3 ms·

In order to produce the link preview, probably. As far as why it's character by character, I don't know, but that doesn't seem very sinister to me. Checking URL

In order to produce the link preview, probably. As far as why it's character by character, I don't know, but that doesn't seem very sinister to me. Checking URLs letter by letter is sloppy, especially if you're not even trying to do auto completion, but it doesn't reveal any more information than a complete url could. Anyway, I would think they are expecting people to paste URLs in, not type them. I've written code to fetch sites and give a preview, for a bookmarking bookmarklet. This involves analyzing the html for title and to select best image to represent the page. That of course necessitates retrieving the page, either through the client or server.

revicon 9y ago
It's not sinister so much as that Whatsapp is sending the requests directly from the user's phone (not through a proxy, etc) which is exposing the end user's IP address and full user agent string to the website hosting the page. This information could be used to identify the end user which goes against Whatsapp's whole "Privacy and Security is in our DNA" thing. (https://www.whatsapp.com/security/ https://www.whatsapp.com/security/) See this tweet for the info exposed: https://twitter.com/0xjomo/status/874585822158352384 https://twitter.com/0xjomo/status/874585822158352384
- marcosdumay 9y ago
  The alternative would be telling WhatsApp what everybody was typing, so they could proxy the requests. They did the right thing here. It might be good to add a "do not show URL previews" option, but it's not currently broken.
- Jare 9y ago
  Knowing that WhatsApp produces link preview cards, I frankly don't see anything here that I didn't already expect and assume was happening - these cards come from somewhere that is neither me nor my conversation partner. This can't be a surprise to anyone who was concerned about privacy. If WA proxied the request, it would be WA snooping on the conversation, and that would be a way larger problem because they would accumulate that metadata for EVERYONE. If you don't want cards or external requests in the conversation, you obfuscate the url with any of the myriad methods people use to get past anti-url filters in forums etc.
- code_duck 9y ago
  I see, thanks. So, the lookup is done from the sender's client, not the recipient, correct? I was actually looking at it from the perspective of it was being done on the server, rather than the client, and people were concerned about information collection about where they're linking to (or something). This is a good heads up for people with special security needs using proxies to access HTTP. Most people are willing to visit URLs they send in messages from their IP addresses in a browser, or already have before they send the message, but I can see how it's worth knowing about, especially with the additional information disclosure.
- eip 9y ago
  Privacy. Facebook. Pick one.

revicon 9y ago

It's not sinister so much as that Whatsapp is sending the requests directly from the user's phone (not through a proxy, etc) which is exposing the end user's IP address and full user agent string to the website hosting the page. This information could be used to identify the end user which goes against Whatsapp's whole "Privacy and Security is in our DNA" thing. (https://www.whatsapp.com/security/ https://www.whatsapp.com/security/) See this tweet for the info exposed: https://twitter.com/0xjomo/status/874585822158352384 https://twitter.com/0xjomo/status/874585822158352384

marcosdumay 9y ago
The alternative would be telling WhatsApp what everybody was typing, so they could proxy the requests. They did the right thing here. It might be good to add a "do not show URL previews" option, but it's not currently broken.
Jare 9y ago
Knowing that WhatsApp produces link preview cards, I frankly don't see anything here that I didn't already expect and assume was happening - these cards come from somewhere that is neither me nor my conversation partner. This can't be a surprise to anyone who was concerned about privacy. If WA proxied the request, it would be WA snooping on the conversation, and that would be a way larger problem because they would accumulate that metadata for EVERYONE. If you don't want cards or external requests in the conversation, you obfuscate the url with any of the myriad methods people use to get past anti-url filters in forums etc.
code_duck 9y ago
I see, thanks. So, the lookup is done from the sender's client, not the recipient, correct? I was actually looking at it from the perspective of it was being done on the server, rather than the client, and people were concerned about information collection about where they're linking to (or something). This is a good heads up for people with special security needs using proxies to access HTTP. Most people are willing to visit URLs they send in messages from their IP addresses in a browser, or already have before they send the message, but I can see how it's worth knowing about, especially with the additional information disclosure.
eip 9y ago
Privacy. Facebook. Pick one.