Hacker News Reader

Comment by _wmd | Hacker News Reader

This is quite a cavalier recommendation for proprietary unaudited (for the public at least) spyware that uploads your phone book to a company participating in PRISM.

View on HN

WhatsApp doesn't upload your phone book. All contact info resolution is done locally.

How does the app figure out another telephone number has a WhatsApp account? How does it fetch profile information for that telephone number without communicating the desire to fetch it to WhatsApp? Perhaps WhatsApp ships their entire profile photo and telephone number database to every phone

There are two things here: a) the app can take a snapshot of your phone book, upload it, associate it with your own WhatsApp account, and then keep the remote version synchronised; and b) the app can periodically perform disparate requests to the central directory server to query the profile information for each number. As far as I know, WhatsApp uses approach b. These two may seem similar but in approach b, WhatsApp the service wouldn't learn of any contact removals. WhatsApp the app would, of course, but the service wouldn't. Now, with some simple filtering and statistics, WhatsApp the service can deduce your phone book with some certainty, but I believe most would agree that it is materially different from actually uploading your phone book.

> Now, with some simple filtering and statistics, WhatsApp the service can deduce your phone book with some certainty, but I believe most would agree that it is materially different from actually uploading your phone book.

No, not really. Both implementations give WhatsApp a complete list of all my contacts. The fact that one of those implementations might not be 100% accurate because of deleted contacts changes nothing - if you're someone who's worried about a third party having your contact list, it doesn't make sense to think "but hey, they don't know I removed $FOO last week, so their list isn't 100% accurate!".

Both implementations mean you'll have to take their word on what they will and won't do with the data, so there's really not much of a practical difference.

The word "participating" there implies intention, which is a lie. Care to re-phrase?

> The PRISM program collects stored internet communications based on demands made to internet companies such as Google Inc. under Section 702 of the FISA Amendments Act of 2008 to turn over any data that match court-approved search terms

I can't imagine it's a simple task for a large company to unintentionally comply with a court demand, there needed to be some wilful choice between attempting to fight it or rolling over

So if you're using literally any messaging app on Android, you're using software by a company cooperating with PRISM?

Yes, and consequently the platform should not (and in practice does not) receive declarations of high security in its default state. Ignoring PRISM, this is true of every major smart phone platform as they all have remote install and update abilities that excepting Android aren't generally straightforward to disable. Argumentum ad populum is not an excuse for doing something even when you know it's wrong.

Reply on news.ycombinator.com