All I have to say is, Thank you Guardian!!!
And, oh, screw this app.
I wouldn't recommend it to anyone. Or any other claimed secure/anonymous app, that does not have the "Moxie Marlinspike seal of approval"(TM)!
How Whisper app tracks ‘anonymous’ users
61–70 of 70 posts
Re: How Whisper app tracks ‘anonymous’ users
#62Earlier quoted context omitted.
It's "anonymous" if it doesn't publish your name/identifier alongside your content. 4chan is anonymous. When you use it, you are anonymous to the people reading your comments. Does this app pretend at any point that its operators couldn't identify users if they wanted to? That would be dishonest. But what word do you expect them to use for "your name will not be published" besides "anonymous"?
This is a useless definition of "anonymous". It's anonymous to the extent that you care about 4chan, but not anonymous to the extent that you care about prosecution. Where on Whisper's site do they say "this site is anonymous, but it is not safe enough to publish anything with legal implications"? I looked.
[deleted]
Re: How Whisper app tracks ‘anonymous’ users
#63I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…
You don't deny any of the statements attributed to whisper executives. They were what gave most people cause for concern, not geoip tracking people that don't want to be tracked.
Re: How Whisper app tracks ‘anonymous’ users
#64I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…
Based on your own comments here, it sounds like the reporting is entirely accurate. You're attempting to justify why you're tracking your users, but you're still tracking them. You've highlighted many of the hard problems in this space: how do you achieve anonymity and unlinkability while doing things like IP hiding, spam filtering, and relevance matching? The issue is that you haven't solved the problems, and are in…
That is 100% correct and clear.
Re: How Whisper app tracks ‘anonymous’ users
#65Anonymous - no way. A small amount of location tracking + the additional data any agency and many others can easily access will easily identify an individual. I read the UCSB paper referenced by the Whisper CTO - it just said there was a hard problem Whisper was trying to do something about. The paper also said that each user had a permanent GUID. So if I, with my GUID, get on a plane from SFO to (say) Santa Fe on one particular day - the GUID use moving will make it clear I have taken a plane - then the agency (or perhaps my credit card issuer?) will get the candidates for my GUID down to a few hundred at most just from that move and the passenger list (or ticket purchase records). Coupled with my GUID's home city and work city and they probably have me nailed - just like that. Trivial.
Re: How Whisper app tracks ‘anonymous’ users
#66I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…
>> I am happy to show a screenshot of the email chain between myself and our lawyers back in July.
I am happy to see!
Re: How Whisper app tracks ‘anonymous’ users
#67What amazes me is that all of this information came voluntarily from Whisper . > The Guardian visited the Whisper offices to consider the possibility of undertaking other journalistic projects with the company and sent two reporters last month to look in detail at how the app operates. At no stage during the visit were the journalists told they could not report on the information shared with them. What kind of a comp…
> What kind of a company invites journalists from a newspaper known for its investigative/muckraking skills I can only guess, but I'd be willing to bet it's because of a mistaken idea that "we're on the same side", therefore any reporting by Guarding would almost certainly end up positive. > and then hands over their secret sauce along with such gems: ... but yeah, I've got nothing, other than what were they thinking…
In this situation it was in Whisper's interest to sell their ability to locate users as precisely as possible, they were obviously too keen to do so. Journalists value Whisper's user's content because they can be sure that it comes from a military base, for example, if their location tracking tools are precise.
Re: How Whisper app tracks ‘anonymous’ users
#68So even if you disable the location feature it still tracks your location? I'd be interested what they mean by 'broad location tracking' but I can't imagine that it's consistent with their anonymity claims. e.g. see http://www.nature.com/srep/2013/130325/srep01376/full/srep01...
I'm the author of this paper and I absolutely agree. If you keep identifiers, simply blurring the location isn't enough to address the risks of re-identification (https://twitter.com/yvesalexandre/status/524219573650722817).
Re-identification is a very different risk than the one considered by the UC Santa Barbara researchers in Wang, Gang, et al. "Whispers in the Dark: Analysis of an Anonymous Social Network." (2014).
Re: How Whisper app tracks ‘anonymous’ users
#69Earlier quoted context omitted.
Your comments are at odds with the evidence presented by the Guardian, namely that you gave them access to your backend geo-tracking tool and they TOOK SCREENSHOTS: http://www.theguardian.com/world/2014/oct/16/-sp-whispers-se... With regards to the MaxMind Legacy databases (which are updated every Tuesday) the following accuracy is tested by MaxMind and presented on their website: Correctly Resolved Incorrectly Resol…
No, I'm saying the whisper locations are made up per #3 above.
Why not allow people to choose where they want to post "from" instead?
Re: How Whisper app tracks ‘anonymous’ users
#70Earlier quoted context omitted.
Do you have any links about Telegraph endangering user privacy? I had a friend try to get me to start using it. I haven't really had time yet to do a lot of research on it and would love some insight if they are fishy at all.
http://www.thoughtcrime.org/blog/telegram-crypto-challenge/ https://news.ycombinator.com/item?id=6936539
Thanks for providing these links. Very interesting stuff.
I heard about Telegram after it's rise in popularity in Asian countries; shame that they have (BIG) issues like this.