21–30 of 69 posts
E: Disregard. Whatsapp is doing exactly what they should be doing. Telegram seems to proxy the requests. Why is no one saying anything about end to end crypto? Whatsapp shouldn't be able to see my messages, isn't that what they say themselves?
In order to produce the link preview, probably. As far as why it's character by character, I don't know, but that doesn't seem very sinister to me. Checking URLs letter by letter is sloppy, especially if you're not even trying to do auto completion, but it doesn't reveal any more information than a complete url could. Anyway, I would think they are expecting people to paste URLs in, not type them. I've written code t…
See this tweet for the info exposed: https://twitter.com/0xjomo/status/874585822158352384
E: Disregard. Whatsapp is doing exactly what they should be doing. Telegram seems to proxy the requests. Why is no one saying anything about end to end crypto? Whatsapp shouldn't be able to see my messages, isn't that what they say themselves?
The app obviously can see the messages, this happens on the clients.
Telegram seems to proxy the requests.
So Whatsapp wins with crypto here.
One aspect is the lack of debounce, but also revealing the endusers ip and user agent. They could proxy external link requests via whatsapp servers without breaking end to end encryption. wonder what iMessage does ?!
One aspect is the lack of debounce, but also revealing the endusers ip and user agent. They could proxy external link requests via whatsapp servers without breaking end to end encryption. wonder what iMessage does ?!
What good is E2E if you are going to send the plaintext home anyway? Doing these requests on the device is stupid, but proxying them through FB servers would border on malicious.
Did you all know that chrome does this too? May sound obvious but I always had assumed that nothing is sent until you press enter for some reason (yeah I know, search prediction would be impossible without that). But one day I was type in a path on a test URL and noticing my server getting hit on - every single letter.
Facebook has literally told courts they can't decrypt WhatApp traffic. I wonder if that court case in Brazil is still pending.
By comparison, no one ever said "There's no way Google could read my search terms".
A more accurate comparison would be regarding Allo.
I realized I accidentally had a password copied to my clipboard and I pasted into into my address bar. Well great, I didn't push enter, didn't search for the password, but now I have to change my password because it was sent to google because autocomplete.
It's very frustrating because often times people are not aware they are exposing sensitive information via URLs for internal resources.
Did you all know that chrome does this too? May sound obvious but I always had assumed that nothing is sent until you press enter for some reason (yeah I know, search prediction would be impossible without that). But one day I was type in a path on a test URL and noticing my server getting hit on - every single letter.
Yes, I did know that. The difference is WhatsApp is selling encrypted-onboard privacy. Which is now, prima facie, a lie. Facebook has literally told courts they can't decrypt WhatApp traffic. I wonder if that court case in Brazil is still pending. By comparison, no one ever said "There's no way Google could read my search terms". A more accurate comparison would be regarding Allo.
Yeah this is a much bigger deal, for sure, as it's a messaging app - just pointing out similar case in a different application.
Did you all know that chrome does this too? May sound obvious but I always had assumed that nothing is sent until you press enter for some reason (yeah I know, search prediction would be impossible without that). But one day I was type in a path on a test URL and noticing my server getting hit on - every single letter.
However, WhatsApp is selling a solution that is meant to provide privacy. When I write a URL in an SMS, my phone does not try to preemptively retrieve it to display a preview. WhatsApp may be encrypting the message, but it's identifying me to a server while I'm composing it, which is enough to completely destroy any level of privacy or anonymity that I would expect.