Live data from Hacker News

How to Bypass WhatsApp Web's Locked Chat Feature

lcat.dev

11–20 of 34 posts

Re: How to Bypass WhatsApp Web's Locked Chat Feature

#11
post #8
post #2

I think my expectations for a feature called “locked chats” are somewhat different from those of WhatsApp. What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks? In this case, I think WhatsApp should have done better — or refrained from adding this feature at all.

Personally I use it to hide chats from my girlfriend who has access to my phone.

I totally get that hiding things from partners is a not uncommon thing.

Speaking as someone who has lived with my wife for over 10 years and where we can each access each other’s phones (for reasons of administrative convenience), neither of us have ever “snooped” on each other.

So when I hear of people taking advantage of features to hide chats from their partner it makes me wonder about the psychological health of either the relationship, one, or both of the partners.

There are absolutely psychologically unhealthy controlling partners who “snoop” on their partners unreasonably dictating what is and isn’t allowed. And at the same time there are also unfaithful partners who are having the kind of conversations with other people that they really shouldn’t when they’re in a committed relationship.

Only other reason I can think to hide chats are risqué group chats with friends posting arguably inappropriate content, but again, if your partner is snooping on this and then getting controlling, that’s not really healthy.

Finally, I will admit I sometimes use incognito mode on my web browser at times (but never for conversations), so perhaps I’m a bit of a hypocrite.

Re: How to Bypass WhatsApp Web's Locked Chat Feature

#12
post #5

Semi-related: On the old F1 website, they'd post the lap and sector times of drivers during an F1 session (practice, qualifying, race). First it was a Java app which had all the data, and then they got fancy and wrote it in JavaScript, and enshittified it: if you don't subscribe to their premium... website offering?.. you just get colored sectors whenever the driver's finished that sector (yellow as they've passed it…

One of the dating apps with a web interface had a separate API to increment message counts sent to users. Non-premium users could only like profiles or send a limited number of texts. I simply blocked that API and was able to use the app like a premium user

Re: How to Bypass WhatsApp Web's Locked Chat Feature

#13
post #8

Earlier quoted context omitted.

Personally I use it to hide chats from my girlfriend who has access to my phone.

I totally get that hiding things from partners is a not uncommon thing. Speaking as someone who has lived with my wife for over 10 years and where we can each access each other’s phones (for reasons of administrative convenience), neither of us have ever “snooped” on each other. So when I hear of people taking advantage of features to hide chats from their partner it makes me wonder about the psychological health of…

I'm curious, for what reasons do you use incognito?

Re: How to Bypass WhatsApp Web's Locked Chat Feature

#14

Earlier quoted context omitted.

I totally get that hiding things from partners is a not uncommon thing. Speaking as someone who has lived with my wife for over 10 years and where we can each access each other’s phones (for reasons of administrative convenience), neither of us have ever “snooped” on each other. So when I hear of people taking advantage of features to hide chats from their partner it makes me wonder about the psychological health of…

I'm curious, for what reasons do you use incognito?

Aside from technical troubleshooting reasons, never for “social” interactions. For all other times, all I will say is that your guess is probably correct.

Re: How to Bypass WhatsApp Web's Locked Chat Feature

#15
post #5

Semi-related: On the old F1 website, they'd post the lap and sector times of drivers during an F1 session (practice, qualifying, race). First it was a Java app which had all the data, and then they got fancy and wrote it in JavaScript, and enshittified it: if you don't subscribe to their premium... website offering?.. you just get colored sectors whenever the driver's finished that sector (yellow as they've passed it…

One of the dating apps with a web interface had a separate API to increment message counts sent to users. Non-premium users could only like profiles or send a limited number of texts. I simply blocked that API and was able to use the app like a premium user

Leave some matches for the rest of us, Lewis. :<

Re: How to Bypass WhatsApp Web's Locked Chat Feature

#16
It is a good reminder for front-end devs that security-through-obscurity is not sufficient. It never has.

Reminds me of a security company that claimed they could force a watermark onto any content in their web-front-end. Turns out it was a canvas overlay you could just simple delete from the HTML. LOL.

Re: How to Bypass WhatsApp Web's Locked Chat Feature

#17
post #5

Semi-related: On the old F1 website, they'd post the lap and sector times of drivers during an F1 session (practice, qualifying, race). First it was a Java app which had all the data, and then they got fancy and wrote it in JavaScript, and enshittified it: if you don't subscribe to their premium... website offering?.. you just get colored sectors whenever the driver's finished that sector (yellow as they've passed it…

Yep, this is why I'm not a fan of WASM. It's going to make debugging/reversing webapps much, much harder while that has always been one of the charms of the web.

Also makes learning from other sites much harder, which I think is another fundamental appeal of the web.

Re: How to Bypass WhatsApp Web's Locked Chat Feature

#18
post #2

I think my expectations for a feature called “locked chats” are somewhat different from those of WhatsApp. What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks? In this case, I think WhatsApp should have done better — or refrained from adding this feature at all.

> In this case, I think WhatsApp should have done better — or refrained from adding this feature at all.

At least they should encrypt the messages instead of making it seems like it's encrypted. AFAIK, in the mobile WhatsApp, locked chats will get wiped without screen lock or secret code. They make it seem like it's practically impossible to recover the messages without doing real crypto stuff on the locked chats' messages.

Re: How to Bypass WhatsApp Web's Locked Chat Feature

#19
post #8

Earlier quoted context omitted.

Personally I use it to hide chats from my girlfriend who has access to my phone.

I totally get that hiding things from partners is a not uncommon thing. Speaking as someone who has lived with my wife for over 10 years and where we can each access each other’s phones (for reasons of administrative convenience), neither of us have ever “snooped” on each other. So when I hear of people taking advantage of features to hide chats from their partner it makes me wonder about the psychological health of…

> So when I hear of people taking advantage of features to hide chats from their partner it makes me wonder about the psychological health of either the relationship, one, or both of the partners.

I am the exact opposite and would wonder about the psychological health of either the relationship or both of the partners if they have so intertwined themselves that they no longer feel the need to keep any aspect of their identities private from each other.

> Only other reason I can think to hide chats

The number of reasons are as numerous as there are relationships. I literally just finished sending my mother a message about a joint gift to my father in a group chat that I would not want my father to see, since it would spoil his Christmas present. I have several chat groups that contain information that I am legally not allowed to let my partner, or anyone else for that matter, see. And thats not even getting into all the different levels of confidentially that friends talking amongst friends reasonably might expect when sharing stories of their personal lives with each other.

Re: How to Bypass WhatsApp Web's Locked Chat Feature

#20
post #16

It is a good reminder for front-end devs that security-through-obscurity is not sufficient. It never has. Reminds me of a security company that claimed they could force a watermark onto any content in their web-front-end. Turns out it was a canvas overlay you could just simple delete from the HTML. LOL.

This is such a problem in security - executives don’t know that and will buy all sorts of security theatre bullshit
Post reply on HN