers seem to conflate this disinterest to stupidity and think this gives them a right to do whatever they want with other people's data.

There is a fundamental lack of understanding and respect of other people rights and privacy and an easy dehumanization that is disconnected from human society and the evolution of fundamental rights like like the right to privacy. Regulation will catch up and eventually address this as more people become aware but is a troubling reflection of a large part of the software ecosystem.

Re: Tracking friends and strangers using WhatsApp

#48
post #43
post #34

A few weeks ago there was a similar discussion, and I commented the following: If you think there is no problem, you are wrong. The blog post does not show all the information leaks that this implies. Example: I can modify the script to monitor all the numbers I've in my phone, so that based on the online/offline status in a few weeks I can be able to guess who is having conversations together, discovering cheatings,…

The thing is, this method works pretty well if people are chatting in real time, if you wait like 10 minutes to answers messages, it is much more difficult to create the links. Moreover if people are using all the time Whatsapp, it is again much more difficult to do. But I agree with you, there are many situations where these could work

Unfortunately even under much more noise than the Whatsapp activation patterns, we have seen timing attacks working in incredible reliable ways, with the network in the middle adding random delays, and even when the task at hand was to misure very small differences in time. So I guess that if this attack already seems feasible in certain contexts, it can only get much better using more advanced techniques.

Re: Tracking friends and strangers using WhatsApp

#50
Nevermind the clever writing but the issue has been known for years—and beautifully exploited with the selfhostable ready-made solution WhatsSpy Public since Feb 2015: https://gitlab.maikel.pro/maikeldus/WhatsSpy-Public/ It's not actively maintained anymore but Maikel deserves some credit for it.
Post reply on HN