Tracking the WhatsApp habits of random smartphones
jorislacance.fr
jorislacance.fr
I've gone back to using SMS for messaging these days. No more read receipts, no more "last active 10 minutes ago", no more "Alice is nearby!", and no more "you haven't messaged Bob in a while, send a message?".
Sure SMS is insecure, but at least it doesn't drive me insane with all the bullshit of so many messaging apps.
But why use the "last seen" feature, if WhatsApp also has an "online" indicator? Funnily enough, that one can't be disabled and is visible to everyone! That has been criticized for over 5 years now, with no reaction from whatsapp/FB.
There was even a similar tool back in 2016 which used this "online" indicator instead, called WhatsSpy [0]. It's no longer maintained, but you can see screenshots of it on this old German article [1] or you might be able to find English articles as well.
I don't know of any current tool which does this, but I'd guess there are a few out there, since it's so easy to do and can't be prevented.
[0] https://github.com/jorik041/WhatsSpy-Public
[1] https://www.heise.de/security/meldung/WhatsSpy-Beliebige-Wha...
There were quite correlation that I was able to find with basic setup
The results can be quite horrifying as you can predict plethora of things.
- When is someone sleeping.
- When they're working,etc.
- If two person are talking to each other in closed group.
https://maikel.pro/blog/en-whatsapp-privacy-options-are-illu...
Wow, that's legal ? :P Not to mention moral...
Also interesting: The article "Celebrity recognition compared to face search" [0] does actually have a disclaimer:
> Celebrity recognition should not be used in a manner that could result in a negative impact on civil liberties.
Only to then follow up how face search allows for the very same thing with your own face collections, so it's apparently not just reserved to celebrities.
[0] https://docs.aws.amazon.com/rekognition/latest/dg/celebrity-...
I remember that the facebook messenger was leaking the same kind of data and facebook said it's not a bug and didn't change it.
Now, if you tell me that by leaving public my "last seen" date, people can get more data about me (e.g., with whom I talk to), well then yes, I would call that a security issue.
I use WhatsApp with Belgians (I live in Belgium) because SMS's are not free for them, and also for sharing photos because MMS is a mess.
Here is a github repo that implements it, including generating text QR code.
It's quite possible, at least among mutual friends. If you have 2 people you know, who are also friends with each other, who have high correlation of online times, then, it's a signal that they could be talking with each other.
It's also amusing (insert a better verb...) that Facebook probably knows who's dating who based on frequency of messages on Messenger/WhatsApp/Instagram, location data ("It's the 3rd Friday night that their phones are close to each other in some venue"), and if they're on the same WiFi (A few hours later: "Well, it's 1AM, and after an hour of inactivity, James' phone is now connected to Jenny's WiFi, they did have their third date earlier...")
In that case, it is nice to at least visually expose that this information is available to bad actors using custom clients too.
However, this fails as a possible excuse ever since Facebook acquired WhatsApp, given that they have essentially unlimited resources available and could easily implement a privacy proxy to hide this information from clients.
If you have had no interaction with someone, you should first accept a message (and not report it as spam) before this information is shared. Ideally that would be the default as well for the About field and the profile picture.
Another weird decision is that read receipts are not possible to be deactivated in group chats, but there is no explanation for that that I could think of (delivery receipts might be required for faster encryption key ratcheting, but the read status has no significance at all for the protocol).
Now that I think more about it, I could do two things: (1) disable notifications, (2) make it so I disable the blue check and double check and appear offline. It'd effectively simulate logging off.
I'm unsure how you'd do #2 though? There's a permission for background data, wonder if that would be enough? Let me know if you test it!
I'm on Android btw.
The drawback is that this behavior can not be enabled on a per-app basis: either all app synchronize, or none. So I don't have new emails either unless explicitly enabled, or any other similar app. The only thing that still works and notify without requiring the app to be open are text messages and phone calls.
I consider that to be a feature, but other might not.
As long as the app is not open you also won't be shown as online, that only happens when actively using the app.
If one would've come to HN and read the last few months worth of posts you'd come to think that a lot of people from around the world moved to Signal. But then again this is a reminder about how little HN represents compared to the general population's tech choices.
* Messenger for family and some friends * WhatsApp for group chats and most of my friends * SMS for older family members * Signal and Telegram for a select few privacy-conscious friends
And at least one family member uses three of these, and it's a toss-up which one he'll use at any given time.
The only issue I've seen is when I want to add someone who's only WhatsApp to a Signal chat, which has happened maybe twice until they also joined.
Personally I feel good about taking even a small amount of Comms out of Zuckerberg's clutches
When an API always returns the `last_seen` field regardless of who is querying the data, it's very easy to make the mistake to present the data to someone who should not see it.
That's also one of the reasons I think most CRUD APIs use bad practice because they always return all data on a READ and may always store all data on a CREATE or UPDATE.
But.. a company like Facebook should know better. It seems they just don't care.
I agree 100%. If it was a simple hobby project that somebody had hacked together, I'd agree that it might be easily overlooked. When you have thousands of people supposedly working on making privacy a priority etc: not so much.
People like keeping watch on others and Facebook is exploiting that.
It surprised me that only 10% of his random (French) sample is active daily (179/1751=10%). In my contacts, I do see people who have accounts but haven't used it in weeks, but it's not the norm. However, I see lots of people in my contacts who show no info for Last Seen. Is he underestimating how often people configure the privacy setting for Last Seen? Or perhaps there is another factor that determines when Last Seen gets shown?
As he said, starting with 06 numbers are saturated by now and we opened 07 XX... numbers. Thus, 07 numbers are more likely to be fresher et more used by "younger" people. While first 06 could be more used by professional and "older" people
As I said in a previous comments, older generation do not use WhatsApp very much as we had unlimited text message before getting internet on our phones (before iPhone 1). Before Covid, my parents did not use WhatsApp at all while texting daily. They use it now to video call during curfew
I really dearly wish there was one for the online status as well, and I'm glad to have spent my teenage years in a time where SMS was the norm, where neither read receipts nor online status was available. It made for a much more relaxed messaging experience (which iMessage seems to be much better at approximating).
I love that picture of a tweet, instead of an embedded one that takes 1 million years to load after you have scrolled to it, and not before.
I will never, ever, understand the "online" status feature. It is ridiculously invasive and cannot ever be turned off or even hidden from specific contacts. This is a SMS client, not a chat client, and revealing a user's online status is highly problematic both socially and security-wise. I can't help but wonder how many lives this feature has ruined.
(I am talking specifically about the "online" indication, not the "last seen" information, which is also invasive but can be turned off).
and relationships
I have definitely been called out for being online but not replying, so I can easily imagine how that can end up becoming a big drama in some relationships.
I don't remember the online indication, is that only when you're actively using the app? or just if the app is open on your phone? I'm trying to think of a situation where either could ruin someones life but I'm struggling. Maybe if you're trying to avoid someone important to you, but need to talk to someone else on whats app? Could you give an example of what you were thinking?
I do agree I don't particularly like that it's on by default.
> Please note you can't hide your online.
https://faq.whatsapp.com/general/chats/about-last-seen-and-o...
Not sure about desktop clients and not sure about what you mean by "open in the background" in this specific case, but I can answer this for mobile WhatsApp apps specifically. For those, it only tracks when you actually have the app open in your main view.
More specifically, if you just have the app in the background while using some other app, it doesn't count as online. If someone sends you a WhatsApp message and you receive a notification but don't open the app itself, it doesn't count. Only when you actually open the app is when it shows you as being online.
Personally, I agree with you that the simplest solution that would already resolve a ton of those issues is to simply only display your "online" status to those who you have added to your contact list (instead of to literally the entire world).
How does this work - does it leak status or location, messages, contact lists etc? We have a number of folks who are absolutely freaking out over how folks are being killed because of this - can someone walk us through how it leaks all this info?
A quick note that I make my entire calendar public in terms of available times so that folks can schedule their time with me.
I can totally see that happening:
Person X suspects their partner is cheating on them with Person Y. So they start logging every time their partner is online and every time Person Y is online. Person X becomes obsessed with this theory of cheating and discovers a correlation between their online times, concluding that they're being cheated on, so they explode in rage and go kill their partner.
Ruining someone's life might be hyperbole but people certainly notice when the people they're messaging are online. Especially when they send messages and are ignored.
The fact that those two things can't be disabled actually makes me want to use WhatsApp less. I doubt I'm alone in that. Makes me wonder if Facebook's "engagement" stats account for those types of disincentives.
Same in my country, I don't think Americans (or the American tech culture) realise how ubiquitous WhatsApp is in Europe and around the world.
Previous to that, I was in Australia where practically nobody used WhatsApp, favouring iMessage or Facebook messenger.
Messaging app adoption is highly localised.
And you have to do that fir checking messages.
I agree with your comment completely, but isn't this a bit a bit of an exaggeration?
No. Many global south countries like Brazil use WhatsApp instead of sms, and not being able to control what information you push out is therefore dangerous. As someone else wrote in this sub, you don’t need to first ‘friend’ or link with someone on WhatsApp before they can see all your info (like how often and how long someone is online). Stalking and stalkers are more prevalent than you think. Nevermind that the situation is also different depending on your gender (women are stalked and victims of violence more than men).
Also I think a few people here seem really concerned with whether its an SMS or an IM service, but I think that doesn’t matter when you ask instead what’s affordable and accessible to the average person in the global south. I think you’ll find that sms and calls are usually luxuries reserved for the tiny minority in power).
This is going to be a bit off-topic now, but I'd say by violence above only physical violence is meant. If verbal and psychological abuse is included, the balance isn't quite so obvious.
That is a subjective take that's mainly in your head.
WhatsApp is a client for chatting, so it is a chat client. It does not use the SMS network, so it is not an SMS client.
Some countries such as US and France had free SMS services, that enabled it to be used as chat. Other places SMS being costly it was used as a "write ideally one message" functionality, similar to email (which only costs in other ways, in human time, but not in actual bills). You can see this in the design of the Messages app in iPhone for example.
And it is definitely NOT an SMS client. The entire reason it has become so popular is that it does not use SMS. Before WhatsApp - the govt in these countries - supposedly looking out for the common good - allowed telecom carriers (usually giant oligarchs) to charge OBSENE per msg rates.
Fun fact: WhatsApp was initially just that i.e. It showed status of its users online and people started using it to share messages leading up to the development of full-fledged chat app.
We may be from the same country, Where peer pressure to have a WhatsApp account is so high that friends and relatives get offended if you don't have one.
So I have isolated WhatsApp to a android VM, it sends me an encrypted email of the incoming messages, lets know the sender the same and that they need to message me on Signal if expect faster reply[1].
[1] https://abishekmuthian.com/send-and-receive-whatsapp-message...
I believe whatsapp knows how useful this feature is but it will lead to lower usage and they are not rolling out
information age 2.0
That said, I agree it's not good that you can spam strangers phone numbers and see when they're online. I'll be turning off that feature on my phone.