Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp is using your IMEI number as password

samgranger.com

Post reply on HN
Print view View original

41–50 of 83 posts

Re: WhatsApp is using your IMEI number as password

#41

Post by LaGrange »

ariannahsimpson wrote: post #31
LaGrange wrote: post #30

Earlier quoted context omitted.

This is a well-known design decision on their side. This is not as much a discovery as bringing it up.

Is there a particular reason (that you're aware of) for this decision? I'm certainly no expert on the matter, but it seems risky to store everything like that, especially unsalted. LinkedIn, anyone?

The problem isn't storing -- remember that we don't know how they store it, we only know how the password is generated. IMEI is intended to be unique and private -- e.g. knowing your IMEI might be enough to report the phone as stolen. If someone knows your IMEI they most likely have enough control over the phone to either completely spoof it or put malicious software on it. This makes it a reasonable tradeoff against implementing "proper" passwords, with their own ton of problems.

Re: WhatsApp is using your IMEI number as password

#42

Post by njs12345 »

shmerl wrote: post #32

Can anyone explain in general what is the point in WhatsApp which isn't compatible with anything except itself, vs normative XMPP/Jingle client through which one can communicate with any user from federated XMPP servers? I have hard time understanding why new closed (walled garden) IM networks appear in these day and age.

I use it to talk to my friends back home because:

- it's free (or inexpensive compared to international SMS)

- it doesn't require any technical expertise whatsoever

- it's cross platform

- it already has traction

I can't think of any alternative which has this combination of properties..

Re: WhatsApp is using your IMEI number as password

#43

Post by njs12345 »

shmerl wrote: post #40
marquis wrote: post #39

Earlier quoted context omitted.

It's quite popular in countries where buying SMS credits is not always an afforded cost, but public wifi is everywhere. Basic Android phones are fairly popular and inexpensive given that they double as a web browser and communication device for many.

That's understandable, but my question was about creating WhatsApp vs making a regular conformant XMPP/Jingle client which also simply works through TCP and UDP. The later gives free choice of what XMPP server to use and allows communicating with users of other federated servers. WhatsApp allows communicating only with WhatsApp if I understand correctly.

I would imagine this is a plus for them, sadly. It's probably easier to extract revenue from a walled garden than an equally user-friendly XMPP client.

Re: WhatsApp is using your IMEI number as password

#44

Post by njs12345 »

rjzzleep wrote: post #21
mobweb wrote: post #16

If you installed WhatsApp on an Android device for example, your password is likely to be an inverse of your phones IMEI number with an MD5 encryption thrown on top of it (without salt). How does OP know this? Was there a leak of "passwords" or did he find this through trial & error? Edit: Just found out that's what it says even on the Wikipedia entry about WhatsApp[1]. [1]: http://en.wikipedia.org/wiki/WhatsApp

it's called reverse engineering though. it's much easier to use reverse ios code than that weirdass dex format though imho

Really? I've done it once or twice, not hard at all with smali: http://code.google.com/p/smali/

Re: WhatsApp is using your IMEI number as password

#45

Post by njs12345 »

CrazyRobot wrote: post #28

This actually seems to me like a perfect solution (from WhatsApp's side). This way as long the user has the same phone number, he/she doesn't have to remember any credentials, which is probably the main reason (or one of the top 3) for people using WhatsApp in the first place. And as for the "security problem", if someone has access to your phone they can just maliciously use the app itself. I'm not saying that this…

Perhaps a better solution would be to tie it to the Google account on the phone? This could be done without requiring the user to remember any details as most people already have an account tied in.

Re: WhatsApp is using your IMEI number as password

#46

Post by evertonfuller »

shmerl wrote: post #38
adthrelfall wrote: post #36

Earlier quoted context omitted.

It got traction because it worked simply with no config and was very cost effective in certain use cases. I know it was used as a precursor to iMessage type eaperince to send 'texts' and images using only data, so was perfect for communicating across countries with no carrier charges.

So the only point was in avoiding one time step like adding an account to the client (like users do with e-mail too) / or registering on some XMPP server? Still it hardly justifies creating more walled networks (unless they allow federation and regular XMPP communication with their servers).

Do you think consumers care about walled networks? No.

Re: WhatsApp is using your IMEI number as password

#47

Post by cageface »

marquis wrote: post #39
shmerl wrote: post #32

Can anyone explain in general what is the point in WhatsApp which isn't compatible with anything except itself, vs normative XMPP/Jingle client through which one can communicate with any user from federated XMPP servers? I have hard time understanding why new closed (walled garden) IM networks appear in these day and age.

It's quite popular in countries where buying SMS credits is not always an afforded cost, but public wifi is everywhere. Basic Android phones are fairly popular and inexpensive given that they double as a web browser and communication device for many.

Here in Vietnam you can get unlimited 3g access for $2/month and once you've paid for that using something like WhatsApp is much cheaper than paying the SMS fee for every message.

Re: WhatsApp is using your IMEI number as password

#48

Post by elliottcarlson »

While it may not be the case in this scenario (since Sam says in a response on here that he sent them a message a few days ago), everyone should always be responsible in how they disclose flaws or discoveries in software:

http://en.wikipedia.org/wiki/Responsible_disclosure

Re: WhatsApp is using your IMEI number as password

#49

Post by kefs »

elliottcarlson wrote: post #48

While it may not be the case in this scenario (since Sam says in a response on here that he sent them a message a few days ago), everyone should always be responsible in how they disclose flaws or discoveries in software: http://en.wikipedia.org/wiki/Responsible_disclosure

> So just as giving a vendor no time to fix a vulnerability is irresponsible, so is it even more irresponsible to give that vendor a blank rain check.

http://kevtownsend.wordpress.com/2012/09/01/java-vulnerabili...

Re: WhatsApp is using your IMEI number as password

#50

Post by captaintacos »

njs12345 wrote: post #42
shmerl wrote: post #32

Can anyone explain in general what is the point in WhatsApp which isn't compatible with anything except itself, vs normative XMPP/Jingle client through which one can communicate with any user from federated XMPP servers? I have hard time understanding why new closed (walled garden) IM networks appear in these day and age.

I use it to talk to my friends back home because: - it's free (or inexpensive compared to international SMS) - it doesn't require any technical expertise whatsoever - it's cross platform - it already has traction I can't think of any alternative which has this combination of properties..

I hate to be the devil's advocate but I swear by Facebook's messenger app. It does exactly the same things: international, FREE-as-in-beer, really cross platform (can whatsapp do web?), push notifications on iPhone thereby effectively replacing SMS, etc. As long as the other person is on facebook of course!

It has come to the point that my wife and I barely use SMS anymore and are actually saving some play money on SMS thanks to that thing.

And that is bad news for carriers worldwide yes, but not that anyone really feels pity for them anyway.

Post reply on HN