Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Whisper app tracks ‘anonymous’ users

theguardian.com

Post reply on HN
Print view View original

41–50 of 70 posts

Re: How Whisper app tracks ‘anonymous’ users

#41

Post by tptacek »

superuser2 wrote: post #36
moxie wrote: post #16

Earlier quoted context omitted.

I don't know what to say, except that you're right . This is the problem that Tor is trying to solve, which is why Tor gets to claim that it is "anonymous," and random websites or apps don't get to make that claim. I don't think it's a deliberate violation of privacy to operate a website, but I do think that it's a violation to operate a normal website and call it "anonymous." Because, as you point out, it's not. Not…

It's "anonymous" if it doesn't publish your name/identifier alongside your content. 4chan is anonymous. When you use it, you are anonymous to the people reading your comments. Does this app pretend at any point that its operators couldn't identify users if they wanted to? That would be dishonest. But what word do you expect them to use for "your name will not be published" besides "anonymous"?

This is a useless definition of "anonymous". It's anonymous to the extent that you care about 4chan, but not anonymous to the extent that you care about prosecution.

Where on Whisper's site do they say "this site is anonymous, but it is not safe enough to publish anything with legal implications"? I looked.

Re: How Whisper app tracks ‘anonymous’ users

#42

Post by opendais »

pwnna wrote: post #23
opendais wrote: post #7

Earlier quoted context omitted.

Ya, I wouldn't trust anything that promises security I can't compile myself. Its not perfect but at least there are more eyeballs.

Random sidenote on this: if everyone have this mentality doesn't mean no one will look at the source? Not sure how to address this, just a random thought.

I tend to look when I run into an issue. So its not "I never look" it is more "I only look when I feel I have to."

If you get enough people doing that...well, imo, you'd probably have most "issues" surface as quickly as it would in commercial software ... and you'd have the added advantage of not everyone having a vested interest in obscuring any potential 'issues' that might negatively affect the company. [e.g. A privacy centric company that records addresses? Ouch]

The other issue is if you don't own the network, you can't trust the network.

Re: How Whisper app tracks ‘anonymous’ users

#43

Post by lsiebert »

agd wrote: post #2

So even if you disable the location feature it still tracks your location? I'd be interested what they mean by 'broad location tracking' but I can't imagine that it's consistent with their anonymity claims. e.g. see http://www.nature.com/srep/2013/130325/srep01376/full/srep01...

Apparently they use IP address and geolocation in that case, not GPS.

Re: How Whisper app tracks ‘anonymous’ users

#44

Post by mpyne »

hdevalence wrote: post #28
mpyne wrote: post #26

Earlier quoted context omitted.

I think all they're saying is that the location X appears precise , but that it's not accurate . Just because the pin appears at location X doesn't mean that the user was actually at location X, simply that the database ended up recording their location as a (inaccurate) point that happened to be X, as opposed to recording an "area of uncertainty" or similar construct.

That may be true, but the meat of the contention is that Whisper are tracking their users' locations, even when those users asked Whisper not to . The accuracy of the tracking is a bit of a red herring: Whisper is tracking their users' location, without those users' consent.

I'm not trying to advocate one way or the other with this comment, just to clarify what is actually being argued about.

Re: How Whisper app tracks ‘anonymous’ users

#45

Post by [deleted] »

hdevalence wrote: post #28
mpyne wrote: post #26

Earlier quoted context omitted.

I think all they're saying is that the location X appears precise , but that it's not accurate . Just because the pin appears at location X doesn't mean that the user was actually at location X, simply that the database ended up recording their location as a (inaccurate) point that happened to be X, as opposed to recording an "area of uncertainty" or similar construct.

That may be true, but the meat of the contention is that Whisper are tracking their users' locations, even when those users asked Whisper not to . The accuracy of the tracking is a bit of a red herring: Whisper is tracking their users' location, without those users' consent.

[deleted]

Re: How Whisper app tracks ‘anonymous’ users

#46

Post by throwawayaway »

moxie wrote: post #12
rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

Based on your own comments here, it sounds like the reporting is entirely accurate. You're attempting to justify why you're tracking your users, but you're still tracking them. You've highlighted many of the hard problems in this space: how do you achieve anonymity and unlinkability while doing things like IP hiding, spam filtering, and relevance matching? The issue is that you haven't solved the problems, and are in…

Very unfortunate naming clash what with whispersystems[2010] predating whisper app [2012] and whispertext llc [2011].

Very unfortunate indeed, people may have misunderstood my recommendations of the foremost as recommendations of the latter.

Good to see a very public lambasting.

Re: How Whisper app tracks ‘anonymous’ users

#47

Post by MichaelGG »

rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

The Whisper app on Android asks for "Device ID & call information" allowing you to see the serial number of a user as well as who they call and who calls them. If you don't collect that info, why is your app requesting permissions to it?

Re: How Whisper app tracks ‘anonymous’ users

#48

Post by scintill76 »

rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

> I am happy to show a screenshot of the email chain between myself and our lawyers back in July.

Do your emails specifically detail the changes the Guardian discusses, and an October 13-ish timeline for publishing them? Maybe you were planning on changing the ToS since July, but that doesn't mean anything in relation to the content, nature, or timing of the change you just released.

> we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable... The % of all Whispers which are tagged as somewhere in the middle of Kansas because we don't really know where they are (but we know they are in the US) is very high.

> We want to know where a user is in a general sense for things like tracking timezone so when we send pushes we know not to send pushes at 3 in the morning. you'd be surprised how often device timezone may not always match with physical location.

So, "Chill everyone, we get 'USA' and just plot it randomly." then "Our location algorithm is accurate enough that we override the user's timezone selection, despite 'USA' spanning 6-9 timezones and multiple Daylight Savings permutations."

Re: How Whisper app tracks ‘anonymous’ users

#49

Post by scintill76 »

hdevalence wrote: post #30
rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

Since you're here, care to comment on: > “He’s a guy that we’ll track for the rest of his life and he’ll have no idea we’ll be watching him,” the same Whisper executive said. Is that a quote that the Guardian invented from whole cloth, or is that how you see your users?

It's a bit reminiscent of "They 'trust me'. Dumb fucks."[0], if the Guardian is accurate here.

[0] http://www.businessinsider.com/well-these-new-zuckerberg-ims...

Re: How Whisper app tracks ‘anonymous’ users

#50

Post by scintill76 »

MichaelGG wrote: post #47
rubyrescue wrote: post #8

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

The Whisper app on Android asks for "Device ID & call information" allowing you to see the serial number of a user as well as who they call and who calls them. If you don't collect that info, why is your app requesting permissions to it?

Would not be surprised if it was for a third-party analytics library, but still, that does not go well with a supposedly anonymous app.
Post reply on HN