Hacker News Reader

Comment by chatmasta | Hacker News Reader

This is not a security vulnerability, it’s been documented in the user interface for years. That’s why I have no profile picture and no status. You clearly opt into “everyone” viewing it, and it’s obvious this it is literally anyone, because when you add a new contact, you simply enter their phone number and can see their profile picture and status. It doesn’t take a leap of imagination to enumerate that for the space of valid phone numbers.

View on HN

There is a way to show profile pictures to only contacts. It's a setting.

Yes, and those people didn't get their profile pictures exposed through this phone number enumeration. If they had, then maybe it would have qualified as a security breach.

> Yes, and those people didn't get their profile pictures exposed through this phone number enumeration.

They did and this was not enumeration, did you read post?

The post with the headline “Worldwide enumeration of accounts was possible?”

OK... but it's not phone number enumeration. You need to give it a phone number to check if whatsapp acc is registered for it. So you need to have a collection of phone numbers first. If you have a collection of all phone numebrs in the world then you could enumerate whatsapp accounts.

And yes the pictures were leaked in the process.

It's trivial to enumerate all the phone numbers in the world.

exactly. to claim enumerating phone numbers is a whatsapp bug is stupid. and to say profile pictures were not revealed = not reading tfa.

"The accessible data items used in the study are the same that are public for anyone who knows a user's phone number and consist of: phone number, public keys, timestamps, and, if set to public, about text and profile picture." Source: TFA, which I read.

From my understanding the accessible data items meant they got them through the bug? Maybe I read wrong

Reply on news.ycombinator.com