7 ms·

How Whisper app tracks ‘anonymous’ users

199 points by blackRust 12y ago

agd 12y ago
So even if you disable the location feature it still tracks your location? I'd be interested what they mean by 'broad location tracking' but I can't imagine that it's consistent with their anonymity claims. e.g. see http://www.nature.com/srep/2013/130325/srep01376/full/srep01376.html http://www.nature.com/srep/2013/130325/srep01376/full/srep01...
- lsiebert 12y ago
  Apparently they use IP address and geolocation in that case, not GPS.
- yva 12y ago
  I'm the author of this paper and I absolutely agree. If you keep identifiers, simply blurring the location isn't enough to address the risks of re-identification (https://twitter.com/yvesalexandre/status/524219573650722817 https://twitter.com/yvesalexandre/status/524219573650722817). Re-identification is a very different risk than the one considered by the UC Santa Barbara researchers in Wang, Gang, et al. "Whispers in the Dark: Analysis of an Anonymous Social Network." (2014).
doe88 12y ago
Note: Whisper app != Open Whisper Systems (Completely unrelated)
- HCIdivision17 12y ago
  I freaked out slightly when I saw the headline. Shame there's so many name collisions like that...
- Strilanc 12y ago
  Doubly confusing because Signal was originally going to be called Whisper [1]. 1: https://whispersystems.org/blog/a-whisper/ https://whispersystems.org/blog/a-whisper/
- secfirstmd 12y ago
  Definitely an important point. I love the work of Open Whisper Systems, Redphone/TextSecure/Signal is brilliant. I hope the completely get the number of users they deserve when they merge under the one brand.
scw 12y ago
> The Guardian witnessed this practice on a three-day visit to the company’s Los Angeles headquarters last month, as part of a trip to explore the possibility of an expanded journalistic relationship with Whisper. So they look to partner, don't like what they see and turn it into a story? Whisper has two problems: violating its users' trust, and letting an external group in without an agreement in place. The Guardian also looks bad flipping this into a lede in my mind.
- pessimizer 12y ago
  >The Guardian also looks bad flipping this into a lede in my mind. The Grauniad would look bad for claiming to be journalists and not reporting on this. edit: really? Journalists, not under any 'off-the-record' or non-disclosure agreements, seek to partner with an app that allows anonymous communication, and finds that it's tracking it's users, storing all information, ignoring opt outs, and funneling information to governments. They shouldn't report this because what? They should report this even if they are not journalists, but have a moral center.
  - secfirstmd 12y ago
    Agreed. The overwhelming public interest was served by The Guardian publishing it.
r0h1n 12y ago
What amazes me is that all of this information came voluntarily from Whisper. >The Guardian visited the Whisper offices to consider the possibility of undertaking other journalistic projects with the company and sent two reporters last month to look in detail at how the app operates. At no stage during the visit were the journalists told they could not report on the information shared with them. What kind of a company invites journalists from a newspaper known for its investigative/muckraking skills, and then hands over their secret sauce along with such gems: >Separately, Whisper has been following a user claiming to be a sex-obsessed lobbyist in Washington DC. The company’s tracking tools allow staff to monitor which areas of the capital the lobbyist visits. “He’s a guy that we’ll track for the rest of his life and he’ll have no idea we’ll be watching him,” the same Whisper executive said. >The Guardian is no longer pursuing a relationship with Whisper. Well, no shit Sherlock!
- opendais 12y ago
  Ya, I wouldn't trust anything that promises security I can't compile myself. Its not perfect but at least there are more eyeballs.
  - pwnna 12y ago
    Random sidenote on this: if everyone have this mentality doesn't mean no one will look at the source? Not sure how to address this, just a random thought.
    - hdevalence 12y ago
      More eyeballs have a good track record -- for instance, since bash is Free Software, many people have looked at it, which is why there have been no recent critical flaws in bash discovered by automated fuzzers.
    - opendais 12y ago
      I tend to look when I run into an issue. So its not "I never look" it is more "I only look when I feel I have to." If you get enough people doing that...well, imo, you'd probably have most "issues" surface as quickly as it would in commercial software ... and you'd have the added advantage of not everyone having a vested interest in obscuring any potential 'issues' that might negatively affect the company. [e.g. A privacy centric company that records addresses? Ouch] The other issue is if you don't own the network, you can't trust the network.
rubyrescue 12y ago
I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app, and it won't appear without some general location. The % of all Whispers which are tagged as somewhere in the middle of Kansas because we don't really know where they are (but we know they are in the US) is very high. This is not a scandal. b) We want to know where a user is in a general sense for things like tracking timezone so when we send pushes we know not to send pushes at 3 in the morning. you'd be surprised how often device timezone may not always match with physical location. c) We use general location to determine things users may be interested in. folks who post in lower manhattan may see different results than people in College Station, TX, over time. d) We have a lot of anti-spam technology, and what IP you posted from, and what country that IP is in, is important. I can't elaborate on this but it's incredibly logical why we would use that information for things like keeping the app from filling with spammy garbage. e) We throw away the IP you used to create the whisper after a brief period of time. 2. We've been working with researchers at a local university to ensure the anonymity around location was such that they couldn't determine groups of whispers from the same user. They contributed to our randomization algorithms and provided suggestions around security. 3. We fuzz location even more than this on write and on reads. We randomize it based on the observer who asks for the location, and we randomize it BEFORE WE SAVE IT TO OUR DATABASE. In other words, we don't actually know where the user was once the whisper is saved, and we can't even tell later. 4. The guardian's reporting that we changed our terms of service in response to the article is beyond silly. I am happy to show a screenshot of the email chain between myself and our lawyers back in July. The entire point of updating the TOS was to make it clearer and easier to read, not to protect ourselves or give ourselves more rights to user data. It takes MONTHS to get things like TOS write for an app like Whisper, and we take it seriously. 5. Edited to add... We just don't have any personally identifiable information. Not name, email, phone number, etc. I can't tell you who a user is without them posting their actual personal information, and in that case, it would be a violation of our terms of service.
- 12y ago
krigi 12y ago
I'm not upset or surprised by this. However, it's not the tracking Whisper and similar apps do that upsets me; it's the trashy content and vituperative gossip produced by their users.
deleted 12y ago
[deleted]
socrates2015 12y ago
The central business model of our tech times is converting data into money. The eternal pressure will be to gather more and more data over time since that will result in more money.
barnaby 12y ago
Aren't Open Source privacy apps more preferable? Shouldn't we all be talking about ChatSecure, Redphone, Textsecure, Mailvelope, Cryptocat, GPG, EnigMail, etc.? And about the companies that offer these programs as a service? While it's not a guarantee of privacy, open source does significantly increase the likelihood that invasions of privacy and security vulnerabilities can be discovered by enthusiasts and journalists. Right? Wouldn't that be preferable when selecting a privacy app?
- kbart 12y ago
  Of course, but common users don't have technical knowledge to know the difference, so they depend purely on marketing and trust (I guess "the safest place on internet" here did it's trick). It's good that mainstream media finally starts paying attention to the privacy, maybe it will make non-technical user to think twice before trusting such bullshit apps/services.
blueskin_ 12y ago
A fool and his privacy are soon parted.
forgottenpass 12y ago
I've always suspected that the standard rationalizations about modern user tracking (not technically PII or assuming your data won't be analyzed outside the aggregate) were feel good nothings. At least I have something concrete to point to now when I say it's all bullshit.
shiven 12y ago
All I have to say is, Thank you Guardian!!! And, oh, screw this app. I wouldn't recommend it to anyone. Or any other claimed secure/anonymous app, that does not have the "Moxie Marlinspike seal of approval"(TM)!
someoneelsetoo 12y ago
Anonymous - no way. A small amount of location tracking + the additional data any agency and many others can easily access will easily identify an individual. I read the UCSB paper referenced by the Whisper CTO - it just said there was a hard problem Whisper was trying to do something about. The paper also said that each user had a permanent GUID. So if I, with my GUID, get on a plane from SFO to (say) Santa Fe on one particular day - the GUID use moving will make it clear I have taken a plane - then the agency (or perhaps my credit card issuer?) will get the candidates for my GUID down to a few hundred at most just from that move and the passenger list (or ticket purchase records). Coupled with my GUID's home city and work city and they probably have me nailed - just like that. Trivial.

199 points by blackRust 12y ago

agd 12y ago

So even if you disable the location feature it still tracks your location? I'd be interested what they mean by 'broad location tracking' but I can't imagine that it's consistent with their anonymity claims. e.g. see http://www.nature.com/srep/2013/130325/srep01376/full/srep01376.html http://www.nature.com/srep/2013/130325/srep01376/full/srep01...

lsiebert 12y ago
Apparently they use IP address and geolocation in that case, not GPS.
yva 12y ago
I'm the author of this paper and I absolutely agree. If you keep identifiers, simply blurring the location isn't enough to address the risks of re-identification (https://twitter.com/yvesalexandre/status/524219573650722817 https://twitter.com/yvesalexandre/status/524219573650722817). Re-identification is a very different risk than the one considered by the UC Santa Barbara researchers in Wang, Gang, et al. "Whispers in the Dark: Analysis of an Anonymous Social Network." (2014).

doe88 12y ago

Note: Whisper app != Open Whisper Systems (Completely unrelated)

HCIdivision17 12y ago
I freaked out slightly when I saw the headline. Shame there's so many name collisions like that...
Strilanc 12y ago
Doubly confusing because Signal was originally going to be called Whisper [1]. 1: https://whispersystems.org/blog/a-whisper/ https://whispersystems.org/blog/a-whisper/
secfirstmd 12y ago
Definitely an important point. I love the work of Open Whisper Systems, Redphone/TextSecure/Signal is brilliant. I hope the completely get the number of users they deserve when they merge under the one brand.

scw 12y ago

> The Guardian witnessed this practice on a three-day visit to the company’s Los Angeles headquarters last month, as part of a trip to explore the possibility of an expanded journalistic relationship with Whisper. So they look to partner, don't like what they see and turn it into a story? Whisper has two problems: violating its users' trust, and letting an external group in without an agreement in place. The Guardian also looks bad flipping this into a lede in my mind.

pessimizer 12y ago
>The Guardian also looks bad flipping this into a lede in my mind. The Grauniad would look bad for claiming to be journalists and not reporting on this. edit: really? Journalists, not under any 'off-the-record' or non-disclosure agreements, seek to partner with an app that allows anonymous communication, and finds that it's tracking it's users, storing all information, ignoring opt outs, and funneling information to governments. They shouldn't report this because what? They should report this even if they are not journalists, but have a moral center.
- secfirstmd 12y ago
  Agreed. The overwhelming public interest was served by The Guardian publishing it.

r0h1n 12y ago

What amazes me is that all of this information came voluntarily from Whisper. >The Guardian visited the Whisper offices to consider the possibility of undertaking other journalistic projects with the company and sent two reporters last month to look in detail at how the app operates. At no stage during the visit were the journalists told they could not report on the information shared with them. What kind of a company invites journalists from a newspaper known for its investigative/muckraking skills, and then hands over their secret sauce along with such gems: >Separately, Whisper has been following a user claiming to be a sex-obsessed lobbyist in Washington DC. The company’s tracking tools allow staff to monitor which areas of the capital the lobbyist visits. “He’s a guy that we’ll track for the rest of his life and he’ll have no idea we’ll be watching him,” the same Whisper executive said. >The Guardian is no longer pursuing a relationship with Whisper. Well, no shit Sherlock!

opendais 12y ago
Ya, I wouldn't trust anything that promises security I can't compile myself. Its not perfect but at least there are more eyeballs.
- pwnna 12y ago
  Random sidenote on this: if everyone have this mentality doesn't mean no one will look at the source? Not sure how to address this, just a random thought.
  - hdevalence 12y ago
    More eyeballs have a good track record -- for instance, since bash is Free Software, many people have looked at it, which is why there have been no recent critical flaws in bash discovered by automated fuzzers.
  - opendais 12y ago
    I tend to look when I run into an issue. So its not "I never look" it is more "I only look when I feel I have to." If you get enough people doing that...well, imo, you'd probably have most "issues" surface as quickly as it would in commercial software ... and you'd have the added advantage of not everyone having a vested interest in obscuring any potential 'issues' that might negatively affect the company. [e.g. A privacy centric company that records addresses? Ouch] The other issue is if you don't own the network, you can't trust the network.

rubyrescue 12y ago

I'm the CTO of Whisper. This is really bad reporting. A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable. for instance, my current IP using our service says "USA", though I'm in Venice, CA. This is hardly a privacy violation, and it's really important for a bunch of reasons: a) The whisper needs to actually appear in the app, and it won't appear without some general location. The % of all Whispers which are tagged as somewhere in the middle of Kansas because we don't really know where they are (but we know they are in the US) is very high. This is not a scandal. b) We want to know where a user is in a general sense for things like tracking timezone so when we send pushes we know not to send pushes at 3 in the morning. you'd be surprised how often device timezone may not always match with physical location. c) We use general location to determine things users may be interested in. folks who post in lower manhattan may see different results than people in College Station, TX, over time. d) We have a lot of anti-spam technology, and what IP you posted from, and what country that IP is in, is important. I can't elaborate on this but it's incredibly logical why we would use that information for things like keeping the app from filling with spammy garbage. e) We throw away the IP you used to create the whisper after a brief period of time. 2. We've been working with researchers at a local university to ensure the anonymity around location was such that they couldn't determine groups of whispers from the same user. They contributed to our randomization algorithms and provided suggestions around security. 3. We fuzz location even more than this on write and on reads. We randomize it based on the observer who asks for the location, and we randomize it BEFORE WE SAVE IT TO OUR DATABASE. In other words, we don't actually know where the user was once the whisper is saved, and we can't even tell later. 4. The guardian's reporting that we changed our terms of service in response to the article is beyond silly. I am happy to show a screenshot of the email chain between myself and our lawyers back in July. The entire point of updating the TOS was to make it clearer and easier to read, not to protect ourselves or give ourselves more rights to user data. It takes MONTHS to get things like TOS write for an app like Whisper, and we take it seriously. 5. Edited to add... We just don't have any personally identifiable information. Not name, email, phone number, etc. I can't tell you who a user is without them posting their actual personal information, and in that case, it would be a violation of our terms of service.

12y ago

krigi 12y ago

I'm not upset or surprised by this. However, it's not the tracking Whisper and similar apps do that upsets me; it's the trashy content and vituperative gossip produced by their users.

deleted 12y ago

[deleted]

socrates2015 12y ago

The central business model of our tech times is converting data into money. The eternal pressure will be to gather more and more data over time since that will result in more money.

barnaby 12y ago

Aren't Open Source privacy apps more preferable? Shouldn't we all be talking about ChatSecure, Redphone, Textsecure, Mailvelope, Cryptocat, GPG, EnigMail, etc.? And about the companies that offer these programs as a service? While it's not a guarantee of privacy, open source does significantly increase the likelihood that invasions of privacy and security vulnerabilities can be discovered by enthusiasts and journalists. Right? Wouldn't that be preferable when selecting a privacy app?

kbart 12y ago
Of course, but common users don't have technical knowledge to know the difference, so they depend purely on marketing and trust (I guess "the safest place on internet" here did it's trick). It's good that mainstream media finally starts paying attention to the privacy, maybe it will make non-technical user to think twice before trusting such bullshit apps/services.

blueskin_ 12y ago

A fool and his privacy are soon parted.

forgottenpass 12y ago

I've always suspected that the standard rationalizations about modern user tracking (not technically PII or assuming your data won't be analyzed outside the aggregate) were feel good nothings. At least I have something concrete to point to now when I say it's all bullshit.

shiven 12y ago

All I have to say is, Thank you Guardian!!! And, oh, screw this app. I wouldn't recommend it to anyone. Or any other claimed secure/anonymous app, that does not have the "Moxie Marlinspike seal of approval"(TM)!

someoneelsetoo 12y ago

Anonymous - no way. A small amount of location tracking + the additional data any agency and many others can easily access will easily identify an individual. I read the UCSB paper referenced by the Whisper CTO - it just said there was a hard problem Whisper was trying to do something about. The paper also said that each user had a permanent GUID. So if I, with my GUID, get on a plane from SFO to (say) Santa Fe on one particular day - the GUID use moving will make it clear I have taken a plane - then the agency (or perhaps my credit card issuer?) will get the candidates for my GUID down to a few hundred at most just from that move and the passenger list (or ticket purchase records). Coupled with my GUID's home city and work city and they probably have me nailed - just like that. Trivial.