3 ms·

It seems that Whisper is acting in a manner that is contradictory to almost every claim they make about the service and software. Isn't this just spyware? - Th

by snsr 12y ago

It seems that Whisper is acting in a manner that is contradictory to almost every claim they make about the service and software. Isn't this just spyware? - They track your location regardless of stated preferences - They store "anonymous" messages indefinitely - They share contents of said messages with the media when it's profitable for the corporation - They freely share data with the US, UK and Chinese governments - They track users with a high potential for juicy posts "for life" - They lie about all of the above (though their terms have been updated since the Guardian revelations)

zaroth 12y ago
I think it's more nuanced than that. If geolocation is turned off, I don't think they are pulling GPS data anyway. So they are not 'tracking your location regardless of stated preferences' any more than every other site on the internet. They don't track anything that isn't implicit in the functioning of the internet -- i.e. an IP address. Obviously they store the messages that their users submit to them. Their data retention should be spelled out in their ToS, and it's not clear if they are violating their own policies here. But take, for example, when Google a while back made a very concerted effort to ensure that deleting an email in Gmail actually meant the email would be deleted from all backups system-wide in some reasonably short timeframe (some number of days/weeks). However, prior to this, and in almost all databases worldwide, you will find that clicking 'Delete' doesn't actually remove the item from backups, and backups are kept for quite a long time / indefinitely. An anonymous post is not necessarily a secret post, they are two different concepts entirely. I've never used Whisper, but when you post something there, I believe it is entirely public. On the face of it, there should be no more an issue sharing a tweet than sharing a whisper. To the following point, I would need to understand what private data they are sharing, not simply that they are featuring specific public posts. If they do feature a post, it makes sense for them to do some due diligence on the veracity of the claims. Honestly, I'm not sure how I feel about them using GeoIP databases as part of that diligence. If someone makes a post to Whisper without using Tor then they have certainly given their IP address away completely willingly, but I'm not sure what restrictions on use of that IP are expected by Whisper, or by any site in general which logs IPs (all of them). Whisper, very similar to Snapchat, both promise the impossible. If you understand that technically their core feature is not actually possible, you try to understand why do people use it anyway. Either they truly thought they were getting the impossible, or there's value to the platform anyway. With Snapchat, you can see how they are trying to reframe the issue from truly secure ephemerality to simply a user interface which focuses on the present and discards the past. Similarly, Whisper is trying to reframe the issue from truly secure anonymity, to simply a user interface which doesn't include usernames / identity. Unless you are a trained professional practicing perfect opsec, you are not anonymous on the internet. It's wrong and potentially dangerous that Whisper is making people feel like they are perfectly anonymous, but I almost wonder why anyone on HN would be surprised by any of this? As a cryptographer, I expect every piece of information I submit/leak to be used against me, so given there's literally nothing about Whisper that provides any security whatsoever, my expectation going into it would be that I am getting none. I get that my perspective is completely different from the average user on this.
- Zigurd 12y ago
  That's a bit like saying "I'm a nutritionist. How could not think most of the aisles at the grocery store are out to kill you?"
  - zaroth 12y ago
    Food isn't supposed to kill you, but the internet definitely is supposed to identify you. It's only through extraordinary measures that you can get on the internet anonymously, but it would take extraordinary measures to kill yourself eating at the grocery store. If someone told me the corner grocery store was selling deadly food, I would be just as likely to believe them as someone telling me that posting on Whisper.sh keeps me securely anonymous on the internet.
    - titanomachy 12y ago
      > the internet definitely is supposed to identify you If you have a rudimentary technical understanding of the internet, it's clear that the default assumption should be that you're identified unless presented with strong evidence/reasoning to the contrary. But what percentage of internet users do you think have any technical understanding of the internet? 20-30 percent, maybe? To most people it's basically magic, and they have no compelling reason to give any thought to how it works. Regulations should be designed with the common user in mind, not the technically proficient. If a company claims that they provide anonymity, they should live up to that promise or be prosecuted for false advertising.
      - zaroth 12y ago
        I think the fact that this was as big of a story as it is shows us how poorly people understand how privacy and anonymity work online. The closer the general response to this story is "Well, duh" I think the better.
- deleted 12y ago
  [deleted]

by snsr 12y ago

zaroth 12y ago

I think it's more nuanced than that. If geolocation is turned off, I don't think they are pulling GPS data anyway. So they are not 'tracking your location regardless of stated preferences' any more than every other site on the internet. They don't track anything that isn't implicit in the functioning of the internet -- i.e. an IP address. Obviously they store the messages that their users submit to them. Their data retention should be spelled out in their ToS, and it's not clear if they are violating their own policies here. But take, for example, when Google a while back made a very concerted effort to ensure that deleting an email in Gmail actually meant the email would be deleted from all backups system-wide in some reasonably short timeframe (some number of days/weeks). However, prior to this, and in almost all databases worldwide, you will find that clicking 'Delete' doesn't actually remove the item from backups, and backups are kept for quite a long time / indefinitely. An anonymous post is not necessarily a secret post, they are two different concepts entirely. I've never used Whisper, but when you post something there, I believe it is entirely public. On the face of it, there should be no more an issue sharing a tweet than sharing a whisper. To the following point, I would need to understand what private data they are sharing, not simply that they are featuring specific public posts. If they do feature a post, it makes sense for them to do some due diligence on the veracity of the claims. Honestly, I'm not sure how I feel about them using GeoIP databases as part of that diligence. If someone makes a post to Whisper without using Tor then they have certainly given their IP address away completely willingly, but I'm not sure what restrictions on use of that IP are expected by Whisper, or by any site in general which logs IPs (all of them). Whisper, very similar to Snapchat, both promise the impossible. If you understand that technically their core feature is not actually possible, you try to understand why do people use it anyway. Either they truly thought they were getting the impossible, or there's value to the platform anyway. With Snapchat, you can see how they are trying to reframe the issue from truly secure ephemerality to simply a user interface which focuses on the present and discards the past. Similarly, Whisper is trying to reframe the issue from truly secure anonymity, to simply a user interface which doesn't include usernames / identity. Unless you are a trained professional practicing perfect opsec, you are not anonymous on the internet. It's wrong and potentially dangerous that Whisper is making people feel like they are perfectly anonymous, but I almost wonder why anyone on HN would be surprised by any of this? As a cryptographer, I expect every piece of information I submit/leak to be used against me, so given there's literally nothing about Whisper that provides any security whatsoever, my expectation going into it would be that I am getting none. I get that my perspective is completely different from the average user on this.

Zigurd 12y ago
That's a bit like saying "I'm a nutritionist. How could not think most of the aisles at the grocery store are out to kill you?"
- zaroth 12y ago
  Food isn't supposed to kill you, but the internet definitely is supposed to identify you. It's only through extraordinary measures that you can get on the internet anonymously, but it would take extraordinary measures to kill yourself eating at the grocery store. If someone told me the corner grocery store was selling deadly food, I would be just as likely to believe them as someone telling me that posting on Whisper.sh keeps me securely anonymous on the internet.
  - titanomachy 12y ago
    > the internet definitely is supposed to identify you If you have a rudimentary technical understanding of the internet, it's clear that the default assumption should be that you're identified unless presented with strong evidence/reasoning to the contrary. But what percentage of internet users do you think have any technical understanding of the internet? 20-30 percent, maybe? To most people it's basically magic, and they have no compelling reason to give any thought to how it works. Regulations should be designed with the common user in mind, not the technically proficient. If a company claims that they provide anonymity, they should live up to that promise or be prosecuted for false advertising.
    - zaroth 12y ago
      I think the fact that this was as big of a story as it is shows us how poorly people understand how privacy and anonymity work online. The closer the general response to this story is "Well, duh" I think the better.
deleted 12y ago
[deleted]