Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp data leak: 500M user records for sale

cybernews.com

Post reply on HN
Print view View original

11–20 of 109 posts

Re: WhatsApp data leak: 500M user records for sale

#11

Post by krater23 »

Gualdrapo wrote: post #10
TrianguloY wrote: post #7

Are there any other data associated with the number, other than the country and whether it has a WhatsApp account? You can check if a given number is on WhatsApp easily, and associate the country based on the phone format itself. Make this for all possible phone numbers (big number, but not impossibly big) and you will have a "leak". Edit: having a list of WhatsApp users already generated for you is easier than check…

Profile pictures come to mind.

Mostly blocked when you not in the phone book of the user. Thats not a leak, it's just a database of public accessible data. I would say, someone needs a headline, thats all. Ob the prize of this databases you see that they are worth nothing.

Re: WhatsApp data leak: 500M user records for sale

#12

Post by idiocrat »

kadoban wrote: post #9
andrewallbright wrote: post #2

So... what advise is there for technology comfortable people who want to mitigate the effects of data leaks like these? It seems like data provided is will be exposed eventually and company size doesn't seem correlate with data safety. For example should people be advised to rotate phone numbers every N amount of time?

The basic stuff helps a decent amount. Assume your name, phone, email, address are all public. Don't reuse passwords, ever (use a password manager), use 2fa wherever possible, ideally not the SMS kind. Use a password manager that has a tie-in with haveibeenpwned or whatever so you know asap to change your creds. Some extras: use unique email addresses per site if you can. Some setups allow infinite aliases. Then you…

>Don't reuse passwords, ever

Note to myself: change the combination on my luggage.

https://www.youtube.com/watch?v=LcHnf7VQuhc

Re: WhatsApp data leak: 500M user records for sale

#13

Post by TrianguloY »

Gualdrapo wrote: post #10
TrianguloY wrote: post #7

Are there any other data associated with the number, other than the country and whether it has a WhatsApp account? You can check if a given number is on WhatsApp easily, and associate the country based on the phone format itself. Make this for all possible phone numbers (big number, but not impossibly big) and you will have a "leak". Edit: having a list of WhatsApp users already generated for you is easier than check…

Profile pictures come to mind.

Profile, last connection time and status is public unless configured to not be.

I was thinking about data not obtainable without a normal use of the service.

Re: WhatsApp data leak: 500M user records for sale

#14

Post by krater23 »

TruffleLabs wrote: post #6

Sadly the WhatsApp 2 step really is just a pin and an email. I believe this really isn't 2 step as there is no ever-changing code. https://faq.whatsapp.com/2976081889094372/

Thats just public data. You can check for every phone number if there is a Whatsapp account connected with it, there is no leak. Everyone know this, this databases are worth nothing, and the prizes are really low, as you see.

Re: WhatsApp data leak: 500M user records for sale

#16

Post by krater23 »

baxtr wrote: post #8

These seem to be “just” phone numbers. Most of which probably already leaked through the last Facebook leak. Not sure how significant the data is.

You can check whith your own cellphone, if a phone number have a Whatsapp account, without any hacker knowledge, this is not significant at all.

Re: WhatsApp data leak: 500M user records for sale

#17

Post by aliqot »

Komodai wrote: post #3
andrewallbright wrote: post #2

So... what advise is there for technology comfortable people who want to mitigate the effects of data leaks like these? It seems like data provided is will be exposed eventually and company size doesn't seem correlate with data safety. For example should people be advised to rotate phone numbers every N amount of time?

Quoted post unavailable.

It's disgusting that this comment had to be vouched for, it's common sense.

Re: WhatsApp data leak: 500M user records for sale

#18

Post by jsnell »

andrewallbright wrote: post #2

So... what advise is there for technology comfortable people who want to mitigate the effects of data leaks like these? It seems like data provided is will be exposed eventually and company size doesn't seem correlate with data safety. For example should people be advised to rotate phone numbers every N amount of time?

The advise is to do literally nothing about it. What effect do you think this specific leak has on you? What kind of adversary do you think will be able to benefit from this data, and how?

The reality is that the data is useless trash, and there is no indication that this has actually leaked from Facebook or is showing any kind of security problem in their systems.

Re: WhatsApp data leak: 500M user records for sale

#19

Post by MattDemers »

kadoban wrote: post #9
andrewallbright wrote: post #2

So... what advise is there for technology comfortable people who want to mitigate the effects of data leaks like these? It seems like data provided is will be exposed eventually and company size doesn't seem correlate with data safety. For example should people be advised to rotate phone numbers every N amount of time?

The basic stuff helps a decent amount. Assume your name, phone, email, address are all public. Don't reuse passwords, ever (use a password manager), use 2fa wherever possible, ideally not the SMS kind. Use a password manager that has a tie-in with haveibeenpwned or whatever so you know asap to change your creds. Some extras: use unique email addresses per site if you can. Some setups allow infinite aliases. Then you…

>Some extras: use unique email addresses per site if you can. Some setups allow infinite aliases. Then you can blackhole one that gets leaked, and you can know where it got leaked from.

If you pay for ProtonMail, you get a SimpleLogin Premium for free, which makes the creation of dummy/alias emails a lot easier. They're owned by the same company.

Re: WhatsApp data leak: 500M user records for sale

#20

Post by tuyguntn »

krater23 wrote: post #16
baxtr wrote: post #8

These seem to be “just” phone numbers. Most of which probably already leaked through the last Facebook leak. Not sure how significant the data is.

You can check whith your own cellphone, if a phone number have a Whatsapp account, without any hacker knowledge, this is not significant at all.

> this is not significant at all.

I wonder if HN community would say same if Telegram data was leaked in a similar way

Post reply on HN