7 ms·

How a WhatsApp status loophole is aiding cyberstalkers

87 points by dsr12 6y ago

skrebbel 6y ago
I'll never understand this kind of framing. Why not "How cyberstalkers are using a WhatsApp status loophole"? I mean it's not like WA added the loophole in an enthusiastic attempt to "aid" cyberstalkers.
- ParanoidShroom 6y ago
  There seems to be a hive mind attitude that bashing big tech is the "right thing" to do. And sensation ofcourse. "a typical example of what happens when companies don’t think about abusive relationships when they’re making their design decisions.". I'm annoyed about making assumptions and exposing them as truth. Who said they didn't? I'm not defending the creepy abuse of those people at all, but I feel the focus is aimed at the wrong creator here.
  - dvfjsdhgfv 6y ago
    I'm not sure if the hive mind is at play here. You should have the right to privacy, period. Some companies/messaging apps respect that, some don't. Users react accordingly. Plain and simple.
    - ParanoidShroom 6y ago
      I agree, and you do have that right, it's a gradient and yes this is up for debate. It really isn't this black and white. That being said, I would like to see a platform for discussion from BOTH parties instead of blogposts with no real communication.
      - dvfjsdhgfv 6y ago
        > I would like to see a platform for discussion from BOTH parties I can't imagine it would ever happen, it would make no any sense from the business point of view unless you build your image as a privacy-focused company (Facebook doesn't even try). For example Tim Kendall's testimony [0] paints a very bleak picture of the motivations behind strategic decisions made at Facebook. There is simply no reason to reveal your real motivation and it makes more sense to hide behind corporate PRspeak, except a few very specific issues where you could make a case a privacy violation was caused by a bug etc. [0] https://energycommerce.house.gov/sites/democrats.energycommerce.house.gov/files/documents/09.24.20%20CPC%20Witness%20Testimony_Kendall.pd https://energycommerce.house.gov/sites/democrats.energycomme...
- deleted 6y ago
  [deleted]
- lol768 6y ago
  Because, to be honest, it was entirely foreseeable. It's awful software engineering practice to just gloss over and ignore the privacy implications of this sort of feature! These risks should've been brought up during code review (if not when the feature was designed and specced) and there should've been an opt out added to the Privacy settings dialog.
- dvfjsdhgfv 6y ago
  Because every little detail in WhatsApp is geared towards getting a certain result, it's meant to influence your behavior in a way. In the case of messaging apps, the aim is to make you use them longer/more frequently. The privacy of the user has zero importance here.
throwaway888abc 6y ago
Meh, just metadata
- suprfsat 6y ago
  Previously in metadata: https://news.ycombinator.com/item?id=5854593 https://news.ycombinator.com/item?id=5854593
  - _jal 6y ago
    If you enjoyed that, stay tuned for: https://news.ycombinator.com/item?id=11108738 https://news.ycombinator.com/item?id=11108738
- Syonyk 6y ago
  "We kill people based on metadata." ~Michael Hayden, former NSA and CIA director (https://www.justsecurity.org/10318/video-clip-director-nsa-cia-we-kill-people-based-metadata/ https://www.justsecurity.org/10318/video-clip-director-nsa-c... if you're curious as to the source and context)
- renewiltord 6y ago
  Thank you for this. Skipped the article.
grawprog 6y ago
I really hate the online notification in WhatsApp because it's not possible to disable it. Even Facebook lets you appear offline if you want to. It's been a standard feature of messaging apps since pretty much as long as they've existed. Why whatsapp chose to make this setting like this has always just made my brain hurt. Does anyone actually like that every time you open WhatsApp any person who has WhatsApp installed and has your number in their contact list, they can see that you opened the app with zero way to disable it? That would be bad enough on a desktop app, on a mobile app it's completely and utterly fucked.
- bellyfullofbac 6y ago
  I wonder what status your contacts see if you have WhatsApp Web open... If someone really needs a workaround, a hack would be to have a browser instance somewhere connected to WA Web and if necessary some sort of virtual mouse randomly clicking contacts so WA thinks you're actually active. That way you'll always appear online to your contacts, and they won't know what your real status is.
  - g_p 6y ago
    Whatsapp web doesn't seem to update the presence status, as I've seen people ask why others are able to reply without their last-online time updating.
    - bellyfullofbac 6y ago
      Testing it yesterday with 2 phones/accounts, I do see my account coming online when I switch the focus to the WA web tab. When I switch tabs, after a while it says "last seen...".
- amelius 6y ago
  Yes, I hate it too. My boss doesn't need to know when I'm texting, and they can see this even if they don't use any cyberstalking software.
- prpl 6y ago
amelius 6y ago
Would it be possible to run WhatsApp in a sandbox, and let the sandbox perform the messaging through an API which other (more secure) chat clients can use to relay messages to/from the WhatsApp network?
- rovr138 6y ago
  Matrix has a whatsapp bridge
  - amelius 6y ago
    Interesting. How well does it work in practice?
    - GekkePrutser 6y ago
      It works reliably, but it does require WhatsApp to run somewhere else on Android (or iOS!), as it simply simulates a WhatsApp Web client (which requires the real WhatsApp to run somewhere). So it doesn't really solve this problem if you connect to the WhatsApp instance on your phone and use that. I have WhatsApp installed on a Raspberry Pi for this with Emteria OS (Android build for raspberry pi) Also, I believe WhatsApp Web being connected makes you appear "Online" all the time. While this is a good solution to hide your actual online status, it may be confusing for people you talk to. They might think you're ignoring them. However, Facebook will probably use these stalking apps as an excuse to lock down any whatsapp web integration as some of these tools use the same method. So I doubt it will continue working for long.
      - dvfjsdhgfv 6y ago
        > I believe WhatsApp Web being connected makes you appear "Online" all the time. Somewhere else in this thread people claim the opposite.
        GekkePrutser 6y ago
        Well I haven't tested it but I have seen that when I open WAW people suddenly start pinging me. So I assume this is why. Either way it's not a big deal as it hides your real status either way.
vzaliva 6y ago
Stating the obivious (with quote from the areticle): "As an alternative to changing your number, you could try switching from WhatsApp to Signal, a popular, privacy-focussed instant messaging app. It’s very similar to WhatsApp but built with greater concern for privacy and security. It does not have the same online or last seen statuses as WhatsApp and can’t be tracked in the same way."
- Syonyk 6y ago
  And everyone in your contact list, who has Signal installed, gets a message: Vzaliva is on Signal! At least if you're using the default settings, which is safe to assume most installs will. On the plus side, Signal is now common enough that it's no longer "Oh. That weird encrypted app that probably means you're a hacker." On the minus side, it's still a centrally managed service, and as most intelligence agencies will point out if asked, the message content being encrypted doesn't really bother them. Who you talk to, how often, and with what patterns? That's good enough for most of what they need to know, and I'm far from confident that Signal encrypts the metadata well enough to deter analysis. Matrix at least has the advantage of spreading the traffic out and making it a bit harder to analyze...
  - renewiltord 6y ago
    Yeah, why does it do that? Seems kind of weird that if you have my phone number you automatically get this notification that I installed an app. Not upset or anything because I don't mind. It just felt a bit skeevy.
dorkwood 6y ago
> Acceptable forms of these apps can be used by parents to track their children. However, these apps cannot be used to track a person (a spouse, for example) without their knowledge or permission unless a persistent notification is displayed while the data is being transmitted. Why is it ethical to track children, but not adults? If phones existed when I was a kid, I would have been horrified to discover my parents had installed spyware on my phone.
- lsiebert 6y ago
  In general or this shit specifically? I'm not sure why you would need this sort of status for kids. In general though, well a natural or man made disaster can happen suddenly, and you probably want to know where your kid is then, especially if you are fleeing for your life. Also, kids get kidnapped. Some kids run away. Also there are bad people in the internet, horrible people that find kids attractive and then groom children or teens. Having a kid, and I don't myself have one but my sister does, seems to involve a lot of worrying about bad shit happening. Kids don't always make the best decisions on their own. Neither do teens; and if someone is late for curfew, checking the app when they don't answer there phone is better than frantically calling hospitals.
  - scrollaway 6y ago
    Everything you said is applicable to adults as well though.
    - lsiebert 6y ago
      Adults are old enough and capable enough to be trusted to make their own decisions. That's pretty much the definition of being an adult.
- mLuby 6y ago
  How much time can pass before it's unethical for a guardian not to know where their ward is? 1 hour is fine, but 1 day would be concerning, and definitely 1 week is too long. (It may be related to how long the ward might survive without finding shelter or water.) So some degree of tracking is required. However, ethically speaking, we should strive to track as little as possible, since the whole point is to allow the child to develop into an independent, self-responsible adult. What's deemed acceptable to maintain control over a child has been diminishing (e.g. corporal punishment). Maybe location tracking should be the next addition to a child's Bill of Rights (and then we can talk to our Big Brother babysitter about knocking it off too).
scrollaway 6y ago
The whole "protecting children" thing ... these apps are no better when used to watch your kids than they are when used to spy on your spouse. Spying on kids is just as creepy as spying on a spouse imo, and the whole "it comes from a place of love and concern" can apply to both just as well. It's all excuses by overzealous parents. Shit should be outlawed, period, none of these creepy exceptions.
zimbatm 6y ago
I haven't technically validated it, but it looks like this is also the case for the Matrix protocol. If a user is in a public room, then their presence gets encoded as part of the message history. If the room is fully public, anybody can come along and get the historical info. It's possible to turn off presence but only on the server level.

87 points by dsr12 6y ago

I'll never understand this kind of framing. Why not "How cyberstalkers are using a WhatsApp status loophole"? I mean it's not like WA added the loophole in an enthusiastic attempt to "aid" cyberstalkers.

ParanoidShroom 6y ago
There seems to be a hive mind attitude that bashing big tech is the "right thing" to do. And sensation ofcourse. "a typical example of what happens when companies don’t think about abusive relationships when they’re making their design decisions.". I'm annoyed about making assumptions and exposing them as truth. Who said they didn't? I'm not defending the creepy abuse of those people at all, but I feel the focus is aimed at the wrong creator here.
- dvfjsdhgfv 6y ago
  I'm not sure if the hive mind is at play here. You should have the right to privacy, period. Some companies/messaging apps respect that, some don't. Users react accordingly. Plain and simple.
  - ParanoidShroom 6y ago
    I agree, and you do have that right, it's a gradient and yes this is up for debate. It really isn't this black and white. That being said, I would like to see a platform for discussion from BOTH parties instead of blogposts with no real communication.
    - dvfjsdhgfv 6y ago
      > I would like to see a platform for discussion from BOTH parties I can't imagine it would ever happen, it would make no any sense from the business point of view unless you build your image as a privacy-focused company (Facebook doesn't even try). For example Tim Kendall's testimony [0] paints a very bleak picture of the motivations behind strategic decisions made at Facebook. There is simply no reason to reveal your real motivation and it makes more sense to hide behind corporate PRspeak, except a few very specific issues where you could make a case a privacy violation was caused by a bug etc. [0] https://energycommerce.house.gov/sites/democrats.energycommerce.house.gov/files/documents/09.24.20%20CPC%20Witness%20Testimony_Kendall.pd https://energycommerce.house.gov/sites/democrats.energycomme...
deleted 6y ago
[deleted]
lol768 6y ago
Because, to be honest, it was entirely foreseeable. It's awful software engineering practice to just gloss over and ignore the privacy implications of this sort of feature! These risks should've been brought up during code review (if not when the feature was designed and specced) and there should've been an opt out added to the Privacy settings dialog.
dvfjsdhgfv 6y ago
Because every little detail in WhatsApp is geared towards getting a certain result, it's meant to influence your behavior in a way. In the case of messaging apps, the aim is to make you use them longer/more frequently. The privacy of the user has zero importance here.

throwaway888abc 6y ago

Meh, just metadata

suprfsat 6y ago
Previously in metadata: https://news.ycombinator.com/item?id=5854593 https://news.ycombinator.com/item?id=5854593
- _jal 6y ago
  If you enjoyed that, stay tuned for: https://news.ycombinator.com/item?id=11108738 https://news.ycombinator.com/item?id=11108738
Syonyk 6y ago
"We kill people based on metadata." ~Michael Hayden, former NSA and CIA director (https://www.justsecurity.org/10318/video-clip-director-nsa-cia-we-kill-people-based-metadata/ https://www.justsecurity.org/10318/video-clip-director-nsa-c... if you're curious as to the source and context)
renewiltord 6y ago
Thank you for this. Skipped the article.

grawprog 6y ago

I really hate the online notification in WhatsApp because it's not possible to disable it. Even Facebook lets you appear offline if you want to. It's been a standard feature of messaging apps since pretty much as long as they've existed. Why whatsapp chose to make this setting like this has always just made my brain hurt. Does anyone actually like that every time you open WhatsApp any person who has WhatsApp installed and has your number in their contact list, they can see that you opened the app with zero way to disable it? That would be bad enough on a desktop app, on a mobile app it's completely and utterly fucked.

bellyfullofbac 6y ago
I wonder what status your contacts see if you have WhatsApp Web open... If someone really needs a workaround, a hack would be to have a browser instance somewhere connected to WA Web and if necessary some sort of virtual mouse randomly clicking contacts so WA thinks you're actually active. That way you'll always appear online to your contacts, and they won't know what your real status is.
- g_p 6y ago
  Whatsapp web doesn't seem to update the presence status, as I've seen people ask why others are able to reply without their last-online time updating.
  - bellyfullofbac 6y ago
    Testing it yesterday with 2 phones/accounts, I do see my account coming online when I switch the focus to the WA web tab. When I switch tabs, after a while it says "last seen...".
amelius 6y ago
Yes, I hate it too. My boss doesn't need to know when I'm texting, and they can see this even if they don't use any cyberstalking software.
prpl 6y ago

amelius 6y ago

Would it be possible to run WhatsApp in a sandbox, and let the sandbox perform the messaging through an API which other (more secure) chat clients can use to relay messages to/from the WhatsApp network?

rovr138 6y ago
Matrix has a whatsapp bridge
- amelius 6y ago
  Interesting. How well does it work in practice?
  - GekkePrutser 6y ago
    It works reliably, but it does require WhatsApp to run somewhere else on Android (or iOS!), as it simply simulates a WhatsApp Web client (which requires the real WhatsApp to run somewhere). So it doesn't really solve this problem if you connect to the WhatsApp instance on your phone and use that. I have WhatsApp installed on a Raspberry Pi for this with Emteria OS (Android build for raspberry pi) Also, I believe WhatsApp Web being connected makes you appear "Online" all the time. While this is a good solution to hide your actual online status, it may be confusing for people you talk to. They might think you're ignoring them. However, Facebook will probably use these stalking apps as an excuse to lock down any whatsapp web integration as some of these tools use the same method. So I doubt it will continue working for long.
    - dvfjsdhgfv 6y ago
      > I believe WhatsApp Web being connected makes you appear "Online" all the time. Somewhere else in this thread people claim the opposite.
      - GekkePrutser 6y ago
        Well I haven't tested it but I have seen that when I open WAW people suddenly start pinging me. So I assume this is why. Either way it's not a big deal as it hides your real status either way.

vzaliva 6y ago

Stating the obivious (with quote from the areticle): "As an alternative to changing your number, you could try switching from WhatsApp to Signal, a popular, privacy-focussed instant messaging app. It’s very similar to WhatsApp but built with greater concern for privacy and security. It does not have the same online or last seen statuses as WhatsApp and can’t be tracked in the same way."

Syonyk 6y ago
And everyone in your contact list, who has Signal installed, gets a message: Vzaliva is on Signal! At least if you're using the default settings, which is safe to assume most installs will. On the plus side, Signal is now common enough that it's no longer "Oh. That weird encrypted app that probably means you're a hacker." On the minus side, it's still a centrally managed service, and as most intelligence agencies will point out if asked, the message content being encrypted doesn't really bother them. Who you talk to, how often, and with what patterns? That's good enough for most of what they need to know, and I'm far from confident that Signal encrypts the metadata well enough to deter analysis. Matrix at least has the advantage of spreading the traffic out and making it a bit harder to analyze...
- renewiltord 6y ago
  Yeah, why does it do that? Seems kind of weird that if you have my phone number you automatically get this notification that I installed an app. Not upset or anything because I don't mind. It just felt a bit skeevy.

dorkwood 6y ago

> Acceptable forms of these apps can be used by parents to track their children. However, these apps cannot be used to track a person (a spouse, for example) without their knowledge or permission unless a persistent notification is displayed while the data is being transmitted. Why is it ethical to track children, but not adults? If phones existed when I was a kid, I would have been horrified to discover my parents had installed spyware on my phone.

lsiebert 6y ago
In general or this shit specifically? I'm not sure why you would need this sort of status for kids. In general though, well a natural or man made disaster can happen suddenly, and you probably want to know where your kid is then, especially if you are fleeing for your life. Also, kids get kidnapped. Some kids run away. Also there are bad people in the internet, horrible people that find kids attractive and then groom children or teens. Having a kid, and I don't myself have one but my sister does, seems to involve a lot of worrying about bad shit happening. Kids don't always make the best decisions on their own. Neither do teens; and if someone is late for curfew, checking the app when they don't answer there phone is better than frantically calling hospitals.
- scrollaway 6y ago
  Everything you said is applicable to adults as well though.
  - lsiebert 6y ago
    Adults are old enough and capable enough to be trusted to make their own decisions. That's pretty much the definition of being an adult.
mLuby 6y ago
How much time can pass before it's unethical for a guardian not to know where their ward is? 1 hour is fine, but 1 day would be concerning, and definitely 1 week is too long. (It may be related to how long the ward might survive without finding shelter or water.) So some degree of tracking is required. However, ethically speaking, we should strive to track as little as possible, since the whole point is to allow the child to develop into an independent, self-responsible adult. What's deemed acceptable to maintain control over a child has been diminishing (e.g. corporal punishment). Maybe location tracking should be the next addition to a child's Bill of Rights (and then we can talk to our Big Brother babysitter about knocking it off too).

scrollaway 6y ago

The whole "protecting children" thing ... these apps are no better when used to watch your kids than they are when used to spy on your spouse. Spying on kids is just as creepy as spying on a spouse imo, and the whole "it comes from a place of love and concern" can apply to both just as well. It's all excuses by overzealous parents. Shit should be outlawed, period, none of these creepy exceptions.

zimbatm 6y ago

I haven't technically validated it, but it looks like this is also the case for the Matrix protocol. If a user is in a public room, then their presence gets encoded as part of the message history. If the room is fully public, anybody can come along and get the historical info. It's possible to turn off presence but only on the server level.