4 ms·

WhatsApp group chats can be found on Google

3 points by leephillips 7y ago

ColinWright 7y ago
The story has been submitted several times here on HN, but the community doesn't seem to care: https://news.ycombinator.com/item?id=22386788 https://news.ycombinator.com/item?id=22386788 9 comments; https://news.ycombinator.com/item?id=22397130 https://news.ycombinator.com/item?id=22397130 1 (content-free) comment; https://news.ycombinator.com/item?id=22389718 https://news.ycombinator.com/item?id=22389718 no comments; https://news.ycombinator.com/item?id=22386186 https://news.ycombinator.com/item?id=22386186 no comments; https://news.ycombinator.com/item?id=22383487 https://news.ycombinator.com/item?id=22383487 no comments. The consensus seems to be: Working as intended.
- Tomte 7y ago
  I find it hard to care, unless I've misunderstood it. You post a group chat's invite link to a public web site, and then you wonder how Google finds it? There's no chat content visible to Google, isn't it? It's just the invite link that "leaks" the group name or so?
  - ColinWright 7y ago
    I don't use WhatsApp[0] so I don't know how these things work. But here is a summary from the article: > People can create a group chat in WhatsApp; > People can then be invited to join that; > There is a reasonable expectation that only those invited can join; > That turns out not to be the case; > Group chats can be found via Google search; > Random, uninvited people can then join; > Those who were invited might find that surprising. So the way WhatsApp is described, people might expect that their groups chats are invitation only and end-to-end encrypted. Personally, even though I don't use WhatsApp at all, I'd be deeply annoyed to discover that a "private" group chat, joined through being sent an invitation, was potentially discoverable via a Google search and could be joined by people other than those to whom an invitation was sent. I think non-technical people, and some technical people, will find it very surprising. ================ [0] I don't use WhatsApp because the terms of service require that I permit them to slurp my address book, and I have contact details for people who really don't want their details leaked.
    - Tomte 7y ago
      I'm still unclear about who is posting the link: WhatsApp itself, somewhere under whatsapp.com? Or random users on whatever web sites, Facebook etc.? If the latter (and that's how I understood it): if you give people an invite link, that link can be used to access the group. Obviously. Works as intended. If you don't want random people to show up, don't post the link publicly, give it only to trusted people you actually want in the group.
      - ColinWright 7y ago
        As I say, I don't use WhatsApp, so I don't know. However, quoting from another report on this: > If you want to comb through Google Search to find out if your private WhatsApp group is indexed, just start with a “chat.whatsapp.com” string and then enter in some information specific to your chat. Vice did this and was able to find several chat groups related to sharing porn as well as a chat that describes itself as being for NGOs accredited by the United Nations. These chat groups listed out members’ names as well as contact information, in some cases phone numbers. -- https://www.androidauthority.com/private-whatsapp-1085998/ https://www.androidauthority.com/private-whatsapp-1085998/ So I don't know who's sharing these links, or what the mechanism is for doing so, but I'm pretty sure people won't be expecting the groups to be found via a Google search. As such, whatever the mechanism may be, dismissing this as "Works as intended" seems to me to be breathtaking arrogance. Your opinion may differ, but I think muggles would be surprised by this, and potentially it's only being kept in the dark about it that's stopping them from being very angry.
        Tomte 7y ago
        > dismissing this as "Works as intended" seems to me to be breathtaking arrogance. I really don't like your arrogant dismissal. I've tried to understand the issue, after three articles it's still unclear. But let's step back for a second. How would you expect it to work? How could anyone else be at fault than the one posting the link on public web sites (and it doesn't look like it's WhatsApp). Say, I'm posting a link to your LinkedIn profile here on Hacker News. How do you propose that LinkedIn(!) stops following other people that link to your profile? Assuming you didn't want to have that posted, wouldn't you take umbrage with me? What mechanism do you expect WhatsApp to implement to make sure that (a) a link can be followed by the right people, after sharing it publically and (b) the link cannot be followed by the wrong people and (c) the link is enough to enter the group, so no password, because that#s the whole point of that feature – and a password would be shared just alongside the link anyway.

3 points by leephillips 7y ago

The story has been submitted several times here on HN, but the community doesn't seem to care: https://news.ycombinator.com/item?id=22386788 https://news.ycombinator.com/item?id=22386788 9 comments; https://news.ycombinator.com/item?id=22397130 https://news.ycombinator.com/item?id=22397130 1 (content-free) comment; https://news.ycombinator.com/item?id=22389718 https://news.ycombinator.com/item?id=22389718 no comments; https://news.ycombinator.com/item?id=22386186 https://news.ycombinator.com/item?id=22386186 no comments; https://news.ycombinator.com/item?id=22383487 https://news.ycombinator.com/item?id=22383487 no comments. The consensus seems to be: Working as intended.

Tomte 7y ago
I find it hard to care, unless I've misunderstood it. You post a group chat's invite link to a public web site, and then you wonder how Google finds it? There's no chat content visible to Google, isn't it? It's just the invite link that "leaks" the group name or so?
- ColinWright 7y ago
  I don't use WhatsApp[0] so I don't know how these things work. But here is a summary from the article: > People can create a group chat in WhatsApp; > People can then be invited to join that; > There is a reasonable expectation that only those invited can join; > That turns out not to be the case; > Group chats can be found via Google search; > Random, uninvited people can then join; > Those who were invited might find that surprising. So the way WhatsApp is described, people might expect that their groups chats are invitation only and end-to-end encrypted. Personally, even though I don't use WhatsApp at all, I'd be deeply annoyed to discover that a "private" group chat, joined through being sent an invitation, was potentially discoverable via a Google search and could be joined by people other than those to whom an invitation was sent. I think non-technical people, and some technical people, will find it very surprising. ================ [0] I don't use WhatsApp because the terms of service require that I permit them to slurp my address book, and I have contact details for people who really don't want their details leaked.
  - Tomte 7y ago
    I'm still unclear about who is posting the link: WhatsApp itself, somewhere under whatsapp.com? Or random users on whatever web sites, Facebook etc.? If the latter (and that's how I understood it): if you give people an invite link, that link can be used to access the group. Obviously. Works as intended. If you don't want random people to show up, don't post the link publicly, give it only to trusted people you actually want in the group.
    - ColinWright 7y ago
      As I say, I don't use WhatsApp, so I don't know. However, quoting from another report on this: > If you want to comb through Google Search to find out if your private WhatsApp group is indexed, just start with a “chat.whatsapp.com” string and then enter in some information specific to your chat. Vice did this and was able to find several chat groups related to sharing porn as well as a chat that describes itself as being for NGOs accredited by the United Nations. These chat groups listed out members’ names as well as contact information, in some cases phone numbers. -- https://www.androidauthority.com/private-whatsapp-1085998/ https://www.androidauthority.com/private-whatsapp-1085998/ So I don't know who's sharing these links, or what the mechanism is for doing so, but I'm pretty sure people won't be expecting the groups to be found via a Google search. As such, whatever the mechanism may be, dismissing this as "Works as intended" seems to me to be breathtaking arrogance. Your opinion may differ, but I think muggles would be surprised by this, and potentially it's only being kept in the dark about it that's stopping them from being very angry.
      - Tomte 7y ago
        > dismissing this as "Works as intended" seems to me to be breathtaking arrogance. I really don't like your arrogant dismissal. I've tried to understand the issue, after three articles it's still unclear. But let's step back for a second. How would you expect it to work? How could anyone else be at fault than the one posting the link on public web sites (and it doesn't look like it's WhatsApp). Say, I'm posting a link to your LinkedIn profile here on Hacker News. How do you propose that LinkedIn(!) stops following other people that link to your profile? Assuming you didn't want to have that posted, wouldn't you take umbrage with me? What mechanism do you expect WhatsApp to implement to make sure that (a) a link can be followed by the right people, after sharing it publically and (b) the link cannot be followed by the wrong people and (c) the link is enough to enter the group, so no password, because that#s the whole point of that feature – and a password would be shared just alongside the link anyway.