Wait, does this mean you can get the IP of most people you can contact on whatsapp by just sending them a link and waiting for their phone to check that link?
I can think of plenty of ways this could be abused!
Wait, does this mean you can get the IP of most people you can contact on whatsapp by just sending them a link and waiting for their phone to check that link?
I can think of plenty of ways this could be abused!
You can also get their online/offline state by repeatedly requesting their client re-sends you their profile image, even if they have read receipts turned off.
If you're quick enough, you can see it in action:
Paste a link in a WhatsApp message. The preview might take about half a second to load. Hit 'send' before the preview has loaded, and it'll never show for that message.
Paste the same link again, but wait for the preview before hitting send. It'll stay attached to that message.
Facebook makes one request and then caches the result. Other servers may not store the result.
TL;DR, the app establishes a TLS connection directly between your phone and the site, but routes it through a proxy on Signal's server, thereby hiding your IP without being able to view the URL. I imagine Whatsapp works in a similar fashion