7 ms·

Tracking friends and strangers using WhatsApp

828 points by robheaton 9y ago

marindez 9y ago
What I don't like about WhatsApp is that even if you hide your last connection time, everybody gets to see whether you're online.
- deleted 9y ago
  [deleted]
- arunc 9y ago
  I was exactly thinking about this last night. It's bad that WhatsApp doesn't hide the online status.
Havoc 9y ago
I suspect a fairly small percentage of users is active enough that you get usable hourly data.
- polote 9y ago
  I agree with you, whatsapp is not like Tinder or Facebook you don't open it every 2 minutes to check if there is something new.
  - koolba 9y ago
    Do you really check Tinder for new "content" every two minutes?
    - polote 9y ago
      > The company said that, on average, people log into the app 11 times a day https://www.nytimes.com/2014/10/30/fashion/tinder-the-fast-growing-dating-app-taps-an-age-old-truth.html?&_r=1 https://www.nytimes.com/2014/10/30/fashion/tinder-the-fast-g... But yes not every 2 minutes
      - vincentkriek 9y ago
        WhatsApp will definitely be opened more than 11 times a day. I would argue the average is a lot closer to 11 times an hour than 11 times a day.
  - vegbrasil 9y ago
    It is in a lot of countries.
  - raarts 9y ago
    That depends on the country. In the US, people still tend to text a lot, but in most of Europe, Whatsapp totally replaced texting.
    - rconti 9y ago
      Is this because of their still-utterly-broken roaming model? (supposedly to be remedied soon)
      - notzorbo3 9y ago
        It's probably a combination of high cost of texts at the time when Whatsapp became popular, no limit (or much larger limit) to the size of texts, a reasonable probability of texts not arriving or arriving late and a "fuck telcos for squeezing millions of euros from their users for no other reason than to turn massive profits from texting" attitude.
      - morsch 9y ago
        Soon was June 2017. But I doubt it has anything to do with roaming. Maybe more people paid per SMS for a longer time than in the US? I know I still do; I could add unlimited messages to my monthly contract for 1 EUR or so, but what's the point.
        rconti 9y ago
        Interesting. My assumption was that Europe was much more okay with pay-per-use than the US was. It was always strange to someone in the US that a European would pay different amounts for a call depending on what kind of phone you were calling, where in the US both parties simply paid for their airtime if they wanted to use mobile phones. SMS took off faster in Europe than in the US, but we've had bundled packages for so long that the individual cost per text wasn't such an issue, and now on many plans they're unlimited. I guess the differing cost structure depending on who you're texting and from where may have spurred the adoption of WhatsApp, whereas in the US, even if you WERE paying per text, it was the same across a territory of many thousands of miles and hundreds of millions of people. And, the same way that many folks in the US do not even have a passport, they tend also not to have a reason to text internationally. The size and homogeneity of the country benefits the adoptions of some technologies, but hinders the adoption of others.
  - notzorbo3 9y ago
    That's even worse, because it makes it easier to correlate when two people are Whatsapping with each other. If they both happen to be online at the same time a lot...
  - poisonarena 9y ago
    I live in Colombia, before then Mexico, and yes you do check on it every 2 minutes everyone does, at least in Latin America
    - parthdesai 9y ago
      Same in India.
  - avip 9y ago
    That's a per-country thing. There are countries where Whatsapp is the de-facto standard for passing information.
- lbebber 9y ago
  It depends where; in Brazil, for instance, WhatsApp groups are becoming the main social network for a large amount of people—nevermind 1:1 chat.
- yoavm 9y ago
  I guess it really depends where. I believe here, where WhatsApp is pretty much the _only_ method of communication, people most definitely check it every few minutes, and especially before they go to bed.
  - tcmb 9y ago
    Honest question, isn't this what notifications and icon badges are for? It's easy to see if there's anything new without opening the app. Related question, does WhatsApp send the heartbeat only when I open the app, or every x minutes as long as it has a network connection?
    - polote 9y ago
      Only if you go on the app
    - cassowary 9y ago
      The notification and icon badges help hide when you're sleeping, but they advertise when you're interacting with someone. You're "unseen" for twenty hours. The guy you're cheating with logs in and sends you a message. Five minutes later, you log in and read it. You wait two hours, read it again and send another message. He doesn't check for an hour. You're so longing for his response, so every five minutes you're logging in "how many ticks? what color? has he read it yet??". Once he's out of his meeting, he (finally noticing the notification) logs in and sends a message. Your activity drops off now that you have your reply, but you nevertheless send yours...
- himlion 9y ago
  In some countries WhatsApp is the main form of communication between friends and people are on it every waking minute.
- thedaniel 9y ago
  I suspect the opposite - given that whatsapp dominates texting in europe, and twice as many people live in europe as the USA (which is upon what i suspect you base your assumption here)
  - _Tev 9y ago
    Oh come on, "whatsapp dominates texting in europe"? You do not know every country ;) Based on my experience it would actually be opposite, but I am not going to extrapolate to whole continent.
- mateus1 9y ago
  Brazilian here, I probably check Whatsapp +50 times a day and I'm not a heavy user.
- anonu 9y ago
  I think there's more than 1.3 billion users on WhatsApp - its massive - I am personally checking it constantly (> once an hour) It's certainly a more popular app outside of the USA. They initially gained traction because they were willing to make apps for things other than iphones and androids - which gave them a huge following in the developing world where people may still use 10+ year old candy bars.
  - ohmicmann 9y ago
    This is so true. Where I live most of people started using Whatsapp on old Nokia phones running SymbianOS. It was one of the few decent apps available.
  - deleted 9y ago
    [deleted]
vikascoder 9y ago
So you can track someones online log times using WhatsApp last seen feature? Thats the most shocking thing I have heard all year especially considering this whole thing is as stale as the cheese on the burger in your local dive bar. This should have been written early last year, I think a lot of folks have learned the blue ticks and the online status aspects of whatsapp
youeeeeeediot 9y ago
Always wondered what would happen if someone was to happen to have every valid US/CAN number in their contact list (all 3-4 billion), since WhatsApp doesn't validate you actually know the contact just that you have their phone number.
- carroccio 9y ago
  They ban your IP. Anyway with some effort you can deanonimize a lot of numbers (eg: status/name/profile photo).
  - CommentCard 9y ago
    Is there a known upper limit on the number of #s one account can have? I suppose you could use that limit to set up enough WhatsApp accounts on proxies to effectively have access to all registered #s?
    - tcmb 9y ago
      There's another startup idea.
      - CommentCard 9y ago
        It might be worth doing just so WhatsApp will change how they validate access to #s.
      - ballenf 9y ago
        The idea being you incentive WhatsApp users to install your app that then harvests all their contacts and collates the "last seen" info on all of them. If they delete your app, you setup a proxy to imitate their device and continue the monitoring. Have a privacy policy that is super strong but has a couple "loopholes" that one can drive a truck through. Is that the idea? Seems doable if you're not too risk averse, have no family and live in a country with weak extradition laws. Kidding, there's nothing illegal about any of this stuff or FB, Google and lots of other companies would not be in business. FB would have a civil claim against you -- they paid several billion dollars for the legal right to all that user data!
j_s 9y ago
Stalking Your Friends with Facebook Messenger | https://news.ycombinator.com/item?id=9609286 https://news.ycombinator.com/item?id=9609286 (May 2015, 185 comments) when you send a message from the Messenger app there is an option to send your location with it the mobile app for Facebook Messenger defaults to sending a location with all messages
- chis 9y ago
  Facebook doesn't do this anymore. http://money.cnn.com/2015/06/04/technology/facebook-messenger-location-tracking-fix/index.html http://money.cnn.com/2015/06/04/technology/facebook-messenge...
squigg 9y ago
I loved this article. It is beautifully written, given both the hacking curiosity on display as well as the real-world privacy impact it demonstrates. Most of my family use whats-app and would be mortified if they actually understood most of this. Not saying they would stop using it, as the trade-off is a great social app, but it would make them think more broadly about how the world is changing.
- tcmb 9y ago
  Nobody has to stop using WhatsApp, the scenario described in the article can be prevented simply by changing the app's privacy settings.
  - polote 9y ago
    Wrong, if you deactivate the feature 'last seen at' it doesn't change anything because you can still get the same information with the feature 'is online now' and this feature can't be deactivated
    - 100ideas 9y ago
      Can't a user just remain logged-in on a second device 24/7?
      - jhasse 9y ago
        IIRC you can't log in from two devices at once with WhatsApp.
    - netsharc 9y ago
      Did he mean change it client-side, or if WhatsApp the company changes this setting to allow more privacy (allow users to hide their status).
    - NasKe 9y ago
      What count as "online"? Using the app? Does the web app also track that? I don't think this is disclosed by facebook, it would be nice to experiment to check it.
option_greek 9y ago
Of course, the elephant in the room is that all this info and much more is with WhatsApp, Facebook, Google and what ever garbage app is installed on your phone. I agree that the article is more about targeted surveillance towards certain users but that is where NSA and secret letters come in :).
jimmies 9y ago
If you trust those """services""" to be secure and trust that they care about your privacy, then you will be betrayed sooner or later, in ways you can't think of -- just like in the article. Fun fact, years ago I accidentally found out that my girlfriend at the time cheated on me on Snapchat, without me actually exploiting anything. She told me to join it with her, telling me that is going to be fun. Snapchat kept track of useds' activity and gamified it to incentivize you by scoring your activity then. Each person has a public activity score when you tap on their profile. One day, I noticed that her Snapchat had more than twice the score that I had. So I clicked on her profile and there it is some strange dude having a score higher than me, it turned out that was her """"ex"""" (I actually never asked her even for his name before, I found out only after that). I never consciously looked for anything, I trusted her 100%, the score was just there on my screen. Thanks Snapchat for their stupid gamification efforts, otherwise I would have wasted more time on her. But since that accident, I never trust proprietary shit that has money to make, ads to sell, governments to please, and incentives to grow, even it says its selling point is to protect your privacy, like Snapchat. It's not about the "end to end encryption" or "finer privacy control" or "only allow when app is in foreground" or "restricted sharing" or "MIT open sauce license" or "export your data" or "only listening to hotwords" or "open APIs," it's about the intent. If the intent was to expand and make money, then all those techs won't be the magic pill that suddenly cures the ill intent. Anyway, privacy my ass, man.
- rconti 9y ago
  Wait, when you view her profile (as a friend), it shows who has the highest 'score' in terms of contact with her? Wow, that IS a lot of data if they break it down by contact pairs.
  - Puer 9y ago
    Snapchat used to publicly display each person's "best friends" list, but not anymore.
  - jimmies 9y ago
    Yep. It was called Snapchat score or something. It had a list of top 3 people or so and how much score they had with each other. It was unreal. This was back in spring-summer 2015.
thanatropism 9y ago
I'm increasingly inclined to keep my phone on airplane mode for most of the day. Now, I just need to train people into calling me only between x:00 and x:05. But I don't get many calls anymore, everybody texts...
sqren 9y ago
Very well written article - and I love your drawings! I did a similar story a while back on how you can track your friends sleep patterns using Facebook Messenger [1]. I'm sure there are lots of other services that have this problem, and most users are blissfully unaware. [1] https://medium.com/@sqrendk/how-you-can-use-facebook-to-track-your-friends-sleeping-habits-505ace7fffb6 https://medium.com/@sqrendk/how-you-can-use-facebook-to-trac...
jagjotsingh 9y ago
Loved the article. The increasing pace with the article gives you a rush which was amazing! Very well written.
antirez 9y ago
A few weeks ago there was a similar discussion, and I commented the following: If you think there is no problem, you are wrong. The blog post does not show all the information leaks that this implies. Example: I can modify the script to monitor all the numbers I've in my phone, so that based on the online/offline status in a few weeks I can be able to guess who is having conversations together, discovering cheatings, work affairs, ... EDIT: Practical example. After collecting enough data about user X I create a table about the probability of this user being online in a given few-minutes time ranges. Then I check the online frequency of that user compared to the online statuses of another user Y. If the difference compared to the expected probability is significant, than I can suspect the two are chatting. Another thing I can use is that attivation delay of the online status, since often X sends a message to Y and this results in, a few seconds after, Y to be online, and then the contrary. [then an HN user said she/he was not sure this was serious because maybe the users casually had similar patterns, so I replied:] If you check the model I described in my comment, it should filter the "bus problem", since it will detect a chat only if, compared to the standard "bus time" probability of the user A chatting, it is chatting more if in the same range also B is chatting. If you add to this that people on Whatsapp usually do not talk to the exact minutes, it is definitely possible to create a robust system for guessing with good probability of two have often conversations. Also note that the phone numbers in input are not random, are the ones of a connected circle of persons. Add to this the fact that we can split the ranges even, potentially, by few minutes, and you can even detect interesting stuff for people having continuos chats with multiple persons like teenagers. Another thing that is possible probably is also "groups detection", since at new messages a set of users will activate at the same time. [And the attack can be refined a lot with more powerful mathematical approaches]
- polote 9y ago
  The thing is, this method works pretty well if people are chatting in real time, if you wait like 10 minutes to answers messages, it is much more difficult to create the links. Moreover if people are using all the time Whatsapp, it is again much more difficult to do. But I agree with you, there are many situations where these could work
  - 9y ago
throw2016 9y ago
People avoid thinking too much about things that are working as advertised. How many people wonder about how exactly their cars work or the global financial system works yet they are impacted by both of these. They may reserve curiosity for other things depending on their interests. And here the problem begins, a lot of software engineers seem to conflate this disinterest to stupidity and think this gives them a right to do whatever they want with other people's data. There is a fundamental lack of understanding and respect of other people rights and privacy and an easy dehumanization that is disconnected from human society and the evolution of fundamental rights like like the right to privacy. Regulation will catch up and eventually address this as more people become aware but is a troubling reflection of a large part of the software ecosystem.
janwh 9y ago
Nevermind the clever writing but the issue has been known for years—and beautifully exploited with the selfhostable ready-made solution WhatsSpy Public since Feb 2015: https://gitlab.maikel.pro/maikeldus/WhatsSpy-Public/ https://gitlab.maikel.pro/maikeldus/WhatsSpy-Public/ It's not actively maintained anymore but Maikel deserves some credit for it.
- gsich 9y ago
  Wanted to post the same. Note that this project used an own client, instead of scraping the webinterface. Which is by far superior, because you don't need an active charged phone and can scale much better. yowsup is still around and working.
- kevingrahl 9y ago
  Do you happen to know if it’s still working without heavy modifications?
  - gsich 9y ago
    Probably not, it used Chat-API [0], but the developer is kind of an asshole. But I admit, people just post stupid issues all the time. However I don't share the developers opinion that this was abused. My friends and I haven't received spam messages on Whatsapp. I admit that may be a small sample size, but still. [0] https://github.com/mgp25/Chat-API https://github.com/mgp25/Chat-API
    - dedmen 9y ago
      I did the same about mid 2015 using yowsup (Python API to Whatsapp). But it's was a private project because of legality concerns of hoarding so much data.
KamogTechs 9y ago
Nice and very well written article,most of my friends use whatsapp and would be mortified if they actually understood most of this.
- RobertoG 9y ago
  Even without, unfortunately (I'm sure they are wonderful), knowing your friends, I bet you a cookie that they don't care.
JamieF1 9y ago
Reminds me of an article I wrote up about tracking who's talking to who on WhatsApp: https://medium.com/p/finding-out-if-2-people-are-chatting-to-each-other-on-whatsapp-7f13448be665 https://medium.com/p/finding-out-if-2-people-are-chatting-to...
abcdabcd987 9y ago
I think I did almost the same thing three years ago. See: https://www.v2ex.com/t/121272 https://www.v2ex.com/t/121272 (in Chinese only, sorry. I should translate it to English when I'm free)
kyranjamie 9y ago
Enjoyed the article, but my favourite part is the reference to Garth Marenghi's Darkplace in the description.
kzisme 9y ago
Maybe I'm in the minority, but I haven't ever used WhatsApp. Is there a huge benefit to using it over SMS, or something similar?
- marindez 9y ago
  It's free (unlike SMS or MMS) and back in the day it was the only service that worked reliably on all mobile platforms and didn't use PINs or usernames--just the phone numbers in your contact list so it was plug&play: just install it and you can talk to everybody.
- zuppy 9y ago
  Group messages don't really work over sms with different device types. Same for attachments, multimedia, location data.
- zaat 9y ago
  * SMS delivery isn't guaranteed. * SMS don't have read receipt. * SMS depends on cellular connectivity. * SMS and MMS have very limited media transfer support. * SMS don't have feature similar to groups.
  - hnaccy 9y ago
    >* SMS don't have read receipt. I feel like this is a pro.
    - zaat 9y ago
      While I can see your point, it really depends on usage purpose and taste. For many this is the most valuable feature of the app.
    - wongarsu 9y ago
      You can disable it in WhatsApp.
  - zuppy 9y ago
    > * SMS don't have read receipt. Yes, they do. iPhones don't seem to do that, but old GSM phones did it (like my first phone, Ericsson T20, which got released in 2000). Androids have read reports in the default message app, if I'm not mistaken.
diegorbaquero 9y ago
I made an MVP 2 years ago: https://www.producthunt.com/posts/whatsapp-tracker https://www.producthunt.com/posts/whatsapp-tracker
salqadri 9y ago
Huh; why on Earth does WhatsApp make the default visibility of your "last seen" to "everyone"?! Also, speaking of 'tracking', I'd love to be able to track the sources of fake news forwards, but I assume such a technique would not work for anything like that.
colanderman 9y ago
> Facebook sends data to your browser using straightforward HTTP requests that you can easily write a program to mimic. Shameless plug, I wrote a plugin for Chrome [1] and Firefox [2] to do just that. (Facebook is the opposite of WhatsApp – you can disable your online/offline status, but not your idle time.) [1] https://chrome.google.com/webstore/detail/social-network-chat-idle/ngjiolhcdneedkjhdpeokdahhgohnogo https://chrome.google.com/webstore/detail/social-network-cha... [2] https://addons.mozilla.org/en-US/firefox/addon/social-network-chat-idle/ https://addons.mozilla.org/en-US/firefox/addon/social-networ...
aecorredor 9y ago
Just turn off last seen. Duh.
- mnafees 9y ago
  https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-feature-dbde54ecf79b https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-... ;)
- dedmen 9y ago
  If you had read the blogpost you'd know that doesn't help.
antoaravinth 9y ago
I might be wrong here, but what if I change my settings to "not show the last seen status"? I guess in that case this doesn't work. Yes, I believe checking "Online" status frequently does give some information about my activity. Correct me if I'm wrong here.
- helloindia 9y ago
  I was thinking the same. I haven't seen any of my friend with last seen status enabled.
  - slig 9y ago
    If you disable on your account, you can't see the last seen status of your friends, even if they have it enabled.
cl289 9y ago
Just to clarify as a non-user: there's an online status, and a 'last seen' data point, and both can be queried by any user for any user given their telephone number, as often as the querying party likes? And the online status is when the app is open on the phone?
- itsyogesh 9y ago
  AFAIK If you have them in your contacts and they haven't blocked you, you can access both those data points. If they have disabled last seen, you can still get the the 'online' and 'typing' status.
rajesh004 9y ago
isn't this privacy breach?
HNSucksAss 9y ago
That would require that they use WhatsApp... which none of them does.
mnafees 9y ago
A few days ago I tried to track people on WhatsApp even if their "Last Seen" was hidden. https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-feature-dbde54ecf79b https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-...
jesperlang 9y ago
When stuff like this happen I wonder if we can try to trick the system, overloading it with information, faking things. Couldn't we just somehow make sure we are online all the time (some script pinging the app), then the data would become meaningless..
anfogoat 9y ago
The only issue here is that WhatsApp lets you see the status of people who don't have you as a contact. The rest is utterly underwhelming. One thing I loved about ICQ-esque IM services was that you could clearly see whether a contact was online or not. I still feel weird starting a conversation on WhatsApp because of the lack of clear visual cues of the contact's status.
kinnth 9y ago
Brilliantly written Rob Heaton! Bravo!
samfriedman 9y ago
Similar "online status tracking" has been used for Facebook messenger in the past. I know Facebook removed send-location by default, but I'm not sure if the API still allows pulling online status. https://defaultnamehere.tumblr.com/post/139351766005/graphing-when-your-facebook-friends-are-awake https://defaultnamehere.tumblr.com/post/139351766005/graphin...
bikamonki 9y ago
Whatsapp's opening an API for businesses soon. More abuse on your data. Wait for it.
collyw 9y ago
Just turned that "feature" off in mine. I am glad people point out stuff like this. Is Facebook still spitting out similar crap? I checked the console and there is a reassuring looking message there, but I am not up to date.
dedmen 9y ago
I don't see why people suddenly panic about it.. That's not a new thing. I wrote my own Tracking app over 2 years ago. I still have the code and database laying around. I was using https://github.com/tgalal/yowsup https://github.com/tgalal/yowsup back then. Back then you could even see when people requested your online-status. Meaning you could see when they opened your chat. Back then I used that to see if my message have been read because the message-read notification didn't exist back then.
nebulos 9y ago
Well written.

828 points by robheaton 9y ago

What I don't like about WhatsApp is that even if you hide your last connection time, everybody gets to see whether you're online.

deleted 9y ago
[deleted]
arunc 9y ago
I was exactly thinking about this last night. It's bad that WhatsApp doesn't hide the online status.

Havoc 9y ago

I suspect a fairly small percentage of users is active enough that you get usable hourly data.

polote 9y ago
I agree with you, whatsapp is not like Tinder or Facebook you don't open it every 2 minutes to check if there is something new.
- koolba 9y ago
  Do you really check Tinder for new "content" every two minutes?
  - polote 9y ago
    > The company said that, on average, people log into the app 11 times a day https://www.nytimes.com/2014/10/30/fashion/tinder-the-fast-growing-dating-app-taps-an-age-old-truth.html?&_r=1 https://www.nytimes.com/2014/10/30/fashion/tinder-the-fast-g... But yes not every 2 minutes
    - vincentkriek 9y ago
      WhatsApp will definitely be opened more than 11 times a day. I would argue the average is a lot closer to 11 times an hour than 11 times a day.
- vegbrasil 9y ago
  It is in a lot of countries.
- raarts 9y ago
  That depends on the country. In the US, people still tend to text a lot, but in most of Europe, Whatsapp totally replaced texting.
  - rconti 9y ago
    Is this because of their still-utterly-broken roaming model? (supposedly to be remedied soon)
    - notzorbo3 9y ago
      It's probably a combination of high cost of texts at the time when Whatsapp became popular, no limit (or much larger limit) to the size of texts, a reasonable probability of texts not arriving or arriving late and a "fuck telcos for squeezing millions of euros from their users for no other reason than to turn massive profits from texting" attitude.
    - morsch 9y ago
      Soon was June 2017. But I doubt it has anything to do with roaming. Maybe more people paid per SMS for a longer time than in the US? I know I still do; I could add unlimited messages to my monthly contract for 1 EUR or so, but what's the point.
      - rconti 9y ago
        Interesting. My assumption was that Europe was much more okay with pay-per-use than the US was. It was always strange to someone in the US that a European would pay different amounts for a call depending on what kind of phone you were calling, where in the US both parties simply paid for their airtime if they wanted to use mobile phones. SMS took off faster in Europe than in the US, but we've had bundled packages for so long that the individual cost per text wasn't such an issue, and now on many plans they're unlimited. I guess the differing cost structure depending on who you're texting and from where may have spurred the adoption of WhatsApp, whereas in the US, even if you WERE paying per text, it was the same across a territory of many thousands of miles and hundreds of millions of people. And, the same way that many folks in the US do not even have a passport, they tend also not to have a reason to text internationally. The size and homogeneity of the country benefits the adoptions of some technologies, but hinders the adoption of others.
- notzorbo3 9y ago
  That's even worse, because it makes it easier to correlate when two people are Whatsapping with each other. If they both happen to be online at the same time a lot...
- poisonarena 9y ago
  I live in Colombia, before then Mexico, and yes you do check on it every 2 minutes everyone does, at least in Latin America
  - parthdesai 9y ago
    Same in India.
- avip 9y ago
  That's a per-country thing. There are countries where Whatsapp is the de-facto standard for passing information.
lbebber 9y ago
It depends where; in Brazil, for instance, WhatsApp groups are becoming the main social network for a large amount of people—nevermind 1:1 chat.
yoavm 9y ago
I guess it really depends where. I believe here, where WhatsApp is pretty much the _only_ method of communication, people most definitely check it every few minutes, and especially before they go to bed.
- tcmb 9y ago
  Honest question, isn't this what notifications and icon badges are for? It's easy to see if there's anything new without opening the app. Related question, does WhatsApp send the heartbeat only when I open the app, or every x minutes as long as it has a network connection?
  - polote 9y ago
    Only if you go on the app
  - cassowary 9y ago
    The notification and icon badges help hide when you're sleeping, but they advertise when you're interacting with someone. You're "unseen" for twenty hours. The guy you're cheating with logs in and sends you a message. Five minutes later, you log in and read it. You wait two hours, read it again and send another message. He doesn't check for an hour. You're so longing for his response, so every five minutes you're logging in "how many ticks? what color? has he read it yet??". Once he's out of his meeting, he (finally noticing the notification) logs in and sends a message. Your activity drops off now that you have your reply, but you nevertheless send yours...
himlion 9y ago
In some countries WhatsApp is the main form of communication between friends and people are on it every waking minute.
thedaniel 9y ago
I suspect the opposite - given that whatsapp dominates texting in europe, and twice as many people live in europe as the USA (which is upon what i suspect you base your assumption here)
- _Tev 9y ago
  Oh come on, "whatsapp dominates texting in europe"? You do not know every country ;) Based on my experience it would actually be opposite, but I am not going to extrapolate to whole continent.
mateus1 9y ago
Brazilian here, I probably check Whatsapp +50 times a day and I'm not a heavy user.
anonu 9y ago
I think there's more than 1.3 billion users on WhatsApp - its massive - I am personally checking it constantly (> once an hour) It's certainly a more popular app outside of the USA. They initially gained traction because they were willing to make apps for things other than iphones and androids - which gave them a huge following in the developing world where people may still use 10+ year old candy bars.
- ohmicmann 9y ago
  This is so true. Where I live most of people started using Whatsapp on old Nokia phones running SymbianOS. It was one of the few decent apps available.
- deleted 9y ago
  [deleted]

vikascoder 9y ago

So you can track someones online log times using WhatsApp last seen feature? Thats the most shocking thing I have heard all year especially considering this whole thing is as stale as the cheese on the burger in your local dive bar. This should have been written early last year, I think a lot of folks have learned the blue ticks and the online status aspects of whatsapp

youeeeeeediot 9y ago

Always wondered what would happen if someone was to happen to have every valid US/CAN number in their contact list (all 3-4 billion), since WhatsApp doesn't validate you actually know the contact just that you have their phone number.

carroccio 9y ago
They ban your IP. Anyway with some effort you can deanonimize a lot of numbers (eg: status/name/profile photo).
- CommentCard 9y ago
  Is there a known upper limit on the number of #s one account can have? I suppose you could use that limit to set up enough WhatsApp accounts on proxies to effectively have access to all registered #s?
  - tcmb 9y ago
    There's another startup idea.
    - CommentCard 9y ago
      It might be worth doing just so WhatsApp will change how they validate access to #s.
    - ballenf 9y ago
      The idea being you incentive WhatsApp users to install your app that then harvests all their contacts and collates the "last seen" info on all of them. If they delete your app, you setup a proxy to imitate their device and continue the monitoring. Have a privacy policy that is super strong but has a couple "loopholes" that one can drive a truck through. Is that the idea? Seems doable if you're not too risk averse, have no family and live in a country with weak extradition laws. Kidding, there's nothing illegal about any of this stuff or FB, Google and lots of other companies would not be in business. FB would have a civil claim against you -- they paid several billion dollars for the legal right to all that user data!

j_s 9y ago

Stalking Your Friends with Facebook Messenger | https://news.ycombinator.com/item?id=9609286 https://news.ycombinator.com/item?id=9609286 (May 2015, 185 comments) when you send a message from the Messenger app there is an option to send your location with it the mobile app for Facebook Messenger defaults to sending a location with all messages

chis 9y ago
Facebook doesn't do this anymore. http://money.cnn.com/2015/06/04/technology/facebook-messenger-location-tracking-fix/index.html http://money.cnn.com/2015/06/04/technology/facebook-messenge...

squigg 9y ago

I loved this article. It is beautifully written, given both the hacking curiosity on display as well as the real-world privacy impact it demonstrates. Most of my family use whats-app and would be mortified if they actually understood most of this. Not saying they would stop using it, as the trade-off is a great social app, but it would make them think more broadly about how the world is changing.

tcmb 9y ago
Nobody has to stop using WhatsApp, the scenario described in the article can be prevented simply by changing the app's privacy settings.
- polote 9y ago
  Wrong, if you deactivate the feature 'last seen at' it doesn't change anything because you can still get the same information with the feature 'is online now' and this feature can't be deactivated
  - 100ideas 9y ago
    Can't a user just remain logged-in on a second device 24/7?
    - jhasse 9y ago
      IIRC you can't log in from two devices at once with WhatsApp.
  - netsharc 9y ago
    Did he mean change it client-side, or if WhatsApp the company changes this setting to allow more privacy (allow users to hide their status).
  - NasKe 9y ago
    What count as "online"? Using the app? Does the web app also track that? I don't think this is disclosed by facebook, it would be nice to experiment to check it.

option_greek 9y ago

Of course, the elephant in the room is that all this info and much more is with WhatsApp, Facebook, Google and what ever garbage app is installed on your phone. I agree that the article is more about targeted surveillance towards certain users but that is where NSA and secret letters come in :).

jimmies 9y ago

If you trust those """services""" to be secure and trust that they care about your privacy, then you will be betrayed sooner or later, in ways you can't think of -- just like in the article. Fun fact, years ago I accidentally found out that my girlfriend at the time cheated on me on Snapchat, without me actually exploiting anything. She told me to join it with her, telling me that is going to be fun. Snapchat kept track of useds' activity and gamified it to incentivize you by scoring your activity then. Each person has a public activity score when you tap on their profile. One day, I noticed that her Snapchat had more than twice the score that I had. So I clicked on her profile and there it is some strange dude having a score higher than me, it turned out that was her """"ex"""" (I actually never asked her even for his name before, I found out only after that). I never consciously looked for anything, I trusted her 100%, the score was just there on my screen. Thanks Snapchat for their stupid gamification efforts, otherwise I would have wasted more time on her. But since that accident, I never trust proprietary shit that has money to make, ads to sell, governments to please, and incentives to grow, even it says its selling point is to protect your privacy, like Snapchat. It's not about the "end to end encryption" or "finer privacy control" or "only allow when app is in foreground" or "restricted sharing" or "MIT open sauce license" or "export your data" or "only listening to hotwords" or "open APIs," it's about the intent. If the intent was to expand and make money, then all those techs won't be the magic pill that suddenly cures the ill intent. Anyway, privacy my ass, man.

rconti 9y ago
Wait, when you view her profile (as a friend), it shows who has the highest 'score' in terms of contact with her? Wow, that IS a lot of data if they break it down by contact pairs.
- Puer 9y ago
  Snapchat used to publicly display each person's "best friends" list, but not anymore.
- jimmies 9y ago
  Yep. It was called Snapchat score or something. It had a list of top 3 people or so and how much score they had with each other. It was unreal. This was back in spring-summer 2015.

thanatropism 9y ago

I'm increasingly inclined to keep my phone on airplane mode for most of the day. Now, I just need to train people into calling me only between x:00 and x:05. But I don't get many calls anymore, everybody texts...

sqren 9y ago

Very well written article - and I love your drawings! I did a similar story a while back on how you can track your friends sleep patterns using Facebook Messenger [1]. I'm sure there are lots of other services that have this problem, and most users are blissfully unaware. [1] https://medium.com/@sqrendk/how-you-can-use-facebook-to-track-your-friends-sleeping-habits-505ace7fffb6 https://medium.com/@sqrendk/how-you-can-use-facebook-to-trac...

jagjotsingh 9y ago

Loved the article. The increasing pace with the article gives you a rush which was amazing! Very well written.

antirez 9y ago

A few weeks ago there was a similar discussion, and I commented the following: If you think there is no problem, you are wrong. The blog post does not show all the information leaks that this implies. Example: I can modify the script to monitor all the numbers I've in my phone, so that based on the online/offline status in a few weeks I can be able to guess who is having conversations together, discovering cheatings, work affairs, ... EDIT: Practical example. After collecting enough data about user X I create a table about the probability of this user being online in a given few-minutes time ranges. Then I check the online frequency of that user compared to the online statuses of another user Y. If the difference compared to the expected probability is significant, than I can suspect the two are chatting. Another thing I can use is that attivation delay of the online status, since often X sends a message to Y and this results in, a few seconds after, Y to be online, and then the contrary. [then an HN user said she/he was not sure this was serious because maybe the users casually had similar patterns, so I replied:] If you check the model I described in my comment, it should filter the "bus problem", since it will detect a chat only if, compared to the standard "bus time" probability of the user A chatting, it is chatting more if in the same range also B is chatting. If you add to this that people on Whatsapp usually do not talk to the exact minutes, it is definitely possible to create a robust system for guessing with good probability of two have often conversations. Also note that the phone numbers in input are not random, are the ones of a connected circle of persons. Add to this the fact that we can split the ranges even, potentially, by few minutes, and you can even detect interesting stuff for people having continuos chats with multiple persons like teenagers. Another thing that is possible probably is also "groups detection", since at new messages a set of users will activate at the same time. [And the attack can be refined a lot with more powerful mathematical approaches]

polote 9y ago
The thing is, this method works pretty well if people are chatting in real time, if you wait like 10 minutes to answers messages, it is much more difficult to create the links. Moreover if people are using all the time Whatsapp, it is again much more difficult to do. But I agree with you, there are many situations where these could work
- 9y ago

throw2016 9y ago

People avoid thinking too much about things that are working as advertised. How many people wonder about how exactly their cars work or the global financial system works yet they are impacted by both of these. They may reserve curiosity for other things depending on their interests. And here the problem begins, a lot of software engineers seem to conflate this disinterest to stupidity and think this gives them a right to do whatever they want with other people's data. There is a fundamental lack of understanding and respect of other people rights and privacy and an easy dehumanization that is disconnected from human society and the evolution of fundamental rights like like the right to privacy. Regulation will catch up and eventually address this as more people become aware but is a troubling reflection of a large part of the software ecosystem.

janwh 9y ago

Nevermind the clever writing but the issue has been known for years—and beautifully exploited with the selfhostable ready-made solution WhatsSpy Public since Feb 2015: https://gitlab.maikel.pro/maikeldus/WhatsSpy-Public/ https://gitlab.maikel.pro/maikeldus/WhatsSpy-Public/ It's not actively maintained anymore but Maikel deserves some credit for it.

gsich 9y ago
Wanted to post the same. Note that this project used an own client, instead of scraping the webinterface. Which is by far superior, because you don't need an active charged phone and can scale much better. yowsup is still around and working.
kevingrahl 9y ago
Do you happen to know if it’s still working without heavy modifications?
- gsich 9y ago
  Probably not, it used Chat-API [0], but the developer is kind of an asshole. But I admit, people just post stupid issues all the time. However I don't share the developers opinion that this was abused. My friends and I haven't received spam messages on Whatsapp. I admit that may be a small sample size, but still. [0] https://github.com/mgp25/Chat-API https://github.com/mgp25/Chat-API
  - dedmen 9y ago
    I did the same about mid 2015 using yowsup (Python API to Whatsapp). But it's was a private project because of legality concerns of hoarding so much data.

KamogTechs 9y ago

Nice and very well written article,most of my friends use whatsapp and would be mortified if they actually understood most of this.

RobertoG 9y ago
Even without, unfortunately (I'm sure they are wonderful), knowing your friends, I bet you a cookie that they don't care.

JamieF1 9y ago

Reminds me of an article I wrote up about tracking who's talking to who on WhatsApp: https://medium.com/p/finding-out-if-2-people-are-chatting-to-each-other-on-whatsapp-7f13448be665 https://medium.com/p/finding-out-if-2-people-are-chatting-to...

abcdabcd987 9y ago

I think I did almost the same thing three years ago. See: https://www.v2ex.com/t/121272 https://www.v2ex.com/t/121272 (in Chinese only, sorry. I should translate it to English when I'm free)

kyranjamie 9y ago

Enjoyed the article, but my favourite part is the reference to Garth Marenghi's Darkplace in the description.

kzisme 9y ago

Maybe I'm in the minority, but I haven't ever used WhatsApp. Is there a huge benefit to using it over SMS, or something similar?

marindez 9y ago
It's free (unlike SMS or MMS) and back in the day it was the only service that worked reliably on all mobile platforms and didn't use PINs or usernames--just the phone numbers in your contact list so it was plug&play: just install it and you can talk to everybody.
zuppy 9y ago
Group messages don't really work over sms with different device types. Same for attachments, multimedia, location data.
zaat 9y ago
* SMS delivery isn't guaranteed. * SMS don't have read receipt. * SMS depends on cellular connectivity. * SMS and MMS have very limited media transfer support. * SMS don't have feature similar to groups.
- hnaccy 9y ago
  >* SMS don't have read receipt. I feel like this is a pro.
  - zaat 9y ago
    While I can see your point, it really depends on usage purpose and taste. For many this is the most valuable feature of the app.
  - wongarsu 9y ago
    You can disable it in WhatsApp.
- zuppy 9y ago
  > * SMS don't have read receipt. Yes, they do. iPhones don't seem to do that, but old GSM phones did it (like my first phone, Ericsson T20, which got released in 2000). Androids have read reports in the default message app, if I'm not mistaken.

diegorbaquero 9y ago

I made an MVP 2 years ago: https://www.producthunt.com/posts/whatsapp-tracker https://www.producthunt.com/posts/whatsapp-tracker

salqadri 9y ago

Huh; why on Earth does WhatsApp make the default visibility of your "last seen" to "everyone"?! Also, speaking of 'tracking', I'd love to be able to track the sources of fake news forwards, but I assume such a technique would not work for anything like that.

colanderman 9y ago

> Facebook sends data to your browser using straightforward HTTP requests that you can easily write a program to mimic. Shameless plug, I wrote a plugin for Chrome [1] and Firefox [2] to do just that. (Facebook is the opposite of WhatsApp – you can disable your online/offline status, but not your idle time.) [1] https://chrome.google.com/webstore/detail/social-network-chat-idle/ngjiolhcdneedkjhdpeokdahhgohnogo https://chrome.google.com/webstore/detail/social-network-cha... [2] https://addons.mozilla.org/en-US/firefox/addon/social-network-chat-idle/ https://addons.mozilla.org/en-US/firefox/addon/social-networ...

aecorredor 9y ago

Just turn off last seen. Duh.

mnafees 9y ago
https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-feature-dbde54ecf79b https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-... ;)
dedmen 9y ago
If you had read the blogpost you'd know that doesn't help.

antoaravinth 9y ago

I might be wrong here, but what if I change my settings to "not show the last seen status"? I guess in that case this doesn't work. Yes, I believe checking "Online" status frequently does give some information about my activity. Correct me if I'm wrong here.

helloindia 9y ago
I was thinking the same. I haven't seen any of my friend with last seen status enabled.
- slig 9y ago
  If you disable on your account, you can't see the last seen status of your friends, even if they have it enabled.

cl289 9y ago

Just to clarify as a non-user: there's an online status, and a 'last seen' data point, and both can be queried by any user for any user given their telephone number, as often as the querying party likes? And the online status is when the app is open on the phone?

itsyogesh 9y ago
AFAIK If you have them in your contacts and they haven't blocked you, you can access both those data points. If they have disabled last seen, you can still get the the 'online' and 'typing' status.

rajesh004 9y ago

isn't this privacy breach?

HNSucksAss 9y ago

That would require that they use WhatsApp... which none of them does.

mnafees 9y ago

A few days ago I tried to track people on WhatsApp even if their "Last Seen" was hidden. https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-feature-dbde54ecf79b https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-...

jesperlang 9y ago

When stuff like this happen I wonder if we can try to trick the system, overloading it with information, faking things. Couldn't we just somehow make sure we are online all the time (some script pinging the app), then the data would become meaningless..

anfogoat 9y ago

The only issue here is that WhatsApp lets you see the status of people who don't have you as a contact. The rest is utterly underwhelming. One thing I loved about ICQ-esque IM services was that you could clearly see whether a contact was online or not. I still feel weird starting a conversation on WhatsApp because of the lack of clear visual cues of the contact's status.

kinnth 9y ago

Brilliantly written Rob Heaton! Bravo!

samfriedman 9y ago

Similar "online status tracking" has been used for Facebook messenger in the past. I know Facebook removed send-location by default, but I'm not sure if the API still allows pulling online status. https://defaultnamehere.tumblr.com/post/139351766005/graphing-when-your-facebook-friends-are-awake https://defaultnamehere.tumblr.com/post/139351766005/graphin...

bikamonki 9y ago

Whatsapp's opening an API for businesses soon. More abuse on your data. Wait for it.

collyw 9y ago

Just turned that "feature" off in mine. I am glad people point out stuff like this. Is Facebook still spitting out similar crap? I checked the console and there is a reassuring looking message there, but I am not up to date.

dedmen 9y ago

I don't see why people suddenly panic about it.. That's not a new thing. I wrote my own Tracking app over 2 years ago. I still have the code and database laying around. I was using https://github.com/tgalal/yowsup https://github.com/tgalal/yowsup back then. Back then you could even see when people requested your online-status. Meaning you could see when they opened your chat. Back then I used that to see if my message have been read because the message-read notification didn't exist back then.

nebulos 9y ago

Well written.