4 ms·

This is not a security vulnerability, it’s been documented in the user interface for years. That’s why I have no profile picture and no status. You clearly opt

This is not a security vulnerability, it’s been documented in the user interface for years. That’s why I have no profile picture and no status. You clearly opt into “everyone” viewing it, and it’s obvious this it is literally anyone, because when you add a new contact, you simply enter their phone number and can see their profile picture and status. It doesn’t take a leap of imagination to enumerate that for the space of valid phone numbers.

porridgeraisin 11mo ago
There is a way to show profile pictures to only contacts. It's a setting.
- chatmasta 11mo ago
  Yes, and those people didn't get their profile pictures exposed through this phone number enumeration. If they had, then maybe it would have qualified as a security breach.
  - throwaway290 11mo ago
    > Yes, and those people didn't get their profile pictures exposed through this phone number enumeration. They did and this was not enumeration, did you read post?
    - chatmasta 11mo ago
      The post with the headline “Worldwide enumeration of accounts was possible?”
      - throwaway290 11mo ago
        OK... but it's not phone number enumeration. You need to give it a phone number to check if whatsapp acc is registered for it. So you need to have a collection of phone numbers first. If you have a collection of all phone numebrs in the world then you could enumerate whatsapp accounts. And yes the pictures were leaked in the process.
        hashhar 11mo ago
        It's trivial to enumerate all the phone numbers in the world.
        throwaway290 11mo ago
        exactly. to claim enumerating phone numbers is a whatsapp bug is stupid. and to say profile pictures were not revealed = not reading tfa.
        yorwba 11mo ago
        "The accessible data items used in the study are the same that are public for anyone who knows a user's phone number and consist of: phone number, public keys, timestamps, and, if set to public, about text and profile picture." Source: TFA, which I read.
        throwaway290 11mo ago
        From my understanding the accessible data items meant they got them through the bug? Maybe I read wrong

porridgeraisin 11mo ago

There is a way to show profile pictures to only contacts. It's a setting.

chatmasta 11mo ago
Yes, and those people didn't get their profile pictures exposed through this phone number enumeration. If they had, then maybe it would have qualified as a security breach.
- throwaway290 11mo ago
  > Yes, and those people didn't get their profile pictures exposed through this phone number enumeration. They did and this was not enumeration, did you read post?
  - chatmasta 11mo ago
    The post with the headline “Worldwide enumeration of accounts was possible?”
    - throwaway290 11mo ago
      OK... but it's not phone number enumeration. You need to give it a phone number to check if whatsapp acc is registered for it. So you need to have a collection of phone numbers first. If you have a collection of all phone numebrs in the world then you could enumerate whatsapp accounts. And yes the pictures were leaked in the process.
      - hashhar 11mo ago
        It's trivial to enumerate all the phone numbers in the world.
        throwaway290 11mo ago
        exactly. to claim enumerating phone numbers is a whatsapp bug is stupid. and to say profile pictures were not revealed = not reading tfa.
        yorwba 11mo ago
        "The accessible data items used in the study are the same that are public for anyone who knows a user's phone number and consist of: phone number, public keys, timestamps, and, if set to public, about text and profile picture." Source: TFA, which I read.
        throwaway290 11mo ago
        From my understanding the accessible data items meant they got them through the bug? Maybe I read wrong