5 ms·

If you think there is no problem, you are wrong. The blog post does not show all the information leaks that this implies. Example: I can modify the script to mo

If you think there is no problem, you are wrong. The blog post does not show all the information leaks that this implies. Example: I can modify the script to monitor all the numbers I've in my phone, so that based on the online/offline status in a few weeks I can be able to guess who is having conversations together, discovering cheatings, work affairs, ... EDIT: Practical example. After collecting enough data about user X I create a table about the probability of this user being online in a given few-minutes time ranges. Then I check the online frequency of that user compared to the online statuses of another user Y. If the difference compared to the expected probability is significant, than I can suspect the two are chatting. Another thing I can use is that attivation delay of the online status, since often X sends a message to Y and this results in, a few seconds after, Y to be online, and then the contrary.

vultour 9y ago
But you are voluntarily giving that info away if you use WA and don't change your privacy settings. The 'last online' feature is quite important IMO, and if you're concerned about this then disable it. Edit: On the other hand it would perhaps be better to have it on 'Contacts only' as the default, but you could still monitor your colleagues as they probably have you in their contacts anyway.
- antirez 9y ago
  I agree but I don't believe the average user realizes that it is possible to do that with the above data. And indeed, to do that manually is not practical, but if the info becomes scriptable, it's another matter.
  - Loic 9y ago
    Scriptable and available for anybody. That my contacts in WhatsApp can correlate my activities with my status, this is part of the purpose of WhatsApp, that any stranger having my mobile phone from my business contact can do it, this is another matter. Edit: Discovered that one can share only with "My Contacts" these information. I am surprised I haven't seen this before or maybe the if you do not share, you cannot see info box misguided me into not restricting to my contacts these informations.
- erbdex 9y ago
  Whatsapp has no setting to disable the "online" flag when i have opened the app, and a bunch of things mentioned can be built on top of just this. I think this shows how some seemingly trivial data points on an individual level can allow one to build something way more than the sum of parts at a mass surveillance level.
  - exhilaration 9y ago
    I believe you're looking for Settings > Account > Privacy > Status > Only Share with... And select no contacts on that screen. This is on the Android app, I'm not familiar with the web version.
    - jmanderley 9y ago
      I don't think that disables the "online" flag. As far as I'm aware, it's not currently possible to disable that one.
jamesfe 9y ago
Well, maybe. I don't want to discount this concept entirely because some info is being "leaked" if that is the right word, but... Let's say one of your contacts chats a lot because it's a chatty person. They're online far more than another person. What if that other person only chats on the bus on the way to and from work at roughly the same time every day to tell their wife they're on the way home. This activity will overlap with the chatty person's activity all the time. By your rationale, they are having a conversation, maybe cheating, and maybe having a work affair. I think the more contacts a user that are active, the higher probability that your model predicts they are having a "conversation" with another user. You'll probably find that your thresholds are really hard to fine-tune: maybe we say A chats with B if abs(A.activeTime - B.activeTime) < threshold, but that threshold is going to be super hard to find* and even harder to validate. Sure, there is some information here (the picture probably being the most concretely weird) but the fact that you can just go to the App and check a box for privacy means that this seems like not a huge issue. Yes, WhatsApp made the software, but its your responsibility to apply your own privacy settings.
- antirez 9y ago
  If you check the model I described in my comment, it should filter the "bus problem", since it will detect a chat only if, compared to the standard "bus time" probability of the user A chatting, it is chatting more if in the same range also B is chatting. If you add to this that people on Whatsapp usually do not talk to the exact minutes, it is definitely possible to create a robust system for guessing with good probability of two have often conversations. Also note that the phone numbers in input are not random, are the ones of a connected circle of persons. Add to this the fact that we can split the ranges even, potentially, by few minutes, and you can even detect interesting stuff for people having continuos chats with multiple persons like teenagers. Another thing that is possible probably is also "groups detection", since at new messages a set of users will activate at the same time.
- denzil_correa 9y ago
  > Yes, WhatsApp made the software, but its your responsibility to apply your own privacy settings. I do get Caveat Emptor but a lot of people do not understand the meaningful implications of privacy.
fastball 9y ago
But that's literally the only correlation you can make: "these people are chatting". If you think two people talking with each other outside of "state secrets type shenanigans" is a big deal, you're wrong. There are much easier, much more accurate ways to discover "cheating" than online times for WhatsApp...

vultour 9y ago

But you are voluntarily giving that info away if you use WA and don't change your privacy settings. The 'last online' feature is quite important IMO, and if you're concerned about this then disable it. Edit: On the other hand it would perhaps be better to have it on 'Contacts only' as the default, but you could still monitor your colleagues as they probably have you in their contacts anyway.

antirez 9y ago
I agree but I don't believe the average user realizes that it is possible to do that with the above data. And indeed, to do that manually is not practical, but if the info becomes scriptable, it's another matter.
- Loic 9y ago
  Scriptable and available for anybody. That my contacts in WhatsApp can correlate my activities with my status, this is part of the purpose of WhatsApp, that any stranger having my mobile phone from my business contact can do it, this is another matter. Edit: Discovered that one can share only with "My Contacts" these information. I am surprised I haven't seen this before or maybe the if you do not share, you cannot see info box misguided me into not restricting to my contacts these informations.
erbdex 9y ago
Whatsapp has no setting to disable the "online" flag when i have opened the app, and a bunch of things mentioned can be built on top of just this. I think this shows how some seemingly trivial data points on an individual level can allow one to build something way more than the sum of parts at a mass surveillance level.
- exhilaration 9y ago
  I believe you're looking for Settings > Account > Privacy > Status > Only Share with... And select no contacts on that screen. This is on the Android app, I'm not familiar with the web version.
  - jmanderley 9y ago
    I don't think that disables the "online" flag. As far as I'm aware, it's not currently possible to disable that one.

jamesfe 9y ago

Well, maybe. I don't want to discount this concept entirely because some info is being "leaked" if that is the right word, but... Let's say one of your contacts chats a lot because it's a chatty person. They're online far more than another person. What if that other person only chats on the bus on the way to and from work at roughly the same time every day to tell their wife they're on the way home. This activity will overlap with the chatty person's activity all the time. By your rationale, they are having a conversation, maybe cheating, and maybe having a work affair. I think the more contacts a user that are active, the higher probability that your model predicts they are having a "conversation" with another user. You'll probably find that your thresholds are really hard to fine-tune: maybe we say A chats with B if abs(A.activeTime - B.activeTime) < threshold, but that threshold is going to be super hard to find* and even harder to validate. Sure, there is some information here (the picture probably being the most concretely weird) but the fact that you can just go to the App and check a box for privacy means that this seems like not a huge issue. Yes, WhatsApp made the software, but its your responsibility to apply your own privacy settings.

antirez 9y ago
If you check the model I described in my comment, it should filter the "bus problem", since it will detect a chat only if, compared to the standard "bus time" probability of the user A chatting, it is chatting more if in the same range also B is chatting. If you add to this that people on Whatsapp usually do not talk to the exact minutes, it is definitely possible to create a robust system for guessing with good probability of two have often conversations. Also note that the phone numbers in input are not random, are the ones of a connected circle of persons. Add to this the fact that we can split the ranges even, potentially, by few minutes, and you can even detect interesting stuff for people having continuos chats with multiple persons like teenagers. Another thing that is possible probably is also "groups detection", since at new messages a set of users will activate at the same time.
denzil_correa 9y ago
> Yes, WhatsApp made the software, but its your responsibility to apply your own privacy settings. I do get Caveat Emptor but a lot of people do not understand the meaningful implications of privacy.

fastball 9y ago

But that's literally the only correlation you can make: "these people are chatting". If you think two people talking with each other outside of "state secrets type shenanigans" is a big deal, you're wrong. There are much easier, much more accurate ways to discover "cheating" than online times for WhatsApp...