Live data from Hacker News

How Whisper app tracks ‘anonymous’ users

theguardian.com

21–30 of 70 posts

Re: How Whisper app tracks ‘anonymous’ users

#21

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

Do you have any comment on the claims relating to the Department of Defence?

Re: How Whisper app tracks ‘anonymous’ users

#22

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

Your comments are at odds with the evidence presented by the Guardian, namely that you gave them access to your backend geo-tracking tool and they TOOK SCREENSHOTS:

http://www.theguardian.com/world/2014/oct/16/-sp-whispers-se...

With regards to the MaxMind Legacy databases (which are updated every Tuesday) the following accuracy is tested by MaxMind and presented on their website:

                      Correctly Resolved	Incorrectly Resolved	 Unresolved

   GeoLite2 City	   75%	                14%	                  12%

   GeoIP2 City	           84%	                13%	                  3%

   GeoIP2 Precision City.  84%	                13%	                  3%
source: https://www.maxmind.com/en/geoip2-city-accuracy?country=Unit...

Accurate enough to pin-point a particular place in Washington D.C. it seems. 75%/84% isn't bad.

I honestly can't understand that denial. The Guardian visited your offices and they were allowed access to the tool you deny exists and they took screenshots of posts from your users who posted from the Whitehouse. By the sounds of it someone at your company naively showboated the capabilities of your system to a journalist, demonstrating features that are completely contrary to your mission statement.

You then come here and try and deny the whole thing as if we are idiots.

I normally error on the side of caution, but I truly can't see how you can defend against the overwhelming evidence.

Are you stating that the screenshots are fabricated?

Re: How Whisper app tracks ‘anonymous’ users

#23
post #7
post #5

What amazes me is that all of this information came voluntarily from Whisper . > The Guardian visited the Whisper offices to consider the possibility of undertaking other journalistic projects with the company and sent two reporters last month to look in detail at how the app operates. At no stage during the visit were the journalists told they could not report on the information shared with them. What kind of a comp…

Ya, I wouldn't trust anything that promises security I can't compile myself. Its not perfect but at least there are more eyeballs.

Random sidenote on this: if everyone have this mentality doesn't mean no one will look at the source?

Not sure how to address this, just a random thought.

Re: How Whisper app tracks ‘anonymous’ users

#24
post #22

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

Your comments are at odds with the evidence presented by the Guardian, namely that you gave them access to your backend geo-tracking tool and they TOOK SCREENSHOTS: http://www.theguardian.com/world/2014/oct/16/-sp-whispers-se... With regards to the MaxMind Legacy databases (which are updated every Tuesday) the following accuracy is tested by MaxMind and presented on their website: Correctly Resolved Incorrectly Resol…

No, I'm saying the whisper locations are made up per #3 above.

Re: How Whisper app tracks ‘anonymous’ users

#25
post #22

Earlier quoted context omitted.

Your comments are at odds with the evidence presented by the Guardian, namely that you gave them access to your backend geo-tracking tool and they TOOK SCREENSHOTS: http://www.theguardian.com/world/2014/oct/16/-sp-whispers-se... With regards to the MaxMind Legacy databases (which are updated every Tuesday) the following accuracy is tested by MaxMind and presented on their website: Correctly Resolved Incorrectly Resol…

No, I'm saying the whisper locations are made up per #3 above.

ok, then can you explain how there can be a screenshot that states a user at location X said Y then?

As per the screenshot with the caption:

   A Whisper user posted this message from the vicinity of 
   the White House. The red dots indicate Whisper messages
   sent from that location. Potentially identifying 
   information has been redacted by the Guardian.

Re: How Whisper app tracks ‘anonymous’ users

#26
post #25

Earlier quoted context omitted.

No, I'm saying the whisper locations are made up per #3 above.

ok, then can you explain how there can be a screenshot that states a user at location X said Y then? As per the screenshot with the caption: A Whisper user posted this message from the vicinity of the White House. The red dots indicate Whisper messages sent from that location. Potentially identifying information has been redacted by the Guardian.

I think all they're saying is that the location X appears precise, but that it's not accurate. Just because the pin appears at location X doesn't mean that the user was actually at location X, simply that the database ended up recording their location as a (inaccurate) point that happened to be X, as opposed to recording an "area of uncertainty" or similar construct.

Re: How Whisper app tracks ‘anonymous’ users

#27
post #5

What amazes me is that all of this information came voluntarily from Whisper . > The Guardian visited the Whisper offices to consider the possibility of undertaking other journalistic projects with the company and sent two reporters last month to look in detail at how the app operates. At no stage during the visit were the journalists told they could not report on the information shared with them. What kind of a comp…

> What kind of a company invites journalists from a newspaper known for its investigative/muckraking skills

I can only guess, but I'd be willing to bet it's because of a mistaken idea that "we're on the same side", therefore any reporting by Guarding would almost certainly end up positive.

> and then hands over their secret sauce along with such gems:

... but yeah, I've got nothing, other than what were they thinking? I mean, I like the idea of keeping tabs on bad people, but then I'm not the one running a website that claims I won't track people.

Re: How Whisper app tracks ‘anonymous’ users

#28
post #26
post #25

Earlier quoted context omitted.

ok, then can you explain how there can be a screenshot that states a user at location X said Y then? As per the screenshot with the caption: A Whisper user posted this message from the vicinity of the White House. The red dots indicate Whisper messages sent from that location. Potentially identifying information has been redacted by the Guardian.

I think all they're saying is that the location X appears precise , but that it's not accurate . Just because the pin appears at location X doesn't mean that the user was actually at location X, simply that the database ended up recording their location as a (inaccurate) point that happened to be X, as opposed to recording an "area of uncertainty" or similar construct.

That may be true, but the meat of the contention is that Whisper are tracking their users' locations, even when those users asked Whisper not to. The accuracy of the tracking is a bit of a red herring: Whisper is tracking their users' location, without those users' consent.

Re: How Whisper app tracks ‘anonymous’ users

#29
post #23
post #7

Earlier quoted context omitted.

Ya, I wouldn't trust anything that promises security I can't compile myself. Its not perfect but at least there are more eyeballs.

Random sidenote on this: if everyone have this mentality doesn't mean no one will look at the source? Not sure how to address this, just a random thought.

More eyeballs have a good track record -- for instance, since bash is Free Software, many people have looked at it, which is why there have been no recent critical flaws in bash discovered by automated fuzzers.

Re: How Whisper app tracks ‘anonymous’ users

#30

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app…

Since you're here, care to comment on:

> “He’s a guy that we’ll track for the rest of his life and he’ll have no idea we’ll be watching him,” the same Whisper executive said.

Is that a quote that the Guardian invented from whole cloth, or is that how you see your users?

Post reply on HN