Thank HN: WhatsApp Ban Reversed | Hacker News Reader

Thank HN: WhatsApp Ban Reversed

39 pointstempestn19 comments

A couple days ago I posted this thread about my wife's WhatsApp account being randomly banned: https://news.ycombinator.com/item?id=31707349

I'm not sure whether the exposure from the original post helped, but yesterday the ban was reversed with this message:

> Hi, Our system flagged your account activity as a violation of our Terms of Service and banned your phone number. We value you as a user, and apologize for any confusion or inconvenience this may have caused. > After reviewing your account activity, we’ve removed the ban so you should now have access to WhatsApp. As a next step, we recommend re-registering your phone number on WhatsApp to ensure you have access. You can visit our website to download WhatsApp or the WhatsApp Business app. > You can learn more about how to use WhatsApp responsibly in this Help Center article. > Note: We don’t provide support for unsupported apps, devices, or versions of WhatsApp, or jailbroken or rooted devices. Learn more about our supported operating systems in this article. For more information about unofficial apps and why we don’t support these apps, you can refer to this article.

Naturally no explanation of what account activity supposedly triggered the ban, and the bit about how to use WhatsApp responsibly sounds like them implying that something was done wrong, but at least the ban was reversed.

> Note: We don’t provide support for unsupported apps, devices, or versions of WhatsApp, or jailbroken or rooted devices.

Sounds like doing any of these could result in a one-way ticket to getting permabanned. Folks here should consider themselves fairly warned.

A single person being unable to use a communication service can quickly cause an entire group of people to migrate somewhere else. Doubly so if you mess with the technical people who are installing these on their grandma's phone in the first place.

Zealously banning swathes of people is a surefire way to kill your messaging product almost literally over night. People can - and will - change these incredibly quickly. The last messages you'll see on your service will be instructions on how to move to your competitor.

I wouldn't put it past Meta, but it would be really stupid.

> The last messages you'll see on your service will be instructions on how to move to your competitor.

Ah, that old swan song, heard over the ICQ:s and MSN:s from days gone.

Not providing support and banning use are two very different terms. Obviously if you try to connect with oudated version they won't be able to provide you with support, but that doesn't mean they ban you from using the app.

They are indeed different in theory, but the key here is to read between the lines and deduce the practice. :)

WhatsApp is a bit iffy. I prefer Signal over WhatsApp since I read somewhere that people can report your account and have WhatsApp inspect your messages for wrongdoing. Nothing wrong with that per se, but it defeats the purpose of E2E encryption if they do that. There are some edgy memes that people like to share that upset others and people take them too seriously and end up reporting you. Luckily I share memes with a close cadre of friends who would never report me, but if you have 100s of random acquaintances on WhatsApp then your chances of being reported increases.

WhatsApp can't inspect your messages, but they can look at messages another person sends them, including ones from you.

Anyway, if you check the original post, my wife only had a handful of contacts, all family. So some kind of mistake was made, but who knows what. Agreed that Signal is better, but if the people you want to chat with use whatsapp...

> WhatsApp can't inspect your messages

That's what I've always believed too, signal & moxie did their encryption. How do we know that it is true? You can make a pretty strong case with reproduce-able builds, md5 sums on a published client codebase with signal, right? Is that the same for WhatsApp? Sure we might trust Moxie to a certain extent, why not? But even if that's good enough (?) how would we know if whatsapp changed things since? Everyone with commit access will be known to the CIA, NSA, Mossad, Saudi Intelligence, the GRU, MI6 and all the rest including organized crime with a view to compromising things to their advantage somehow.

What they can see are reported messages. The reporter would be responsible for sending the cleartext message being reported. The encryption isn't being broken in this process, but rather the decrypted result is being sent somewhere else. The same problem exists if you screenshot it or copy the text and paste it elsewhere.

Not advocating for WhatsApp or anything, but it's useful to understand what's actually going on to make informed decisions on what apps you use and how they can be used or abused against you. So in this case, WhatsApp is less of a threat actor, and it's more about who you trust with your communications.

Personally, I prefer Signal.

This is pretty obvious to everyone that you can photograph and publish something private and it no longer is private.

This fact has absolutely nothing at all to say about the question raised about how do we know whatsapp encryption is still e2e and trustworthy.

But it's the only response. Sadface.

We can't really know if they broke their implementation of the Signal protocol because it's not open source and the code cannot be reviewed by the public. However, they have openly explained how reporting messages exposes the contents of messages and why it doesn't break the E2EE. All we can do is trust their explanation.

Or, don't. And don't use it. I don't.

So without anyone reaching out to you and finding your wife’s phone number, they just figured out how to reverse the permaban?

Yeah, it's probably not related to the thread; more likely someone with a brain just finally looked at one of the messages she sent rather than sending a form reply denial. Was a bit odd that that happened after explicit notices that the case was closed and no further communication would be read though. Either way, I appreciated the ideas and offers of help in the initial post, and wanted to let anyone interested know it was ultimately reversed.

Or some other engineer detected that some anti-spam tool hand been running incorrectly, and reversed all the decisions it made.

Whatsapp is now a key part of many people's communications. A full ban is unacceptable, because false positives can be costly to the user. A ban should be limited in scope, e.g. so that a "banned" / restricted user can still send messages to people who already have that user as a contact.

Sounds great until your account is compromised and FB refuses to prevent the hacker from mounting a spear-phishing expedition against your friends, family, and co-workers.

This is a great point.

Regulation should start labeling key web services as critical public web infrastructure. Accounts should still be open for access in a locked state when there is a ban. Accounts should have data export properties too. Plus allow for (payable) live monitors to monitor your future use of the account so you can alert your network and close it.

Like Twitter allowing for one last post before suspending, with the closeout tweet available for all future visitors.

Part of that response seems to imply access to the account was attempted with unsupported software. I imagine if someone used a tool to try to brute force the account it might get flagged as something like that. It seems strange to punish an account for attempted unauthorized access, but maybe it's difficult to differentiate the traffic, especially if it's something like trying a leaked password and moving on rather than making repeated attempts that would look very obvious.

I don't think it's related, it's just general disclaimer for everyone to cover all cases.

The thing is they didn't explain why the account was banned, so there is now ay to know what ToS they violated.

Reply on news.ycombinator.com