Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp data leak: 500M user records for sale

cybernews.com

Post reply on HN
Print view View original

71–80 of 109 posts

Re: WhatsApp data leak: 500M user records for sale

#71

Post by lzooz »

capableweb wrote: post #47
TrianguloY wrote: post #13

Earlier quoted context omitted.

Profile, last connection time and status is public unless configured to not be. I was thinking about data not obtainable without a normal use of the service.

> Profile, last connection time and status is public Isn't those details (+ profile pictures) only available only you've accepted the first message from another user? I think I recall that I cannot see a persons avatar when I message first unless they hit "Accept message" after me sending the message. Is it not like that everywhere perhaps? I use Whatsapp with a number in the EU region.

That interaction that you mention doesn't exist in whatsapp at all. You don't have to "accept" messages from new conversations.

Re: WhatsApp data leak: 500M user records for sale

#73

Post by Denvercoder9 »

lzooz wrote: post #71
capableweb wrote: post #47

Earlier quoted context omitted.

> Profile, last connection time and status is public Isn't those details (+ profile pictures) only available only you've accepted the first message from another user? I think I recall that I cannot see a persons avatar when I message first unless they hit "Accept message" after me sending the message. Is it not like that everywhere perhaps? I use Whatsapp with a number in the EU region.

That interaction that you mention doesn't exist in whatsapp at all. You don't have to "accept" messages from new conversations.

Not completely true; while you don't have to accept messages for them to show up in your conversation list, when you receive the first message from someone not in your contact list you get the option to choose between "report", "block" and "continue".

Re: WhatsApp data leak: 500M user records for sale

#75

Post by jsnell »

A4ET8a8uTh0 wrote: post #64
jsnell wrote: post #18

Earlier quoted context omitted.

The advise is to do literally nothing about it. What effect do you think this specific leak has on you? What kind of adversary do you think will be able to benefit from this data, and how? The reality is that the data is useless trash, and there is no indication that this has actually leaked from Facebook or is showing any kind of security problem in their systems.

That remains to be seen. People are fairly ingenious when it comes to abusing information and information runs the world now. I will offer an unrelated example, partially because I do not want to give ideas on how to benefit from this. Do you remember when certain entrepreneurial billionaire offered a checkmark for sale, which resulted in people impersonating companies and manipulating their stock price[1]? Like with…

> Like with most things, any tool is worth what one is able to do with it.

Yes, and given an attacker will not get new capabilities from this data, it is worth nothing.

Any attack that could be feasibly run with a list of nothing but phone numbers associated with some (unknown) WhatsApp account could be done without that list just as easily. That's because of two things: a) phone numbers within a given country are easy to enumerate, b) the WhatsApp account space is dense, i.e. the odds of any legit phone number being used for WhatsApp is high.

> I would not advise to panic, but doing nothing is not exactly great advice either. Some re-assessment of one's current security posture may be warranted.

If you can't formulate a realistic threat from this data, how can you possibly re-evalate your security posture in light of it? You need a threat model for that. Pondering about the security of one's digital life can of course be worthwhile in general, but advising anyone to do so in the context of this linkbait is just advising them to waste their time.

In your Twitter example, the impersonation did not come as a surprise. People were predicting that outcome within minutes of Musk announcing it. Can you make a prediction about what bad things will happen to the people whose phone number is in this dump, compared to people whose phone number isn't there?

Re: WhatsApp data leak: 500M user records for sale

#76

Post by MertsA »

BrandoElFollito wrote: post #36
Kiro wrote: post #30

Earlier quoted context omitted.

In Sweden almost everything about you is public information. Your address, social security number, tax records, criminal record etc.

Out of curiosity: does this lead to more identity theft (or misuse)?

No, instead they use this radical method called actually identifying the person they're about to give a bunch of cash to instead of trying to pretend a username is a password.

Re: WhatsApp data leak: 500M user records for sale

#77

Post by lzooz »

Denvercoder9 wrote: post #73
lzooz wrote: post #71

Earlier quoted context omitted.

That interaction that you mention doesn't exist in whatsapp at all. You don't have to "accept" messages from new conversations.

Not completely true; while you don't have to accept messages for them to show up in your conversation list, when you receive the first message from someone not in your contact list you get the option to choose between "report", "block" and "continue".

That's false. Once again there is no "accept" or "continue" button. If you initiate a conversation and couldn't see the profile picture until they replied back it's because you weren't on their contact list and they added you to their contact list using the "add" button.

https://i.redd.it/8mvd3ez9gmm81.jpg

That's not the same as "accepting" a conversation request like for example it works on facebook.

Re: WhatsApp data leak: 500M user records for sale

#79

Post by wstuartcl »

ambhargava wrote: post #69

Very interesting to note that India is not on this list even though it has the largest WhatsApp user base.

I believe india requires their whatsapp services to be segmented in countryand backdoors to data -- they have a bunch of laws like this regarding communications all the way up to sat phones.

Re: WhatsApp data leak: 500M user records for sale

#80

Post by BrandoElFollito »

MertsA wrote: post #76
BrandoElFollito wrote: post #36

Earlier quoted context omitted.

Out of curiosity: does this lead to more identity theft (or misuse)?

No, instead they use this radical method called actually identifying the person they're about to give a bunch of cash to instead of trying to pretend a username is a password.

Sorry, I did not understand your comment (English is not my first language)
Post reply on HN