10 ms·
You can deactivate anyone's WhatsApp account by simply sending an email
- dbajaj 3y agoah, wished it had email forwarding while it was disabled
- exabrial 3y agoReminds me of government systems where you can lock a specific user out by typing in bad passwords multiple times.
- johnisgood 3y agoThis happens on way too many sites.
- delphi4711 3y agoApple e.g. Even when 2fa is activated, and no successful login happened, they will deactivate my account and force me to change my password :/. I had to change my email that I use to login to Apple.
- rootusrootus 3y agoApple's system caused me more pain in under 1 second than anything I've experienced in the past. That's on me, of course, for using so much of their hardware and software. But still frustrating. What happened? I logged into an Apple service from the browser on my work computer. I should have known better, I get captchas everywhere when coming from our corporate network, so it's clearly on someone's shitlist. Well, even though my authentication was successful, including the verify-pin-on-device-you-already-own part, Apple said "this is a suspicious connection" and immediately logged out every last device, invalidated all sessions, invalidated the password so I had to change it. I was still feeling the pain from that for a week or more afterwards. And now I have a simpler Apple password than the XKCD-style one I had been using, because I got tired of typing it in over-and-over-and-over-and-over.
- harry8 3y ago>That's on me, of course... Yeah, should have used, um, who? Is there no solution to this pain that is actually suggested (designed) by Apple? I would expect there is /something/ that they can do for you for a small, recurring fee. Apple are the worst UI company in the world bar none. Sum up the total amount of utterly needless pain and wanton destruction of the time of their customers and nothing comes close in the wide field of "computing". Yet they have the "Good ui" reputation, which is insane. When people got shocked by this 15 years ago I used to ask them: "Do you know /anyone/ who owns an iPod? Think of them, three names. Now of those three do you know anyone who has not had their music collection deleted by apple software against their wishes? Among those three? No? Anyone at all?" Nowadays there isn't one example that sabotaged literally every user, instead there a many and it has become which subset of the Apple customer smashes got you? Ask your friends. Note the solution to pay apple more. Apple are the shiny, vicious trap. Google are less shiny so it is impossible to sustain the illusion that they do "good ui." Microsoft haha. And from there Apple have consistently led the way in the race to the bottom of customer abuse - you've got nowhere else to go! You can't survive the modern world without this stuff! But sure, Facebook, Microsoft, Google are really quick to match and desperate to find niches in which they can lead and Apple copy.
- deleted 3y ago[deleted]
- KomoD 3y agoAnother very annoying one is when doing forgot password changes the password and emails you a copy, so some funny guy can just go and keep doing forgot password and it force changes your password.
- igitur 3y agoI know a site that does this, except they run their own SMTP server that sometimes blocks up, so the emails never arrive.
- gmargari 3y agoThis was not meant to be used that way: https://www.troyhunt.com/building-password-purgatory-with-cloudflare-pages-and-workers/ https://www.troyhunt.com/building-password-purgatory-with-cl...
- smrtinsert 3y agow
- kiwijamo 3y agoThis happens on non-government systems too. The only system I've experienced this has been a financial institution's system. Frustrating as it meant I had to make the trip into one of their branches to get it reset.
- godelski 3y agoHello, WhatsApp? I'd like to report a stolen phone. Please deactivate the account for ^\+?\d{1,3}[-.\s]?\(?\d{1,3}\)?[-.\s]?\d{1,4}[-.\s]?\d{1,4}[-.\s]?\d{1,9}$ k thx bye https://xkcd.com/327/ https://xkcd.com/327/
- ploum 3y agoI don’t know how I should feel about the fact that I did know what xkcd comic would open before I even clicked the link. https://ploum.net/xkcds-law/index.html https://ploum.net/xkcds-law/index.html
- 0_____0 3y agoBobby Tables, his arms wide.
- ilovecurl 3y agoShaka. When the tables fell.
- TheSpiceIsLife 3y agoI really appreciated this, thank you.
- mellosouls 3y agoInspired the companies house injection attempt discussed here https://news.ycombinator.com/item?id=27815396 https://news.ycombinator.com/item?id=27815396
- cuteboy19 3y agoBut you can reactivate instantly and it doesn't cause data loss if you don't try anything funny during deactivation
- DennisP 3y agoWhat would constitute "trying something funny?"
- chefandy 3y agoUsing your account for anything more humorous than amateur improv comedy, I imagine. Considering how many downvotes most jokes seem to get on HN, I can't imagine that'd be a problem with this crowd.
- deleted 3y ago[deleted]
- stuckkeys 3y agoYou forgot to include “you know, for science” part.
- cuteboy19 3y agoUninstalling the app or clearing the data might lead to data loss if backups were not done before deactivation afiak
- breakingcups 3y agoThen I wonder, what's the point?
- countvonbalzac 3y agoIf someone doesn't control your phone number they can't reactivate.
- jedberg 3y agoAssuming you notice it was deactivated within the short time span they give you. If you're a casual user it could get really annoying to show up and be deactivated, most likely when you have a fairly urgent need.
- lxe 3y agoThis is perfect for getting rid of scammers.
- teddyh 3y ago“Oh? And, when the last law was down, and the Devil turned round on you – where would you hide, Roper, the laws all being flat?” — A Man for All Seasons, Robert Bolt, 1960
- JimtheCoder 3y agoSo, we all want to make it easier to cancel things. But not too easy...
- pmx 3y agoI want it to be easy to cancel my own stuff, not easy for someone else to do it for me.
- swader999 3y agoToo bad it didn't work for the entire meta user base. We could free the world. It would be like independence day when they uploaded the virus to kill the mothership.
- maskedinvader 3y agoI get why one would feel this way if this was one of Meta’s social media apps, but WhatsApp is one of the biggest messaging apps used in so many countries and perhaps also helped kill the telecoms companies paid sms plans to force cheaper sms msging rates, if anything WhatsApp is perhaps the best value Meta has provided to the world, bringing the world closer.
- annadane 3y agoYes but the original founders did that. Zuckerberg took it from them and immediately lied about data sharing, there's a reason why the founders left in disgust
- avalys 3y agoCorrection: The founders sold it to Zuckerberg for billions of dollars. Saying he “took it from them” is outright dishonest.
- cwkoss 3y agoIs anyone working on a script to enumerate all phone numbers and deactivate every whatsapp account yet?
- cwkoss 3y agoI wonder if it would be possible for someone who is really good at getting media stories placed - buy a bunch of put options and sell just after the story breaks - could this be a profitable tradable event? Meta is such a big company I'd be surprised if the cost of the options premiums were less than the value that could be harvested... but maybe..?
- KomoD 3y agoIt's incredibly tempting but too afraid of legal issues
- go_prodev 3y agoYears ago I bought my dad an Audible subscription, but because it was a gift I signed up with my email address and then changed it to my dad's address on his birthday. Somehow I ended up inside his Amazon account because I used his email address. I guess some of the backend logic is hard to get right the first time. Another time I was talking to a credit union CTO who was dealing with someone blocking other people's account access by picking a random account number and making 3 bogus guesses to lock them out. At the time the credit union had a policy that required calling them to unblock... which was a PITA on weekends when people need money.
- mey 3y agoInstacart has some sort of similar issue, signed up under my email, changed the email address to my wife, support requests get sent to both of our addresses.
- jen729w 3y agoSomeone with my name bought a new iPhone in Bismarck, ND last week. They gave AT&T my iCloud email address which is firstname.lastname. An honest mistake, I guess. AT&T dutifully asked 'me' to confirm my email address. I did not. Aaaand... now I still get all of his account email. So what's the point.
- soneil 3y agoI've been struggling with this for years - but with a fun twist. My gmail address is first.last, and someone in the UK keeps using it - but they do not have remotely the same first name, and they don't spell their last name the same as I do (the single-L in my username here is a less common deviation, their surname is the more common variant). Years. I've closed netflix accounts, I've sent them sms from their telco's webtext portal asking them to stop, and still there's a koneill out there who is very, very confused about why his email doesn't work. I know where he lives, I know what pizza he ordered, I know his name, his phone number, I just don't know his email address. And apparently, neither does he. The number of services that fail at email validation (or keep sending you reminders, forever, that you haven't validated), blows my mind. For such a simple process, that seems to exist on every single service I (and koneill) sign up for, it has a surprisingly low rate of successful implementations.
- barbazoo 3y agoI can view tweets again without being logged in ?!?
- shmde 3y agoYes. But you cannot see replies and authors page. Use https://nitter.net/ https://nitter.net/ for that.
- throwaway742 3y agoThank you. I didn't know nitter was working again.
- bastard_op 3y agoSounds like there should be a mass service to close everyone's accounts in their name then. You know, doing them a favor and such.
- dogtorwoof 3y agoSeveral friends of mine had their WhatsApp completely hacked. Basically, hacker would spam recovery, which results in a phone call to the victim. If the victim doesn’t pick up the phone, the recovery code goes to voicemail. Hacker accesses voice mail (password protected yes, but for lots of people it’s a birth year, 1234, 0000, or last 4 digits of their phone), and voila they have access to your WhatsApp. They can’t see your messages but can see all the groups you’re in and message those. Completely preventable by having WhatsApp 2FA enabled.
- fortran77 3y agoAnd some systems still don’t ask for pin if you are calling from your phone. So if you spoof their CID (very easy to do) you get in with no password
- flangola7 3y agoWow that is terrible. Wouldn't that violate multiple data protection laws?
- actionfromafar 3y agoAh maybe, maybe not … best effort blah blah cybercriminals something. So you see, your honor, as a service provider, we did no wrong.
- fortran77 3y agoThis was how most of those "royal family voicemail hacks" from a a decade ago were done... https://www.nytimes.com/2010/09/05/magazine/05hacking-t.html https://www.nytimes.com/2010/09/05/magazine/05hacking-t.html
- cryptoegorophy 3y agoHad this done to me BUT luckily WhatsApp has a “pin” feature, which prevented hackers getting any further. Not as secure maybe as a 2factor but saved my day. Highly recommend.
- 3y ago
- robertlagrant 3y agoClearly Leetcode questions don't cover avoiding the world's dumbest recovery processes.
- nine_zeros 3y agoHey, at least someone got a promo for "impact" in building a low maintenance service with 0% outage history.
- sakopov 3y agoIt might be dumb, but it locks you out in O(1).
- TheCaptain4815 3y agoAnyone know Zuckerburgs WhatsApp account?
- xuki 3y agoI know you got downvoted but it's not that hard to find important people's phone number. The VIP is probably careful handing out that number but when it goes into other people's contact they lost control of that. All it takes is a click on a random iOS/Android app and the whole contact list is uploaded to who know where
- thund 3y agoImagine a world (populated by a human species) where this would be the norm…
- djbusby 3y agoChase bank has a similar issue. Getting confused about business vs personal vs joint and sending the wrong notice to the wrong address.
- 1vuio0pswjnm7 3y agohttps://web.archive.org/web/20230717202207if_/https://twitter.com/JakeMooreUK/status/1680962682726363136 https://web.archive.org/web/20230717202207if_/https://twitte...
- hannofcart 3y agoThere's this insurance aggregator website in my country, where if you ever enter your phone number into their website, without any verification of that number, you get put on some list that elicits 5 calls a day from them trying to sell you insurance. It's crazy. I would wish it on my worst enemies. And I can...
- yokto 3y agoIsn't this flow what more ore less what you would expect? Could someone suggest what would be the appropriate alternative here? - The inconvenience to the deactivated account is minor: one SMS verification code and the account is back, queued messages get received, etc. - Persons who lost their phones probably don't have a good fast way of proving their identity, as their identity is tied to their phone number in WhatsApp's model. - Needing to quickly lock out spammers, thiefs or hackers is probably far more frequent than abuse of this feature. - If abuse of this feature becomes a recurring problem, I'd expect WhatsApp to react and adjust the flow to place more burden on its user. The auto-delete part is slightly more worrying, but if you don't use WhatsApp during 30 days, your account and group membership probably isn't very precious. Backups are automated and separate. You can still easily re-create an account with the same number then. The story might be "Apps should stop using SMS and phones numbers as the source of identity", and while I generally agree, most comments don't seem to be about this and WhatsApp is maybe _the_ one app whose success was based on this very idea.
- hackernewds 3y agoWhat! This is terrible. No other unrelated entity should be able to impact another account they don't own, no less deactivate it! Imagine an automated form of this where you can just mass deactivate antagonistic accounts
- grepfru_it 3y agoBrb automating a denial of service attack
- YetAnotherNick 3y agoLogout is the better word than deactivation in this scenario.
- guiambros 3y agoSince when logout comes with a "we'll delete your account if you don't log back in in 30 days"? This is just an atrocious flow. A better approach would be a "temporary emergency block", and then give the user a week to sort it out, otherwise the account is automatically reinstated.
- ge96 3y agoThis would be useful for the scam jobs
- RajT88 3y agoI am going to use this on the next scammer.
- shannifin 3y agoDigression, story: Years ago I worked in a place that, if you attempted and failed 3 times to login to your account, your account would be locked and you had to see the help desk in person to prove your identity to get it back. And of course somehow this kept happening to me (perhaps a vengeful or stupid coworker?). Fortunately they changed their methods when one week a whole bunch of people had to see the help desk after their accounts were mysteriously locked.
- hight 3y ago[flagged]