Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp is using your IMEI number as password

samgranger.com

Post reply on HN
Print view View original

61–70 of 83 posts

Re: WhatsApp is using your IMEI number as password

#61

Post by zurn »

LaGrange wrote: post #41
ariannahsimpson wrote: post #31

Earlier quoted context omitted.

Is there a particular reason (that you're aware of) for this decision? I'm certainly no expert on the matter, but it seems risky to store everything like that, especially unsalted. LinkedIn, anyone?

The problem isn't storing -- remember that we don't know how they store it, we only know how the password is generated. IMEI is intended to be unique and private -- e.g. knowing your IMEI might be enough to report the phone as stolen. If someone knows your IMEI they most likely have enough control over the phone to either completely spoof it or put malicious software on it. This makes it a reasonable tradeoff against…

> IMEI is intended to be unique and private

It's intended to be unique but not secret and not hard to guess. It's a bit like your SSN or a computer's MAC address.

> If someone knows your IMEI they most likely have enough control over the phone to either completely spoof it or put malicious software on it

Err, no? Your phone can be asked to broadcast it via radio, your phones previous owner / sales clerk knows it, etc, your wife/gf knows it, etc. Now it's trivial for any of those to gain access to your WhatsApp without any active and sophisticated attack requiring physical access.

Sure, with sufficient effort it might be possible for someone sniffing radio or having at some point handled your phone to subvert it in other ways, but this is zero effort.

Re: WhatsApp is using your IMEI number as password

#62

Post by anonuser302 »

zurn wrote: post #58
anonuser302 wrote: post #55

No offense but what is the big deal about this...This seems to be extremely low risk if you can even call it a risk, and hardly a vulnerability.. Every method on your website to “exploit” this is retrieving IMEI number through alternative ways which would mean the phone would be compromised anyway...If someone can compromise the phone who cares about this? Maybe whatsapp can be accessed more easily but isn't that moo…

Your IMEI isn't secret: not random/hard to guess, and not private. It's like a MAC address. Except you can't change it.

This still seems minor. If someone is able to get the number doesn't that spell larger issues than whatsapp? I get the point being made and I understand the potential issue, but I don't see how its a major security problem with whatsapp as I figure things are probably compromised anyway if the user is able to get the IMEI to begin with

Re: WhatsApp is using your IMEI number as password

#63

Post by zurn »

anonuser302 wrote: post #62
zurn wrote: post #58

Earlier quoted context omitted.

Your IMEI isn't secret: not random/hard to guess, and not private. It's like a MAC address. Except you can't change it.

This still seems minor. If someone is able to get the number doesn't that spell larger issues than whatsapp? I get the point being made and I understand the potential issue, but I don't see how its a major security problem with whatsapp as I figure things are probably compromised anyway if the user is able to get the IMEI to begin with

> If someone is able to get the number doesn't that spell larger issues than whatsapp?

No, since it's not a secret. Why would outing your IMEI spell large issues?

Re: WhatsApp is using your IMEI number as password

#64

Post by ZoFreX »

elliottcarlson wrote: post #48

While it may not be the case in this scenario (since Sam says in a response on here that he sent them a message a few days ago), everyone should always be responsible in how they disclose flaws or discoveries in software: http://en.wikipedia.org/wiki/Responsible_disclosure

I don't think responsible disclosure applies to deliberate, already-public protocol decisions.

Re: WhatsApp is using your IMEI number as password

#65

Post by anonuser302 »

zurn wrote: post #63
anonuser302 wrote: post #62

Earlier quoted context omitted.

This still seems minor. If someone is able to get the number doesn't that spell larger issues than whatsapp? I get the point being made and I understand the potential issue, but I don't see how its a major security problem with whatsapp as I figure things are probably compromised anyway if the user is able to get the IMEI to begin with

> If someone is able to get the number doesn't that spell larger issues than whatsapp? No, since it's not a secret. Why would outing your IMEI spell large issues?

even if you have the users phone nurmber and imei nuumber one would assume u already have access to other info then anyway so who cares about whatsapp Can you easedrop on whatsapp sessions from another phone using this info?

Re: WhatsApp is using your IMEI number as password

#66

Post by elemeno »

captaintacos wrote: post #50
njs12345 wrote: post #42

Earlier quoted context omitted.

I use it to talk to my friends back home because: - it's free (or inexpensive compared to international SMS) - it doesn't require any technical expertise whatsoever - it's cross platform - it already has traction I can't think of any alternative which has this combination of properties..

I hate to be the devil's advocate but I swear by Facebook's messenger app. It does exactly the same things: international, FREE-as-in-beer, really cross platform (can whatsapp do web?), push notifications on iPhone thereby effectively replacing SMS, etc. As long as the other person is on facebook of course! It has come to the point that my wife and I barely use SMS anymore and are actually saving some play money on S…

Using Facebook's messenger app requires you to know someone in way which just having their phone number doesn't.

For example, if I'm going to go on a date with someone and we've swapped numbers that's enough for us to talk by SMS/iMessage/WhatsApp, whilst we probably[1] don't know each other well enough yet to expose our digital lives to each other on Facebook.

[1] - This entirely depends on things like age, social norms, how much personal information is on your Facebook page etc. Also, depending on are you going on a date with someone you already know vs. someone new. Mostly the point being that anything that just needs a phone number has a low barrier to communication while also not leaking any personal information (other than your phone number).

Re: WhatsApp is using your IMEI number as password

#67

Post by shmerl »

vdm wrote: post #56
shmerl wrote: post #32

Can anyone explain in general what is the point in WhatsApp which isn't compatible with anything except itself, vs normative XMPP/Jingle client through which one can communicate with any user from federated XMPP servers? I have hard time understanding why new closed (walled garden) IM networks appear in these day and age.

Ubiquity; works on every mobile platform. (Including Nokia/Symbian, Windows Phone) So you can talk to any of your friends if they install the app. Phone numbers are logins. Everybody with a phone already has one, so they don't have to do the whole 'create/verify an ID/password' dance. If you have friends in other countries, this avoids roaming SMS charges. And if you are from Ireland, or Greece, lots of your friends…

> you can talk to any of your friends if they install the app

Yes, that's exactly the catch. Why should you require them to install anoter app if they might already use some other IM network? Approach of WhatsApp may be simplifies the initial registration step, but it adds to the global mess of the non interoperable IM networks. Negative impact way outweighs any potential comfort benefits, and authors who promote such things are to be blamed for it.

> Everybody with a phone already has one, so they don't have to do the whole 'create/verify an ID/password' dance

Actually you might want to do it, since numbers change, while IDs don't. Plus you want to authenticate the other party if for example you need a secure conversation (such as with OTR).

Re: WhatsApp is using your IMEI number as password

#68

Post by francuzz »

objclxt wrote: post #6
Xuzz wrote: post #2

There is no public API on the iPhone to access the IMEI, so at least it is pretty conclusively not using that there.

Good post - although for posterity retrieving a phone number doesn't work as described in all cases. Calling `getLine1Number()` on a GSM phone will return the MSISDN, but not all carriers store the MSISDN on the SIM (for security reasons), so it will in some cases return null. This is a somewhat moot point, because there are other ways to find mobile numbers! As you point out, this is almost certainly an Android spec…

MSISDN file on the SIM card (EFmsisdn) is optional and has default access rights allowing you to modify it with just a PIN(CHV1) code (see 3GPP TS 51.011). Therefore, information stored in this file is not very reliable, since everyone knowing the PIN code of the card can change it's content. I do not think it has anything to do with the security reasons...

I do not see anything wrong with using IMEI as a seed for a password generation, the problem is that this number should be encrypted using proper encryption method and not just transformed using MD5 hash function.

Re: WhatsApp is using your IMEI number as password

#69

Post by janerik »

shmerl wrote: post #67
vdm wrote: post #56

Earlier quoted context omitted.

Ubiquity; works on every mobile platform. (Including Nokia/Symbian, Windows Phone) So you can talk to any of your friends if they install the app. Phone numbers are logins. Everybody with a phone already has one, so they don't have to do the whole 'create/verify an ID/password' dance. If you have friends in other countries, this avoids roaming SMS charges. And if you are from Ireland, or Greece, lots of your friends…

> you can talk to any of your friends if they install the app Yes, that's exactly the catch. Why should you require them to install anoter app if they might already use some other IM network? Approach of WhatsApp may be simplifies the initial registration step, but it adds to the global mess of the non interoperable IM networks. Negative impact way outweighs any potential comfort benefits, and authors who promote suc…

For most people it's far easier to just install an app instead of going through a whole setup and registration process and remembering a login handle and a password. I have a lot non-geek friends who are happy with how WhatsApp works. They mostly ignore all privacy issues with this.
Post reply on HN