4 ms·

Did you all know that chrome does this too? May sound obvious but I always had assumed that nothing is sent until you press enter for some reason (yeah I know,

Did you all know that chrome does this too? May sound obvious but I always had assumed that nothing is sent until you press enter for some reason (yeah I know, search prediction would be impossible without that). But one day I was type in a path on a test URL and noticing my server getting hit on - every single letter.

killjoywashere 9y ago
Yes, I did know that. The difference is WhatsApp is selling encrypted-onboard privacy. Which is now, prima facie, a lie. Facebook has literally told courts they can't decrypt WhatApp traffic. I wonder if that court case in Brazil is still pending. By comparison, no one ever said "There's no way Google could read my search terms". A more accurate comparison would be regarding Allo.
- thebiglebrewski 9y ago
  Oh, cool yeah just pointing it out! Yeah this is a much bigger deal, for sure, as it's a messaging app - just pointing out similar case in a different application.
- marcosdumay 9y ago
  You've got me angrily reading the article while asking myself if WatsApp would be stupid enough to lose that mostly won case. (It's in our supreme court, I hope they will announce it illegal to widely block a communication channel and to coerce companies into releasing broken crypto.) No, WatsApp didn't get informed of what URL you entered on the message. The site owner gets a notice, as does the user's ISP, and a lot of people in between. But WatsApp can not tell what URL was typed.
  - fictioncircle 9y ago
    Yeah but tbh, its still not e2e encrypted. It just means WhatsApp is ignorant. So they are in the clear legally, but morally, its still dubious to do that given its effectively disclosing what is often a substantial portion of the conversation.
    - marcosdumay 9y ago
      The message contents are e2e encrypted. And, transmitting an URL usually has no use beyond accessing it. They are doing what the user expects, it's just lacking some communication and power-user tools to override the default behavior.
      - saghm 9y ago
        I'm not sure that's what a user would expect; if anything, I'd think users would expect the opposite, that internet requests potentially with identifying information are not being sent to third parties based on what they've typed into the box without hitting send.
      - killjoywashere 9y ago
        The system is clearly passing message data, not metadata, back to the app servers in the clear. Full stop.
      - fictioncircle 9y ago
        > And, transmitting an URL usually has no use beyond accessing it. They are doing what the user expects, it's just lacking some communication and power-user tools to override the default behavior. Let us just say there are certain things that can cause legal complications merely accessing it and not reporting it is technically still a crime.
  - cuckcuckspruce 9y ago
    WhatsApp is probably the last entity that I would be worried about reading my message. WhatsApp is trying to sell you a promise where nobody, other than the recipient, can know the content of your messages. Having the owner of a site whose URL is included in a WhatsApp message in real time as it is compose breaks that promise - now the site owner and many more people (DNS server operators, both ISPs at the very least) have information about the content of that message.
- personlurking 9y ago
  If my sleuthing is on point, the case in Brazil is still in progress, with the latest notation on 09/06/2017 (May 9th). http://www.stf.jus.br/portal/processo/verProcessoAndamento.asp?incidente=4975500 http://www.stf.jus.br/portal/processo/verProcessoAndamento.a...
cuckcuckspruce 9y ago
Yes, Chrome does it as well, but I expect that as it's a web browser. I know the tradeoffs when browsing the web and expect that my requests will be visible across the Internet. That's just how web browsing works. However, WhatsApp is selling a solution that is meant to provide privacy. When I write a URL in an SMS, my phone does not try to preemptively retrieve it to display a preview. WhatsApp may be encrypting the message, but it's identifying me to a server while I'm composing it, which is enough to completely destroy any level of privacy or anonymity that I would expect.
- koolba 9y ago
  Maybe not SMS but newer versions of iMessage will prefetch urls to generate a preview. I don't recall if it happens as you type (like WhatsApp) or after you hit send though.
- justboxing 9y ago
  > WhatsApp is selling a solution that is meant to provide privacy. Yep you are right. They even tout this in their Security Page. https://www.whatsapp.com/security/ https://www.whatsapp.com/security/ > WhatsApp's end-to-end encryption ensures only you and the person you're communicating with can read what is sent, and nobody in between, not even WhatsApp. This is because your messages are secured with a lock, and only the recipient and you have the special key needed to unlock and read them.
  - eip 9y ago
    http://izquotes.com/quotes-pictures/quote-zuck-yeah-so-if-you-ever-need-info-about-anyone-at-harvard-zuck-just-ask-zuck-i-have-over-mark-zuckerberg-280610.jpg http://izquotes.com/quotes-pictures/quote-zuck-yeah-so-if-yo...
  - cuckcuckspruce 9y ago
    I suppose that I'm not surprised. You can't audit WhatsApp's source code, and even if you could, you can't guarantee what you're putting on your device matches the source code. Yet another closed source, inherently untrustable system.
ams6110 9y ago
Yeah, that link prediction stuff is one of the things I turn off immediately after installing a browser.
breakingcups 9y ago
Contrary to apparently most other commenters, I had no idea! Thanks!

killjoywashere 9y ago

Yes, I did know that. The difference is WhatsApp is selling encrypted-onboard privacy. Which is now, prima facie, a lie. Facebook has literally told courts they can't decrypt WhatApp traffic. I wonder if that court case in Brazil is still pending. By comparison, no one ever said "There's no way Google could read my search terms". A more accurate comparison would be regarding Allo.

thebiglebrewski 9y ago
Oh, cool yeah just pointing it out! Yeah this is a much bigger deal, for sure, as it's a messaging app - just pointing out similar case in a different application.
marcosdumay 9y ago
You've got me angrily reading the article while asking myself if WatsApp would be stupid enough to lose that mostly won case. (It's in our supreme court, I hope they will announce it illegal to widely block a communication channel and to coerce companies into releasing broken crypto.) No, WatsApp didn't get informed of what URL you entered on the message. The site owner gets a notice, as does the user's ISP, and a lot of people in between. But WatsApp can not tell what URL was typed.
- fictioncircle 9y ago
  Yeah but tbh, its still not e2e encrypted. It just means WhatsApp is ignorant. So they are in the clear legally, but morally, its still dubious to do that given its effectively disclosing what is often a substantial portion of the conversation.
  - marcosdumay 9y ago
    The message contents are e2e encrypted. And, transmitting an URL usually has no use beyond accessing it. They are doing what the user expects, it's just lacking some communication and power-user tools to override the default behavior.
    - saghm 9y ago
      I'm not sure that's what a user would expect; if anything, I'd think users would expect the opposite, that internet requests potentially with identifying information are not being sent to third parties based on what they've typed into the box without hitting send.
    - killjoywashere 9y ago
      The system is clearly passing message data, not metadata, back to the app servers in the clear. Full stop.
    - fictioncircle 9y ago
      > And, transmitting an URL usually has no use beyond accessing it. They are doing what the user expects, it's just lacking some communication and power-user tools to override the default behavior. Let us just say there are certain things that can cause legal complications merely accessing it and not reporting it is technically still a crime.
- cuckcuckspruce 9y ago
  WhatsApp is probably the last entity that I would be worried about reading my message. WhatsApp is trying to sell you a promise where nobody, other than the recipient, can know the content of your messages. Having the owner of a site whose URL is included in a WhatsApp message in real time as it is compose breaks that promise - now the site owner and many more people (DNS server operators, both ISPs at the very least) have information about the content of that message.
personlurking 9y ago
If my sleuthing is on point, the case in Brazil is still in progress, with the latest notation on 09/06/2017 (May 9th). http://www.stf.jus.br/portal/processo/verProcessoAndamento.asp?incidente=4975500 http://www.stf.jus.br/portal/processo/verProcessoAndamento.a...

cuckcuckspruce 9y ago

Yes, Chrome does it as well, but I expect that as it's a web browser. I know the tradeoffs when browsing the web and expect that my requests will be visible across the Internet. That's just how web browsing works. However, WhatsApp is selling a solution that is meant to provide privacy. When I write a URL in an SMS, my phone does not try to preemptively retrieve it to display a preview. WhatsApp may be encrypting the message, but it's identifying me to a server while I'm composing it, which is enough to completely destroy any level of privacy or anonymity that I would expect.

koolba 9y ago
Maybe not SMS but newer versions of iMessage will prefetch urls to generate a preview. I don't recall if it happens as you type (like WhatsApp) or after you hit send though.
justboxing 9y ago
> WhatsApp is selling a solution that is meant to provide privacy. Yep you are right. They even tout this in their Security Page. https://www.whatsapp.com/security/ https://www.whatsapp.com/security/ > WhatsApp's end-to-end encryption ensures only you and the person you're communicating with can read what is sent, and nobody in between, not even WhatsApp. This is because your messages are secured with a lock, and only the recipient and you have the special key needed to unlock and read them.
- eip 9y ago
  http://izquotes.com/quotes-pictures/quote-zuck-yeah-so-if-you-ever-need-info-about-anyone-at-harvard-zuck-just-ask-zuck-i-have-over-mark-zuckerberg-280610.jpg http://izquotes.com/quotes-pictures/quote-zuck-yeah-so-if-yo...
- cuckcuckspruce 9y ago
  I suppose that I'm not surprised. You can't audit WhatsApp's source code, and even if you could, you can't guarantee what you're putting on your device matches the source code. Yet another closed source, inherently untrustable system.

ams6110 9y ago

Yeah, that link prediction stuff is one of the things I turn off immediately after installing a browser.

breakingcups 9y ago

Contrary to apparently most other commenters, I had no idea! Thanks!