How Whisper app tracks ‘anonymous’ users • Hacker News Board

Re: How Whisper app tracks ‘anonymous’ users

#11

Post by denzil_correa » Thu, Oct 16, 2014, 5:23 PM UTC

rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

> 2. We've been working with researchers at a local university to ensure the anonymity around location was such that they couldn't determine groups of whispers from the same user. They contributed to our randomization algorithms and provided suggestions around security.

Recently, there was a paper by researchers at UCSB on anonymity on Whisper (Page 10, Section 7). I must say that Whisper seems to have mitigated the attack presented in the paper.

https://www.cs.ucsb.edu/~ravenben/publications/pdf/whisper-i...

Re: How Whisper app tracks ‘anonymous’ users

#12

Post by moxie » Thu, Oct 16, 2014, 5:38 PM UTC

rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

Based on your own comments here, it sounds like the reporting is entirely accurate. You're attempting to justify why you're tracking your users, but you're still tracking them.

You've highlighted many of the hard problems in this space: how do you achieve anonymity and unlinkability while doing things like IP hiding, spam filtering, and relevance matching? The issue is that you haven't solved the problems, and are instead suggesting you should get a pass because the problems are hard. It seems simple to me: if you haven't designed something that gives you truly unlinkable anonymity, don't claim to provide it. If you have to track your users to make your app work, don't claim not to track your users.

There are projects like Tor that are approaching these types of problems seriously, but apps like Whisper or Secret end up poisoning the well and confusing users. There's a huge difference between "can't" track and "won't" track. Right now you're claiming "can't," but it sounds like you're squarely in the "won't" category of having your servers "avert their eyes." I think this understandably makes people uneasy, particularly given the data mining direction it sounds like the company is headed.

Re: How Whisper app tracks ‘anonymous’ users

#13

Post by look_lookatme » Thu, Oct 16, 2014, 5:39 PM UTC

rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

So if I read this correctly, you track every users IP address and geolocate it?

Re: How Whisper app tracks ‘anonymous’ users

#14

Post by fragmede » Thu, Oct 16, 2014, 5:45 PM UTC

rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

You might have good reasons (and, certainly, you list some) but at the end of the day, you track every user's IP address and geo-locate it. This is Wrong (tm) for an app that claims to be about privacy.

Also, just because your maxmind geoip database is crap doesn't mean that the DOD or whoever you're selling information to doesn't have a better one.

Re: How Whisper app tracks ‘anonymous’ users

#15

Post by superuser2 » Thu, Oct 16, 2014, 5:46 PM UTC

moxie wrote: post #12

rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

Based on your own comments here, it sounds like the reporting is entirely accurate. You're attempting to justify why you're tracking your users, but you're still tracking them. You've highlighted many of the hard problems in this space: how do you achieve anonymity and unlinkability while doing things like IP hiding, spam filtering, and relevance matching? The issue is that you haven't solved the problems, and are in…

100% of network services "track" their users' IP addresses. Every website that is accessible outside of Tor can see its users' IPs. That is the nature of TCP/IP.

You act like this is a deliberate violation of privacy. I don't know what to say, except that you're wrong.

If you ask a question, you consent to be "tracked" to the extent necessary to deliver an answer to you. On the internet, that means IP address.

Re: How Whisper app tracks ‘anonymous’ users

#16

Post by moxie » Thu, Oct 16, 2014, 6:00 PM UTC

superuser2 wrote: post #15

moxie wrote: post #12

Earlier quoted context omitted.

Based on your own comments here, it sounds like the reporting is entirely accurate. You're attempting to justify why you're tracking your users, but you're still tracking them. You've highlighted many of the hard problems in this space: how do you achieve anonymity and unlinkability while doing things like IP hiding, spam filtering, and relevance matching? The issue is that you haven't solved the problems, and are in…

100% of network services "track" their users' IP addresses. Every website that is accessible outside of Tor can see its users' IPs. That is the nature of TCP/IP. You act like this is a deliberate violation of privacy. I don't know what to say, except that you're wrong. If you ask a question, you consent to be "tracked" to the extent necessary to deliver an answer to you. On the internet, that means IP address.

I don't know what to say, except that you're right. This is the problem that Tor is trying to solve, which is why Tor gets to claim that it is "anonymous," and random websites or apps don't get to make that claim.

I don't think it's a deliberate violation of privacy to operate a website, but I do think that it's a violation to operate a normal website and call it "anonymous." Because, as you point out, it's not.

Not only does it confuse users in the immediate sense, but it poisons the well for everyone who is approaching the problems seriously in the long term.

Re: How Whisper app tracks ‘anonymous’ users

#17

Post by Hario » Thu, Oct 16, 2014, 6:01 PM UTC

moxie wrote: post #12

rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

Based on your own comments here, it sounds like the reporting is entirely accurate. You're attempting to justify why you're tracking your users, but you're still tracking them. You've highlighted many of the hard problems in this space: how do you achieve anonymity and unlinkability while doing things like IP hiding, spam filtering, and relevance matching? The issue is that you haven't solved the problems, and are in…

Moxie, you're an (inter)national treasure. Thanks for helping us filter out the bullshit.

Re: How Whisper app tracks ‘anonymous’ users

#18

Post by secfirstmd » Thu, Oct 16, 2014, 6:03 PM UTC

doe88 wrote: post #3

Note: Whisper app != Open Whisper Systems (Completely unrelated)

Definitely an important point.

I love the work of Open Whisper Systems, Redphone/TextSecure/Signal is brilliant. I hope the completely get the number of users they deserve when they merge under the one brand.

Re: How Whisper app tracks ‘anonymous’ users

#19

Post by secfirstmd » Thu, Oct 16, 2014, 6:06 PM UTC

moxie wrote: post #12

rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

Based on your own comments here, it sounds like the reporting is entirely accurate. You're attempting to justify why you're tracking your users, but you're still tracking them. You've highlighted many of the hard problems in this space: how do you achieve anonymity and unlinkability while doing things like IP hiding, spam filtering, and relevance matching? The issue is that you haven't solved the problems, and are in…

Moxie,

Nothing I like more than watching you destroy snake-oil companies endangering user privacy, like this one and also Telegraph etc. Let's hope TextSecure/Redphone/Signal when they merge into one brand will get the amount of users they really deserve. This stuff is never just about gossip in Washington DC, it's always about the bigger picture of people in Sudan, China, Russia etc who are led into a false sense of security.

Man, I would love to see some of the pushers of this snake oil software crap in court some day as a result of the dangers they often knowingly expose their users to.

BTW - I've been meaning to drop you a secure mail about some other stuff but will do it next week.

Re: How Whisper app tracks ‘anonymous’ users

#20

Post by krigi » Thu, Oct 16, 2014, 6:12 PM UTC

I'm not upset or surprised by this. However, it's not the tracking Whisper and similar apps do that upsets me; it's the trashy content and vituperative gossip produced by their users.