7 ms·

I don't get this part: "We won’t post or share your WhatsApp number with others, including on Facebook" and then "And by connecting your phone number with F

I don't get this part: "We won’t post or share your WhatsApp number with others, including on Facebook" and then "And by connecting your phone number with Facebook's systems, Facebook can offer better friend suggestions and show you more relevant ads if you have an account with them" How are they matching up accounts without sharing my phone number with Facebook?

jamiesonbecker 10y ago
It's just hashed. I.e., pick a unique number that matches your phone number and just always use that one instead, because the value in your phone number is not the functionality of calling you, but matching you up with all of your other metadata, content, "Likes", etc. So the goal isn't to sell YOU. You are boring and prosaic. No advertiser cares about you personally. We'll make money by selling your likes and who you're connected to in this fuzzy, aggregate format. Advertisers want to sell to a group of people who look just like you.
- lorenzhs 10y ago
  > It's just hashed but the key space is way too small for a hash to be a meaningful anonymization mechanism. It's too easy to build a rainbow table for possible phone numbers.
  - xapata 10y ago
    How do you know what hashing algorithm is being used? And what salt?
    - JshWright 10y ago
      The algorithm and salt are irrelevant. There are only so many phone numbers... You could brute force the hash of a phone number in seconds on any modern computer.
      - SEMW 10y ago
        > The algorithm and salt are irrelevant. Given any input domain, you can choose an algorithm that will make bruteforcing the entire domain take as long as you like. As an extreme example, bcrypt with a work factor of 20 takes over a minute to calculate a single hash on a high-end desktop. (Of course, whether whatsapp are actually doing any of this is another question).
        JshWright 10y ago
        Ok, there is no _practical_ algorithm that would matter for a keyspace this small. Assuming they are hashing the values at all, I think it's pretty unlikely they are using a high work factor KDF...
      - xapata 10y ago
        Unless you know the original algorithm, any collisions you find are useless. I'll give you an example. Here's a hashcode from a real phone number: 1786883671916465751. What's the phone number I used to generate it?
        lorenzhs 10y ago
        Pretty sure Facebook can find out which hash function WhatsApp is using.
        xapata 10y ago
        Or they can just get the original data... So why complain that hashing is insecure?
        JshWright 10y ago
        With one hash, that would obviously be impossible. With millions? Trivial... Particularly when you already know the phone numbers for many of the users (those who have added their number to their profile), and you can match against contact databases.
vincentkriek 10y ago
I believe the big difference sharing ON Facebook and sharing WITH Facebook.
- JOnAgain 10y ago
  This is probably spot on, and the bit I missed when reading. So they share your phone number and contacts (or Facebook and Whatsapp use the same hash off your phone number and share that), but Facebook promises not to put the number you have in Whatsapp on the website.

jamiesonbecker 10y ago

It's just hashed. I.e., pick a unique number that matches your phone number and just always use that one instead, because the value in your phone number is not the functionality of calling you, but matching you up with all of your other metadata, content, "Likes", etc. So the goal isn't to sell YOU. You are boring and prosaic. No advertiser cares about you personally. We'll make money by selling your likes and who you're connected to in this fuzzy, aggregate format. Advertisers want to sell to a group of people who look just like you.

lorenzhs 10y ago
> It's just hashed but the key space is way too small for a hash to be a meaningful anonymization mechanism. It's too easy to build a rainbow table for possible phone numbers.
- xapata 10y ago
  How do you know what hashing algorithm is being used? And what salt?
  - JshWright 10y ago
    The algorithm and salt are irrelevant. There are only so many phone numbers... You could brute force the hash of a phone number in seconds on any modern computer.
    - SEMW 10y ago
      > The algorithm and salt are irrelevant. Given any input domain, you can choose an algorithm that will make bruteforcing the entire domain take as long as you like. As an extreme example, bcrypt with a work factor of 20 takes over a minute to calculate a single hash on a high-end desktop. (Of course, whether whatsapp are actually doing any of this is another question).
      - JshWright 10y ago
        Ok, there is no _practical_ algorithm that would matter for a keyspace this small. Assuming they are hashing the values at all, I think it's pretty unlikely they are using a high work factor KDF...
    - xapata 10y ago
      Unless you know the original algorithm, any collisions you find are useless. I'll give you an example. Here's a hashcode from a real phone number: 1786883671916465751. What's the phone number I used to generate it?
      - lorenzhs 10y ago
        Pretty sure Facebook can find out which hash function WhatsApp is using.
        xapata 10y ago
        Or they can just get the original data... So why complain that hashing is insecure?
      - JshWright 10y ago
        With one hash, that would obviously be impossible. With millions? Trivial... Particularly when you already know the phone numbers for many of the users (those who have added their number to their profile), and you can match against contact databases.

vincentkriek 10y ago

I believe the big difference sharing ON Facebook and sharing WITH Facebook.

JOnAgain 10y ago
This is probably spot on, and the bit I missed when reading. So they share your phone number and contacts (or Facebook and Whatsapp use the same hash off your phone number and share that), but Facebook promises not to put the number you have in Whatsapp on the website.