11 ms·

Tracking the WhatsApp habits of random smartphones

222 points by jorislacance 5y ago

geek_at 5y ago
I love these short write-ups of security issues of things the company in charge does not think is a problem. I remember that the facebook messenger was leaking the same kind of data and facebook said it's not a bug and didn't change it.
- sdevonoes 5y ago
  Why is this a "security" issue? People know that other people can see their "last seen" date, but usually they don't care so they left it. Hell, I leave it public as well. I couldn't care less about this tiny details. Now, if you tell me that by leaving public my "last seen" date, people can get more data about me (e.g., with whom I talk to), well then yes, I would call that a security issue.
  - hellcow 5y ago
    The most interesting part to me wasn't the technical details but rather the MAU, WAU, DAU stats at the end from random sample. Way fewer people than I would have expected use WhatsApp on a weekly basis.
    - CiTyBear 5y ago
      This is in France, where text messages were free (unlimited with your subscription) long ago before we had internet on our smartphone. Thus people use text message a lot and did use WhatsApp only to contact people outside from France
      - jorislacance 5y ago
        Not in France actually, we mainly use WhatsApp as a main message app; nobody uses SMS nowadays
        seszett 5y ago
        Well I do use SMS, as well as my friends and family in France. I use WhatsApp with Belgians (I live in Belgium) because SMS's are not free for them, and also for sharing photos because MMS is a mess.
        jorislacance 5y ago
        true, my point is more about the tendency of using groups of people to quickly share. Which SMS does not do properly.
      - Jiejeing 5y ago
        Text messages were around €0.10 for most plans until 2012 though (due to the unlawful collusion of telcos).
  - jorislacance 5y ago
    What was interesting in my writing is that a simple API request quota could be preventing me from scraping this much.
    - edsouza 5y ago
      Not sure why you are webscraping, there is a Whatsapp business API you can use to gather a lot more information. Here is a github repo that implements it, including generating text QR code. https://github.com/Rhymen/go-whatsapp https://github.com/Rhymen/go-whatsapp
  - bellyfullofbac 5y ago
    > if [...] people can get more data about me (e.g., with whom I talk to) [...] It's quite possible, at least among mutual friends. If you have 2 people you know, who are also friends with each other, who have high correlation of online times, then, it's a signal that they could be talking with each other. It's also amusing (insert a better verb...) that Facebook probably knows who's dating who based on frequency of messages on Messenger/WhatsApp/Instagram, location data ("It's the 3rd Friday night that their phones are close to each other in some venue"), and if they're on the same WiFi (A few hours later: "Well, it's 1AM, and after an hour of inactivity, James' phone is now connected to Jenny's WiFi, they did have their third date earlier...")
    - Item_Boring 5y ago
      Reminds me of this talk: Spiegel Mining at the C3 https://www.youtube.com/watch?v=-YpwsdRKt8Q https://www.youtube.com/watch?v=-YpwsdRKt8Q
computator 5y ago
> Privacy setting for Last Seen: Set by default to Everyone and nobody configures it. It surprised me that only 10% of his random (French) sample is active daily (179/1751=10%). In my contacts, I do see people who have accounts but haven't used it in weeks, but it's not the norm. However, I see lots of people in my contacts who show no info for Last Seen. Is he underestimating how often people configure the privacy setting for Last Seen? Or perhaps there is another factor that determines when Last Seen gets shown?
- CiTyBear 5y ago
  His script start from the bottom of 06 XX XX XX XX (french mobile number) and increases. This is not the most efficient way to have working/active numbers. As he said, starting with 06 numbers are saturated by now and we opened 07 XX... numbers. Thus, 07 numbers are more likely to be fresher et more used by "younger" people. While first 06 could be more used by professional and "older" people As I said in a previous comments, older generation do not use WhatsApp very much as we had unlimited text message before getting internet on our phones (before iPhone 1). Before Covid, my parents did not use WhatsApp at all while texting daily. They use it now to video call during curfew
  - jorislacance 5y ago
    good call about 07 numbers being more attributed to youngers. I took the 06 range to maximize the chance to get valid/active numbers.
- gridder 5y ago
  Hiding last seen is useless as the online status cannot be hidden. There are various apps that exploit this for money so you can stalk anybody…
- lxgr 5y ago
  At least in my group of friends (which is probably a very bad sample), hiding "last seen" is very common. I really dearly wish there was one for the online status as well, and I'm glad to have spent my teenage years in a time where SMS was the norm, where neither read receipts nor online status was available. It made for a much more relaxed messaging experience (which iMessage seems to be much better at approximating).
3dee 5y ago
It's bad that this is happening, but from a developer standpoint it is also very easy to overlook things like this because most APIs are not aware of who the data is for. When an API always returns the `last_seen` field regardless of who is querying the data, it's very easy to make the mistake to present the data to someone who should not see it. That's also one of the reasons I think most CRUD APIs use bad practice because they always return all data on a READ and may always store all data on a CREATE or UPDATE. But.. a company like Facebook should know better. It seems they just don't care.
- luckylion 5y ago
  > But.. a company like Facebook should know better. It seems they just don't care. I agree 100%. If it was a simple hobby project that somebody had hacked together, I'd agree that it might be easily overlooked. When you have thousands of people supposedly working on making privacy a priority etc: not so much.
  - throw_away789 5y ago
    I think its deliberately kept open. There are 100s of apps in play store that can help in predicting if 2 people in your contacts are in conversation. People like keeping watch on others and Facebook is exploiting that.
deleted 5y ago
[deleted]
puttycat 5y ago
I've been using WhatsApp for years, reluctantly since it is the de-facto SMS standard in my country. I will never, ever, understand the "online" status feature. It is ridiculously invasive and cannot ever be turned off or even hidden from specific contacts. This is a SMS client, not a chat client, and revealing a user's online status is highly problematic both socially and security-wise. I can't help but wonder how many lives this feature has ruined. (I am talking specifically about the "online" indication, not the "last seen" information, which is also invasive but can be turned off).
- throw_away789 5y ago
  > I can't help but wonder how many lives this feature has ruined. and relationships
  - mahathu 5y ago
    This seems like a stretch to me. I agree this feature is unnecessary and invasive. But why would it destroy relationships?
    - mcjiggerlog 5y ago
      It doesn't take much imagination to come up with a hypothetical scenario. Person is writing to their partner but receiving no reply, however they can see that their partner has been online for the past 30 minutes. Person is convinced that their partner is talking to that one guy from the gym. I have definitely been called out for being online but not replying, so I can easily imagine how that can end up becoming a big drama in some relationships.
    - crocsarecool 5y ago
      Maybe you have a crazy manager. They see you were online when you were meant to be working. They use this to justify their thoughts you’re lazy. Who knows?
    - throw_away789 5y ago
      Just go ahead and see on playstore how many people are using whatsapp status tracker app. Also read reviews and you will know.
hudixt 5y ago
I had done same thing around this in 2019. This doesn't stop at this. There were quite correlation that I was able to find with basic setup The results can be quite horrifying as you can predict plethora of things. - When is someone sleeping. - When they're working,etc. - If two person are talking to each other in closed group.
- kuu 5y ago
  Can you share that research? Seems interesting
- gsich 5y ago
  Did something similar in 2015, there was even an open-source program to do it with graphical statistics: https://maikel.pro/blog/en-whatsapp-privacy-options-are-illusions/ https://maikel.pro/blog/en-whatsapp-privacy-options-are-illu...
  - jorislacance 5y ago
    Nice work !
    - deleted 5y ago
      [deleted]
    - gsich 5y ago
      Not mine if that was not clear.
- deleted 5y ago
  [deleted]
- suifbwish 5y ago
  Not just that you can correlate this data with activity on various social networks like Reddit and 4chan or even hacker news over time and slowly narrow down the list of possible anonymous usernames someone may have by just removing all users that were active when individual is known to be sleeping.
toomanybeersies 5y ago
Any app that gives my peers even an inkling of what I'm doing without me explicitly sending that information gives me the heebie jeebies. I've gone back to using SMS for messaging these days. No more read receipts, no more "last active 10 minutes ago", no more "Alice is nearby!", and no more "you haven't messaged Bob in a while, send a message?". Sure SMS is insecure, but at least it doesn't drive me insane with all the bullshit of so many messaging apps.
- foo92691 5y ago
  Bad news about "plain SMS" - https://en.wikipedia.org/wiki/Rich_Communication_Services https://en.wikipedia.org/wiki/Rich_Communication_Services
  - hansel_der 5y ago
    Bad news about RCS: It's comming soon(TM) for the last 13years
- godelski 5y ago
  Why not use Signal and turn off read receipts (and typing indicators and previews)? Then you don't have the SMS insecurities (which reveals your locations) and the other metadata issues? That seems to actually fit all your criteria.
Dumbdo 5y ago
And this is just the tip of the iceberg. As described in the article, you can avoid this by hiding your "last seen" status. But why use the "last seen" feature, if WhatsApp also has an "online" indicator? Funnily enough, that one can't be disabled and is visible to everyone! That has been criticized for over 5 years now, with no reaction from whatsapp/FB. There was even a similar tool back in 2016 which used this "online" indicator instead, called WhatsSpy [0]. It's no longer maintained, but you can see screenshots of it on this old German article [1] or you might be able to find English articles as well. I don't know of any current tool which does this, but I'd guess there are a few out there, since it's so easy to do and can't be prevented. [0] https://github.com/jorik041/WhatsSpy-Public https://github.com/jorik041/WhatsSpy-Public [1] https://www.heise.de/security/meldung/WhatsSpy-Beliebige-WhatsApp-Nutzer-rund-um-die-Uhr-ueberwachen-2543968.html https://www.heise.de/security/meldung/WhatsSpy-Beliebige-Wha...
outime 5y ago
>Nobody uses Signal in France [from the 5000 sample] If one would've come to HN and read the last few months worth of posts you'd come to think that a lot of people from around the world moved to Signal. But then again this is a reminder about how little HN represents compared to the general population's tech choices.
- Grimm1 5y ago
  My anecdata but, my friend in France does and has been forever. That's how her and I keep in contact and video chat. Perhaps their sample wasn't representative.
  - outime 5y ago
    I'd say a sample of 5000 random phone numbers is more representative than individual comments from a community obsessed (in a positive way) with privacy.
    - Grimm1 5y ago
      That's not my argument. My friend isn't privacy obsessed and not a part of this community.
- GiveOver 5y ago
  Compared to how many of those numbers have Whatsapp (1750), it's more popular than I'd have guessed. 1 Signal user for every 18 Whatsapp users
- 0xcafecafe 5y ago
  That signal move backfired for me. Before it was just whatsapp. Now with some folks from my generation moving to signal and the older folks from the parent's generation staying with whatsapp, I have had to maintain presence across 2 chat applications.
  - dukeyukey 5y ago
    Right now I'm maintaining: * Messenger for family and some friends * WhatsApp for group chats and most of my friends * SMS for older family members * Signal and Telegram for a select few privacy-conscious friends And at least one family member uses three of these, and it's a toss-up which one he'll use at any given time.
lxgr 5y ago
Is there any chance that the client needs the online status for some internal optimization, e.g. in order to deliver messages for online contacts to a different server than those destined for offline contacts? I could imagine delivery paths to be quite different (one would be immediately passed through in-memory while the other would be stored in some database and potentially trigger mobile push notifications). In that case, it is nice to at least visually expose that this information is available to bad actors using custom clients too. However, this fails as a possible excuse ever since Facebook acquired WhatsApp, given that they have essentially unlimited resources available and could easily implement a privacy proxy to hide this information from clients.
- hiq 5y ago
  In any case there cannot be a good reason to share the online status / last seen date before any interaction has happened between two contacts, and approved by the receiver. If you have had no interaction with someone, you should first accept a message (and not report it as spam) before this information is shared. Ideally that would be the default as well for the About field and the profile picture.
  - lxgr 5y ago
    I definitely agree – none of my hypotheses make for a good reason. I'm just wondering if there's anything technical behind what seems to be a quite stubborn decision that also sticks out (as everything else has controllable privacy options). Another weird decision is that read receipts are not possible to be deactivated in group chats, but there is no explanation for that that I could think of (delivery receipts might be required for faster encryption key ratcheting, but the read status has no significance at all for the protocol).
vxNsr 5y ago
The general consensus here seems to be, let me hide from my friends and family. All the comments are focused on how annoying it is that Facebook is generously sharing information that you might not otherwise think they were collecting about you.
smashah 5y ago
They should really allow people to disable this. I was surprised when a user came to me saying this is possible even with full privacy.
inasio 5y ago
I saw a very strange thing in Whatsapp last week. One of my contacts texted me their name in Cyrillic characters (Whatsapp on IOS), five seconds later I got an email to my Gmail inbox in russian. I check my spam folder occasionally (mostly bitcoin scams for some reason) and had never seen any messages in russian.
- giuscri 5y ago
  that’s creepy
rk1987 5y ago
I really need "Permanently Archive Chat" feature in whatsapp. There are some chats/groups that I never want to see any message in but don't want to leave. I believe whatsapp knows how useful this feature is but it will lead to lower usage and they are not rolling out
- kwonkicker 5y ago
  You can permanently mute a chat group
- hansel_der 5y ago
  > There are some chats/groups that I never want to see any message in but don't want to leave. information age 2.0
perryizgr8 5y ago
> Yes, it’s a picture. Trackers free I love that picture of a tweet, instead of an embedded one that takes 1 million years to load after you have scrolled to it, and not before.
fighterpilot 5y ago
I hate that you can't log out of Whatsapp temporarily. I have to turn off my internet or my phone to take a break from it, or uninstall and reinstall the app. A dark pattern that means I'm always logged in even when I don't want to be.
- spurgu 5y ago
  What do you mean by "logged in"? You're only shown as "Online" when you have the app open. When you close it it turns to "Last seen".
  - fighterpilot 5y ago
    I meant I sometimes wish to take a break from both notifications as well as my counterpart seeing the message got pushed into my client and thinking I'm ignoring them. If there's unattended to messages I feel a social pressure to respond quickly. I want Whatsapp to be more like an email client which is far less intrusive into mental and emotional space. Now that I think more about it, I could do two things: (1) disable notifications, (2) make it so I disable the blue check and double check and appear offline. It'd effectively simulate logging off.
    - spurgu 5y ago
      Yeah I know very well what you mean! I do #1 (turn off notifications in the app settings) every now and then when I want to cut off a specific communication channel. I'm unsure how you'd do #2 though? There's a permission for background data, wonder if that would be enough? Let me know if you test it! I'm on Android btw.
      - Brainmulch 5y ago
        You can do this natively through whatsapp settings by turning off Read receipts, and can control who sees your "last seen" information as well
      - qwaxys 5y ago
notdang 5y ago
Another big problem is that Whatsapp automatically previews the URLs, thus leaking the IP of the person. I could not find a way do disable link previews.
- bombcar 5y ago
  That’s annoying- many chat programs just leak the cache or chat server as they pull the websnippet there.
darkport 5y ago
I've always wanted to do something similar at scale. Generate all possible random mobile numbers 11^10, check if they have a WhatsApp profile pic and run it through AWS' rekognition celebrity model (https://docs.aws.amazon.com/rekognition/latest/dg/celebrities.html https://docs.aws.amazon.com/rekognition/latest/dg/celebritie...). You could identify the personal numbers for a _lot_ of VIPs, politicians, etc.
- m4rtink 5y ago
  "Amazon Rekognition can recognize thousands of celebrities in a wide range of categories, such as entertainment and media, sports, business, and politics. With Amazon Rekognition, you can recognize celebrities in images and in stored videos. You can also get additional information for recognized celebrities." Wow, that's legal ? :P Not to mention moral...
  - freeflight 5y ago
    I guess an argument could be made how celebrities are public figures which in some jurisdictions gives them a bit worse privacy protections. Also interesting: The article "Celebrity recognition compared to face search" [0] does actually have a disclaimer: > Celebrity recognition should not be used in a manner that could result in a negative impact on civil liberties. Only to then follow up how face search allows for the very same thing with your own face collections, so it's apparently not just reserved to celebrities. [0] https://docs.aws.amazon.com/rekognition/latest/dg/celebrity-recognition-vs-face-search.html https://docs.aws.amazon.com/rekognition/latest/dg/celebrity-...
turtletontine 5y ago
Not to downplay this, but the authors "You can track any mobile phone !" claim seems comically overblown. Not everyone has What's App, some people who have it rarely use it, and only knowing when someone's online is a pretty weak form of "tracking". That said, I agree it's not good that you can spam strangers phone numbers and see when they're online. I'll be turning off that feature on my phone.

222 points by jorislacance 5y ago

I love these short write-ups of security issues of things the company in charge does not think is a problem. I remember that the facebook messenger was leaking the same kind of data and facebook said it's not a bug and didn't change it.

sdevonoes 5y ago
Why is this a "security" issue? People know that other people can see their "last seen" date, but usually they don't care so they left it. Hell, I leave it public as well. I couldn't care less about this tiny details. Now, if you tell me that by leaving public my "last seen" date, people can get more data about me (e.g., with whom I talk to), well then yes, I would call that a security issue.
- hellcow 5y ago
  The most interesting part to me wasn't the technical details but rather the MAU, WAU, DAU stats at the end from random sample. Way fewer people than I would have expected use WhatsApp on a weekly basis.
  - CiTyBear 5y ago
    This is in France, where text messages were free (unlimited with your subscription) long ago before we had internet on our smartphone. Thus people use text message a lot and did use WhatsApp only to contact people outside from France
    - jorislacance 5y ago
      Not in France actually, we mainly use WhatsApp as a main message app; nobody uses SMS nowadays
      - seszett 5y ago
        Well I do use SMS, as well as my friends and family in France. I use WhatsApp with Belgians (I live in Belgium) because SMS's are not free for them, and also for sharing photos because MMS is a mess.
        jorislacance 5y ago
        true, my point is more about the tendency of using groups of people to quickly share. Which SMS does not do properly.
    - Jiejeing 5y ago
      Text messages were around €0.10 for most plans until 2012 though (due to the unlawful collusion of telcos).
- jorislacance 5y ago
  What was interesting in my writing is that a simple API request quota could be preventing me from scraping this much.
  - edsouza 5y ago
    Not sure why you are webscraping, there is a Whatsapp business API you can use to gather a lot more information. Here is a github repo that implements it, including generating text QR code. https://github.com/Rhymen/go-whatsapp https://github.com/Rhymen/go-whatsapp
- bellyfullofbac 5y ago
  > if [...] people can get more data about me (e.g., with whom I talk to) [...] It's quite possible, at least among mutual friends. If you have 2 people you know, who are also friends with each other, who have high correlation of online times, then, it's a signal that they could be talking with each other. It's also amusing (insert a better verb...) that Facebook probably knows who's dating who based on frequency of messages on Messenger/WhatsApp/Instagram, location data ("It's the 3rd Friday night that their phones are close to each other in some venue"), and if they're on the same WiFi (A few hours later: "Well, it's 1AM, and after an hour of inactivity, James' phone is now connected to Jenny's WiFi, they did have their third date earlier...")
  - Item_Boring 5y ago
    Reminds me of this talk: Spiegel Mining at the C3 https://www.youtube.com/watch?v=-YpwsdRKt8Q https://www.youtube.com/watch?v=-YpwsdRKt8Q

computator 5y ago

> Privacy setting for Last Seen: Set by default to Everyone and nobody configures it. It surprised me that only 10% of his random (French) sample is active daily (179/1751=10%). In my contacts, I do see people who have accounts but haven't used it in weeks, but it's not the norm. However, I see lots of people in my contacts who show no info for Last Seen. Is he underestimating how often people configure the privacy setting for Last Seen? Or perhaps there is another factor that determines when Last Seen gets shown?

CiTyBear 5y ago
His script start from the bottom of 06 XX XX XX XX (french mobile number) and increases. This is not the most efficient way to have working/active numbers. As he said, starting with 06 numbers are saturated by now and we opened 07 XX... numbers. Thus, 07 numbers are more likely to be fresher et more used by "younger" people. While first 06 could be more used by professional and "older" people As I said in a previous comments, older generation do not use WhatsApp very much as we had unlimited text message before getting internet on our phones (before iPhone 1). Before Covid, my parents did not use WhatsApp at all while texting daily. They use it now to video call during curfew
- jorislacance 5y ago
  good call about 07 numbers being more attributed to youngers. I took the 06 range to maximize the chance to get valid/active numbers.
gridder 5y ago
Hiding last seen is useless as the online status cannot be hidden. There are various apps that exploit this for money so you can stalk anybody…
lxgr 5y ago
At least in my group of friends (which is probably a very bad sample), hiding "last seen" is very common. I really dearly wish there was one for the online status as well, and I'm glad to have spent my teenage years in a time where SMS was the norm, where neither read receipts nor online status was available. It made for a much more relaxed messaging experience (which iMessage seems to be much better at approximating).

3dee 5y ago

It's bad that this is happening, but from a developer standpoint it is also very easy to overlook things like this because most APIs are not aware of who the data is for. When an API always returns the `last_seen` field regardless of who is querying the data, it's very easy to make the mistake to present the data to someone who should not see it. That's also one of the reasons I think most CRUD APIs use bad practice because they always return all data on a READ and may always store all data on a CREATE or UPDATE. But.. a company like Facebook should know better. It seems they just don't care.

luckylion 5y ago
> But.. a company like Facebook should know better. It seems they just don't care. I agree 100%. If it was a simple hobby project that somebody had hacked together, I'd agree that it might be easily overlooked. When you have thousands of people supposedly working on making privacy a priority etc: not so much.
- throw_away789 5y ago
  I think its deliberately kept open. There are 100s of apps in play store that can help in predicting if 2 people in your contacts are in conversation. People like keeping watch on others and Facebook is exploiting that.

deleted 5y ago

[deleted]

puttycat 5y ago

I've been using WhatsApp for years, reluctantly since it is the de-facto SMS standard in my country. I will never, ever, understand the "online" status feature. It is ridiculously invasive and cannot ever be turned off or even hidden from specific contacts. This is a SMS client, not a chat client, and revealing a user's online status is highly problematic both socially and security-wise. I can't help but wonder how many lives this feature has ruined. (I am talking specifically about the "online" indication, not the "last seen" information, which is also invasive but can be turned off).

throw_away789 5y ago
> I can't help but wonder how many lives this feature has ruined. and relationships
- mahathu 5y ago
  This seems like a stretch to me. I agree this feature is unnecessary and invasive. But why would it destroy relationships?
  - mcjiggerlog 5y ago
    It doesn't take much imagination to come up with a hypothetical scenario. Person is writing to their partner but receiving no reply, however they can see that their partner has been online for the past 30 minutes. Person is convinced that their partner is talking to that one guy from the gym. I have definitely been called out for being online but not replying, so I can easily imagine how that can end up becoming a big drama in some relationships.
  - crocsarecool 5y ago
    Maybe you have a crazy manager. They see you were online when you were meant to be working. They use this to justify their thoughts you’re lazy. Who knows?
  - throw_away789 5y ago
    Just go ahead and see on playstore how many people are using whatsapp status tracker app. Also read reviews and you will know.

hudixt 5y ago

I had done same thing around this in 2019. This doesn't stop at this. There were quite correlation that I was able to find with basic setup The results can be quite horrifying as you can predict plethora of things. - When is someone sleeping. - When they're working,etc. - If two person are talking to each other in closed group.

kuu 5y ago
Can you share that research? Seems interesting
gsich 5y ago
Did something similar in 2015, there was even an open-source program to do it with graphical statistics: https://maikel.pro/blog/en-whatsapp-privacy-options-are-illusions/ https://maikel.pro/blog/en-whatsapp-privacy-options-are-illu...
- jorislacance 5y ago
  Nice work !
  - deleted 5y ago
    [deleted]
  - gsich 5y ago
    Not mine if that was not clear.
deleted 5y ago
[deleted]
suifbwish 5y ago
Not just that you can correlate this data with activity on various social networks like Reddit and 4chan or even hacker news over time and slowly narrow down the list of possible anonymous usernames someone may have by just removing all users that were active when individual is known to be sleeping.

toomanybeersies 5y ago

Any app that gives my peers even an inkling of what I'm doing without me explicitly sending that information gives me the heebie jeebies. I've gone back to using SMS for messaging these days. No more read receipts, no more "last active 10 minutes ago", no more "Alice is nearby!", and no more "you haven't messaged Bob in a while, send a message?". Sure SMS is insecure, but at least it doesn't drive me insane with all the bullshit of so many messaging apps.

foo92691 5y ago
Bad news about "plain SMS" - https://en.wikipedia.org/wiki/Rich_Communication_Services https://en.wikipedia.org/wiki/Rich_Communication_Services
- hansel_der 5y ago
  Bad news about RCS: It's comming soon(TM) for the last 13years
godelski 5y ago
Why not use Signal and turn off read receipts (and typing indicators and previews)? Then you don't have the SMS insecurities (which reveals your locations) and the other metadata issues? That seems to actually fit all your criteria.

Dumbdo 5y ago

And this is just the tip of the iceberg. As described in the article, you can avoid this by hiding your "last seen" status. But why use the "last seen" feature, if WhatsApp also has an "online" indicator? Funnily enough, that one can't be disabled and is visible to everyone! That has been criticized for over 5 years now, with no reaction from whatsapp/FB. There was even a similar tool back in 2016 which used this "online" indicator instead, called WhatsSpy [0]. It's no longer maintained, but you can see screenshots of it on this old German article [1] or you might be able to find English articles as well. I don't know of any current tool which does this, but I'd guess there are a few out there, since it's so easy to do and can't be prevented. [0] https://github.com/jorik041/WhatsSpy-Public https://github.com/jorik041/WhatsSpy-Public [1] https://www.heise.de/security/meldung/WhatsSpy-Beliebige-WhatsApp-Nutzer-rund-um-die-Uhr-ueberwachen-2543968.html https://www.heise.de/security/meldung/WhatsSpy-Beliebige-Wha...

outime 5y ago

>Nobody uses Signal in France [from the 5000 sample] If one would've come to HN and read the last few months worth of posts you'd come to think that a lot of people from around the world moved to Signal. But then again this is a reminder about how little HN represents compared to the general population's tech choices.

Grimm1 5y ago
My anecdata but, my friend in France does and has been forever. That's how her and I keep in contact and video chat. Perhaps their sample wasn't representative.
- outime 5y ago
  I'd say a sample of 5000 random phone numbers is more representative than individual comments from a community obsessed (in a positive way) with privacy.
  - Grimm1 5y ago
    That's not my argument. My friend isn't privacy obsessed and not a part of this community.
GiveOver 5y ago
Compared to how many of those numbers have Whatsapp (1750), it's more popular than I'd have guessed. 1 Signal user for every 18 Whatsapp users
0xcafecafe 5y ago
That signal move backfired for me. Before it was just whatsapp. Now with some folks from my generation moving to signal and the older folks from the parent's generation staying with whatsapp, I have had to maintain presence across 2 chat applications.
- dukeyukey 5y ago
  Right now I'm maintaining: * Messenger for family and some friends * WhatsApp for group chats and most of my friends * SMS for older family members * Signal and Telegram for a select few privacy-conscious friends And at least one family member uses three of these, and it's a toss-up which one he'll use at any given time.

lxgr 5y ago

Is there any chance that the client needs the online status for some internal optimization, e.g. in order to deliver messages for online contacts to a different server than those destined for offline contacts? I could imagine delivery paths to be quite different (one would be immediately passed through in-memory while the other would be stored in some database and potentially trigger mobile push notifications). In that case, it is nice to at least visually expose that this information is available to bad actors using custom clients too. However, this fails as a possible excuse ever since Facebook acquired WhatsApp, given that they have essentially unlimited resources available and could easily implement a privacy proxy to hide this information from clients.

hiq 5y ago
In any case there cannot be a good reason to share the online status / last seen date before any interaction has happened between two contacts, and approved by the receiver. If you have had no interaction with someone, you should first accept a message (and not report it as spam) before this information is shared. Ideally that would be the default as well for the About field and the profile picture.
- lxgr 5y ago
  I definitely agree – none of my hypotheses make for a good reason. I'm just wondering if there's anything technical behind what seems to be a quite stubborn decision that also sticks out (as everything else has controllable privacy options). Another weird decision is that read receipts are not possible to be deactivated in group chats, but there is no explanation for that that I could think of (delivery receipts might be required for faster encryption key ratcheting, but the read status has no significance at all for the protocol).

vxNsr 5y ago

The general consensus here seems to be, let me hide from my friends and family. All the comments are focused on how annoying it is that Facebook is generously sharing information that you might not otherwise think they were collecting about you.

smashah 5y ago

They should really allow people to disable this. I was surprised when a user came to me saying this is possible even with full privacy.

inasio 5y ago

I saw a very strange thing in Whatsapp last week. One of my contacts texted me their name in Cyrillic characters (Whatsapp on IOS), five seconds later I got an email to my Gmail inbox in russian. I check my spam folder occasionally (mostly bitcoin scams for some reason) and had never seen any messages in russian.

giuscri 5y ago
that’s creepy

rk1987 5y ago

I really need "Permanently Archive Chat" feature in whatsapp. There are some chats/groups that I never want to see any message in but don't want to leave. I believe whatsapp knows how useful this feature is but it will lead to lower usage and they are not rolling out

kwonkicker 5y ago
You can permanently mute a chat group
hansel_der 5y ago
> There are some chats/groups that I never want to see any message in but don't want to leave. information age 2.0

perryizgr8 5y ago

> Yes, it’s a picture. Trackers free I love that picture of a tweet, instead of an embedded one that takes 1 million years to load after you have scrolled to it, and not before.

fighterpilot 5y ago

I hate that you can't log out of Whatsapp temporarily. I have to turn off my internet or my phone to take a break from it, or uninstall and reinstall the app. A dark pattern that means I'm always logged in even when I don't want to be.

spurgu 5y ago
What do you mean by "logged in"? You're only shown as "Online" when you have the app open. When you close it it turns to "Last seen".
- fighterpilot 5y ago
  I meant I sometimes wish to take a break from both notifications as well as my counterpart seeing the message got pushed into my client and thinking I'm ignoring them. If there's unattended to messages I feel a social pressure to respond quickly. I want Whatsapp to be more like an email client which is far less intrusive into mental and emotional space. Now that I think more about it, I could do two things: (1) disable notifications, (2) make it so I disable the blue check and double check and appear offline. It'd effectively simulate logging off.
  - spurgu 5y ago
    Yeah I know very well what you mean! I do #1 (turn off notifications in the app settings) every now and then when I want to cut off a specific communication channel. I'm unsure how you'd do #2 though? There's a permission for background data, wonder if that would be enough? Let me know if you test it! I'm on Android btw.
    - Brainmulch 5y ago
      You can do this natively through whatsapp settings by turning off Read receipts, and can control who sees your "last seen" information as well
    - qwaxys 5y ago

notdang 5y ago

Another big problem is that Whatsapp automatically previews the URLs, thus leaking the IP of the person. I could not find a way do disable link previews.

bombcar 5y ago
That’s annoying- many chat programs just leak the cache or chat server as they pull the websnippet there.

darkport 5y ago

I've always wanted to do something similar at scale. Generate all possible random mobile numbers 11^10, check if they have a WhatsApp profile pic and run it through AWS' rekognition celebrity model (https://docs.aws.amazon.com/rekognition/latest/dg/celebrities.html https://docs.aws.amazon.com/rekognition/latest/dg/celebritie...). You could identify the personal numbers for a _lot_ of VIPs, politicians, etc.

m4rtink 5y ago
"Amazon Rekognition can recognize thousands of celebrities in a wide range of categories, such as entertainment and media, sports, business, and politics. With Amazon Rekognition, you can recognize celebrities in images and in stored videos. You can also get additional information for recognized celebrities." Wow, that's legal ? :P Not to mention moral...
- freeflight 5y ago
  I guess an argument could be made how celebrities are public figures which in some jurisdictions gives them a bit worse privacy protections. Also interesting: The article "Celebrity recognition compared to face search" [0] does actually have a disclaimer: > Celebrity recognition should not be used in a manner that could result in a negative impact on civil liberties. Only to then follow up how face search allows for the very same thing with your own face collections, so it's apparently not just reserved to celebrities. [0] https://docs.aws.amazon.com/rekognition/latest/dg/celebrity-recognition-vs-face-search.html https://docs.aws.amazon.com/rekognition/latest/dg/celebrity-...

turtletontine 5y ago

Not to downplay this, but the authors "You can track any mobile phone !" claim seems comically overblown. Not everyone has What's App, some people who have it rarely use it, and only knowing when someone's online is a pretty weak form of "tracking". That said, I agree it's not good that you can spam strangers phone numbers and see when they're online. I'll be turning off that feature on my phone.