3 ms·

It's not sinister so much as that Whatsapp is sending the requests directly from the user's phone (not through a proxy, etc) which is exposing the end user's IP

It's not sinister so much as that Whatsapp is sending the requests directly from the user's phone (not through a proxy, etc) which is exposing the end user's IP address and full user agent string to the website hosting the page. This information could be used to identify the end user which goes against Whatsapp's whole "Privacy and Security is in our DNA" thing. (https://www.whatsapp.com/security/ https://www.whatsapp.com/security/) See this tweet for the info exposed: https://twitter.com/0xjomo/status/874585822158352384 https://twitter.com/0xjomo/status/874585822158352384

marcosdumay 9y ago
The alternative would be telling WhatsApp what everybody was typing, so they could proxy the requests. They did the right thing here. It might be good to add a "do not show URL previews" option, but it's not currently broken.
Jare 9y ago
Knowing that WhatsApp produces link preview cards, I frankly don't see anything here that I didn't already expect and assume was happening - these cards come from somewhere that is neither me nor my conversation partner. This can't be a surprise to anyone who was concerned about privacy. If WA proxied the request, it would be WA snooping on the conversation, and that would be a way larger problem because they would accumulate that metadata for EVERYONE. If you don't want cards or external requests in the conversation, you obfuscate the url with any of the myriad methods people use to get past anti-url filters in forums etc.
code_duck 9y ago
I see, thanks. So, the lookup is done from the sender's client, not the recipient, correct? I was actually looking at it from the perspective of it was being done on the server, rather than the client, and people were concerned about information collection about where they're linking to (or something). This is a good heads up for people with special security needs using proxies to access HTTP. Most people are willing to visit URLs they send in messages from their IP addresses in a browser, or already have before they send the message, but I can see how it's worth knowing about, especially with the additional information disclosure.
eip 9y ago
Privacy. Facebook. Pick one.

marcosdumay 9y ago

The alternative would be telling WhatsApp what everybody was typing, so they could proxy the requests. They did the right thing here. It might be good to add a "do not show URL previews" option, but it's not currently broken.

Jare 9y ago

Knowing that WhatsApp produces link preview cards, I frankly don't see anything here that I didn't already expect and assume was happening - these cards come from somewhere that is neither me nor my conversation partner. This can't be a surprise to anyone who was concerned about privacy. If WA proxied the request, it would be WA snooping on the conversation, and that would be a way larger problem because they would accumulate that metadata for EVERYONE. If you don't want cards or external requests in the conversation, you obfuscate the url with any of the myriad methods people use to get past anti-url filters in forums etc.

code_duck 9y ago

I see, thanks. So, the lookup is done from the sender's client, not the recipient, correct? I was actually looking at it from the perspective of it was being done on the server, rather than the client, and people were concerned about information collection about where they're linking to (or something). This is a good heads up for people with special security needs using proxies to access HTTP. Most people are willing to visit URLs they send in messages from their IP addresses in a browser, or already have before they send the message, but I can see how it's worth knowing about, especially with the additional information disclosure.

eip 9y ago

Privacy. Facebook. Pick one.