How to Bypass WhatsApp Web's Locked Chat Feature
1–10 of 34 posts
Re: How to Bypass WhatsApp Web's Locked Chat Feature
#2I think my expectations for a feature called “locked chats” are somewhat different from those of WhatsApp.
What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks?
In this case, I think WhatsApp should have done better — or refrained from adding this feature at all.
Re: How to Bypass WhatsApp Web's Locked Chat Feature
#3I think my expectations for a feature called “locked chats” are somewhat different from those of WhatsApp. What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks? In this case, I think WhatsApp should have done better — or refrained from adding this feature at all.
> What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks?
Amusingly, these two questions apply just as well to almost all physical locks in the material world. I suppose that makes WhatsApp's "lock" analogy apt.
Re: How to Bypass WhatsApp Web's Locked Chat Feature
#4"Trying something?"
Re: How to Bypass WhatsApp Web's Locked Chat Feature
#5Semi-related: On the old F1 website, they'd post the lap and sector times of drivers during an F1 session (practice, qualifying, race). First it was a Java app which had all the data, and then they got fancy and wrote it in JavaScript, and enshittified it: if you don't subscribe to their premium... website offering?.. you just get colored sectors whenever the driver's finished that sector (yellow as they've passed it, green if it's the fastest time they've driven through this sector, purple if it's the fastest of anyone, in the current session). I was wondering if they still had the sector times and just hid it on the frontend, and it was the case. There was an if-block that was called during initialization that checked if user was premium. Adding a breakpoint and adding a condition to set premium = true got me the sector times!
And then they changed their app to use Unity and WASM, and it's all Assembly-esque in the developer tool.
Re: How to Bypass WhatsApp Web's Locked Chat Feature
#6Semi-related: On the old F1 website, they'd post the lap and sector times of drivers during an F1 session (practice, qualifying, race). First it was a Java app which had all the data, and then they got fancy and wrote it in JavaScript, and enshittified it: if you don't subscribe to their premium... website offering?.. you just get colored sectors whenever the driver's finished that sector (yellow as they've passed it…
Yep, this is why I'm not a fan of WASM. It's going to make debugging/reversing webapps much, much harder while that has always been one of the charms of the web.
Re: How to Bypass WhatsApp Web's Locked Chat Feature
#7I think my expectations for a feature called “locked chats” are somewhat different from those of WhatsApp. What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks? In this case, I think WhatsApp should have done better — or refrained from adding this feature at all.
> What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks? Amusingly, these two questions apply just as well to almost all physical locks in the material world. I suppose that makes WhatsApp's "lock" analogy apt.
However, we should consider that this is about online privacy features, which is a fairly hot topic nowadays. And it kind of feels that we got drape curtains* instead of a lock - and I think it's not exactly what people would reasonably expect for a feature like this? Or do they clarify that it's a weak protection somewhere?
___
*) I mean, it can be unlocked by literally opening JS console and typing one command. That's a gate latch at best.
Re: How to Bypass WhatsApp Web's Locked Chat Feature
#8I think my expectations for a feature called “locked chats” are somewhat different from those of WhatsApp. What is the value of locking something if the lock can be easily bypassed? Just preventing the least sophisticated attacks? In this case, I think WhatsApp should have done better — or refrained from adding this feature at all.
Personally I use it to hide chats from my girlfriend who has access to my phone.
Re: How to Bypass WhatsApp Web's Locked Chat Feature
#9Semi-related: On the old F1 website, they'd post the lap and sector times of drivers during an F1 session (practice, qualifying, race). First it was a Java app which had all the data, and then they got fancy and wrote it in JavaScript, and enshittified it: if you don't subscribe to their premium... website offering?.. you just get colored sectors whenever the driver's finished that sector (yellow as they've passed it…
It’s always good to take a look, many things are decided on the client side, and developer tools are part of the browsers anyway.
The other day I wanted to make reservations for a service to send my luggage from the airport to my house in Japan, and the form was giving me errors.
Searching for the error string around I realized there was a timeout set on the client side, so I increased it and could slowly but smoothly fill in all the information that required a server check.
I guess they never bothered to debug their system when accessing it from the other side of the world. All it needed was a few extra milliseconds for the requests to arrive in time.
Re: How to Bypass WhatsApp Web's Locked Chat Feature
#10"Trying something?"
;)