4 ms·

Lets say I have access to a smartphone and I can do everything on it. So if I am able to pull off all the parameters which are used for password, can I imperson

Lets say I have access to a smartphone and I can do everything on it. So if I am able to pull off all the parameters which are used for password, can I impersonate the cell owner? Whatever complex server side code Whatsapp will use, without password, I think it would only be security through obscurity.

amjd 13y ago
Although it's not that easy extracting the password from a WhatsApp installation, it's very much possible. [1] However, since WhatsApp supports only one active session at a time, whenever the second user logs in, the other will be logged out. [1] https://github.com/shirioko/MissVenom https://github.com/shirioko/MissVenom
balladeer 13y ago
Unrelated to your comment but relevant: I had my friend's number saved on my phone, but we were not in touch for over an year; one day I installed WhatsApp and saw him there - I pinged him; the response came, "Who the fk are you, you b*d! There is no <my friend's name> here. Go to hell!!". Turns out my friend had changed the number, so the cell number was released and assigned to another user after few months but WhatsApp on my phone thought it was my friend on the other side. That was when I knew WhatsApp is not revolutionary, it's just lazy, convenient and famous.
- SifJar 13y ago
  So in other words, you got the exact same response as if you had sent a regular SMS message; I fail to see how that is a problem. Yes, WhatsApp uses your regular phone contacts; much simpler than having to exchange usernames with everyone you want to message on WhatsApp. Is it revolutionary? No, it's a simple, cheap, cross-platform messaging app. It does what it's meant to do, and does it pretty well.
  - amjd 13y ago
    Exactly. I don't see how that shows a shortcoming on WhatsApp's part.
    - aylons 13y ago
      It is because using a location and operator dependant phone number as the main gateway to reach someone is prone to errors and no longer necessary. Whatsapp using it just show how bad its architecture is.

amjd 13y ago

Although it's not that easy extracting the password from a WhatsApp installation, it's very much possible. [1] However, since WhatsApp supports only one active session at a time, whenever the second user logs in, the other will be logged out. [1] https://github.com/shirioko/MissVenom https://github.com/shirioko/MissVenom

balladeer 13y ago

Unrelated to your comment but relevant: I had my friend's number saved on my phone, but we were not in touch for over an year; one day I installed WhatsApp and saw him there - I pinged him; the response came, "Who the fk are you, you b*d! There is no <my friend's name> here. Go to hell!!". Turns out my friend had changed the number, so the cell number was released and assigned to another user after few months but WhatsApp on my phone thought it was my friend on the other side. That was when I knew WhatsApp is not revolutionary, it's just lazy, convenient and famous.

SifJar 13y ago
So in other words, you got the exact same response as if you had sent a regular SMS message; I fail to see how that is a problem. Yes, WhatsApp uses your regular phone contacts; much simpler than having to exchange usernames with everyone you want to message on WhatsApp. Is it revolutionary? No, it's a simple, cheap, cross-platform messaging app. It does what it's meant to do, and does it pretty well.
- amjd 13y ago
  Exactly. I don't see how that shows a shortcoming on WhatsApp's part.
  - aylons 13y ago
    It is because using a location and operator dependant phone number as the main gateway to reach someone is prone to errors and no longer necessary. Whatsapp using it just show how bad its architecture is.