
Tracking friends and strangers using WhatsApp - robheaton
https://robertheaton.com/2017/10/09/tracking-friends-and-strangers-using-whatsapp/
======
antirez
A few weeks ago there was a similar discussion, and I commented the following:

If you think there is no problem, you are wrong. The blog post does not show
all the information leaks that this implies. Example: I can modify the script
to monitor all the numbers I've in my phone, so that based on the
online/offline status in a few weeks I can be able to guess who is having
conversations together, discovering cheatings, work affairs, ... EDIT:
Practical example. After collecting enough data about user X I create a table
about the probability of this user being online in a given few-minutes time
ranges. Then I check the online frequency of that user compared to the online
statuses of another user Y. If the difference compared to the expected
probability is significant, than I can suspect the two are chatting. Another
thing I can use is that attivation delay of the online status, since often X
sends a message to Y and this results in, a few seconds after, Y to be online,
and then the contrary.

[then an HN user said she/he was not sure this was serious because maybe the
users casually had similar patterns, so I replied:]

If you check the model I described in my comment, it should filter the "bus
problem", since it will detect a chat only if, compared to the standard "bus
time" probability of the user A chatting, it is chatting more if in the same
range also B is chatting. If you add to this that people on Whatsapp usually
do not talk to the exact minutes, it is definitely possible to create a robust
system for guessing with good probability of two have often conversations.
Also note that the phone numbers in input are not random, are the ones of a
connected circle of persons. Add to this the fact that we can split the ranges
even, potentially, by few minutes, and you can even detect interesting stuff
for people having continuos chats with multiple persons like teenagers.
Another thing that is possible probably is also "groups detection", since at
new messages a set of users will activate at the same time.

[And the attack can be refined a lot with more powerful mathematical
approaches]

~~~
anilakar
Once I hacked together a similar program to log the terminal activity of
fellow students on the university UNIX and Linux servers:
[https://github.com/andyn/actspy/blob/master/actspy.c](https://github.com/andyn/actspy/blob/master/actspy.c)

The main objective, however, was not to stalk innocent users but to catch an
anonymous IRC troll who was using an identless shell server in order to hide
their real account name. Every time the troll wrote to IRC, the activity
logger program showed typing activity from a certain user. After a few message
exchanges during quiet night hours I was able to reliably pinpoint them.

~~~
whamlastxmas
So what happened after finding out who it was?

~~~
anilakar
That'll be the boring part of the story. I just /msged her primary nick and
asked nicely if it was possible to stop. Apparently the threat of losing
anonymity is enough to turn trolls back to normal people.

~~~
inetknght
This is, in a nutshell, the secret of the internet.

------
jimmies
If you trust those """services""" to be secure and trust that they care about
your privacy, then you will be betrayed sooner or later, in ways you can't
think of -- just like in the article.

Fun fact, years ago I accidentally found out that my girlfriend at the time
cheated on me on Snapchat, without me actually exploiting anything. She told
me to join it with her, telling me that is going to be fun. Snapchat kept
track of useds' activity and gamified it to incentivize you by scoring your
activity then. Each person has a public activity score when you tap on their
profile. One day, I noticed that her Snapchat had more than twice the score
that I had. So I clicked on her profile and there it is some strange dude
having a score higher than me, it turned out that was her """"ex"""" (I
actually never asked her even for his name before, I found out only after
that). I never consciously looked for anything, I trusted her 100%, the score
was just there on my screen.

Thanks Snapchat for their stupid gamification efforts, otherwise I would have
wasted more time on her. But since that accident, I never trust proprietary
shit that has money to make, ads to sell, governments to please, and
incentives to grow, even it says its selling point is to protect your privacy,
like Snapchat. It's not about the "end to end encryption" or "finer privacy
control" or "only allow when app is in foreground" or "restricted sharing" or
"MIT open sauce license" or "export your data" or "only listening to hotwords"
or "open APIs," it's about the intent. If the intent was to expand and make
money, then all those techs won't be the magic pill that suddenly cures the
ill intent. Anyway, privacy my ass, man.

~~~
rconti
Wait, when you view her profile (as a friend), it shows who has the highest
'score' in terms of contact with her? Wow, that IS a lot of data if they break
it down by contact pairs.

~~~
jimmies
Yep. It was called Snapchat score or something. It had a list of top 3 people
or so and how much score they had with each other. It was unreal.

This was back in spring-summer 2015.

~~~
ReverseCold
Now it shows you the live current location of all your friends, no one I know
has it turned off.

Wth people?

~~~
komali2
This setting doesn't seem to be enabled by default, at least on Android. I
just scrolled into settings > Who can... See My Location >

Found it to be on "ghost mode (only me)." I never touched this setting before.

~~~
jimmies
Only log me, but don't let my friends know: You know your privacy is respected
jack shit when the _least_ intrusive setting is letting the service know and
log you, but not letting your friends know.

The real question isn't that what it sets by default, the question is why that
chat app needs to know and log your location in the first place? Why does it
not only get it and send it when you choose to share? What kind of enhancement
does it give to your fucking """experience""" when it logs your location like
that?

~~~
jimmies
@cassowary, geotagging your photos can be done without logging your location
on the server. It can be done locally. Plus, I thought that Snapchat does not
keep the pictures you've taken? (I have been out of that since then, so I
don't know.)

------
squigg
I loved this article. It is beautifully written, given both the hacking
curiosity on display as well as the real-world privacy impact it demonstrates.
Most of my family use whats-app and would be mortified if they actually
understood most of this. Not saying they would stop using it, as the trade-off
is a great social app, but it would make them think more broadly about how the
world is changing.

~~~
tcmb
Nobody has to stop using WhatsApp, the scenario described in the article can
be prevented simply by changing the app's privacy settings.

~~~
polote
Wrong, if you deactivate the feature 'last seen at' it doesn't change anything
because you can still get the same information with the feature 'is online
now' and this feature can't be deactivated

~~~
NasKe
What count as "online"? Using the app? Does the web app also track that? I
don't think this is disclosed by facebook, it would be nice to experiment to
check it.

~~~
Tijdreiziger
AFAIK, having either the mobile app or web interface in the foreground.

------
janwh
Nevermind the clever writing but the issue has been known for years—and
beautifully exploited with the selfhostable ready-made solution WhatsSpy
Public since Feb 2015: [https://gitlab.maikel.pro/maikeldus/WhatsSpy-
Public/](https://gitlab.maikel.pro/maikeldus/WhatsSpy-Public/) It's not
actively maintained anymore but Maikel deserves some credit for it.

~~~
kevingrahl
Do you happen to know if it’s still working without heavy modifications?

~~~
gsich
Probably not, it used Chat-API [0], but the developer is kind of an asshole.
But I admit, people just post stupid issues all the time. However I don't
share the developers opinion that this was abused. My friends and I haven't
received spam messages on Whatsapp. I admit that may be a small sample size,
but still.

[0] [https://github.com/mgp25/Chat-API](https://github.com/mgp25/Chat-API)

~~~
dedmen
I did the same about mid 2015 using yowsup (Python API to Whatsapp). But it's
was a private project because of legality concerns of hoarding so much data.

------
option_greek
Of course, the elephant in the room is that all this info and much more is
with WhatsApp, Facebook, Google and what ever garbage app is installed on your
phone. I agree that the article is more about targeted surveillance towards
certain users but that is where NSA and secret letters come in :).

------
sqren
Very well written article - and I love your drawings! I did a similar story a
while back on how you can track your friends sleep patterns using Facebook
Messenger [1]. I'm sure there are lots of other services that have this
problem, and most users are blissfully unaware.

[1] [https://medium.com/@sqrendk/how-you-can-use-facebook-to-
trac...](https://medium.com/@sqrendk/how-you-can-use-facebook-to-track-your-
friends-sleeping-habits-505ace7fffb6)

------
colanderman
> Facebook sends data to your browser using straightforward HTTP requests that
> you can easily write a program to mimic.

Shameless plug, I wrote a plugin for Chrome [1] and Firefox [2] to do just
that.

(Facebook is the opposite of WhatsApp – you can disable your online/offline
status, but not your idle time.)

[1] [https://chrome.google.com/webstore/detail/social-network-
cha...](https://chrome.google.com/webstore/detail/social-network-chat-
idle/ngjiolhcdneedkjhdpeokdahhgohnogo)

[2] [https://addons.mozilla.org/en-US/firefox/addon/social-
networ...](https://addons.mozilla.org/en-US/firefox/addon/social-network-chat-
idle/)

------
jesperlang
When stuff like this happen I wonder if we can try to trick the system,
overloading it with information, faking things. Couldn't we just somehow make
sure we are online all the time (some script pinging the app), then the data
would become meaningless..

------
cl289
Just to clarify as a non-user: there's an online status, and a 'last seen'
data point, and both can be queried by any user for any user given their
telephone number, as often as the querying party likes? And the online status
is when the app is open on the phone?

~~~
itsyogesh
AFAIK If you have them in your contacts and they haven't blocked you, you can
access both those data points. If they have disabled last seen, you can still
get the the 'online' and 'typing' status.

------
Havoc
I suspect a fairly small percentage of users is active enough that you get
usable hourly data.

~~~
polote
I agree with you, whatsapp is not like Tinder or Facebook you don't open it
every 2 minutes to check if there is something new.

~~~
raarts
That depends on the country. In the US, people still tend to text a lot, but
in most of Europe, Whatsapp totally replaced texting.

~~~
rconti
Is this because of their still-utterly-broken roaming model? (supposedly to be
remedied soon)

~~~
morsch
Soon was June 2017. But I doubt it has anything to do with roaming. Maybe more
people paid per SMS for a longer time than in the US? I know I still do; I
could add unlimited messages to my monthly contract for 1 EUR or so, but
what's the point.

~~~
rconti
Interesting. My assumption was that Europe was much more okay with pay-per-use
than the US was. It was always strange to someone in the US that a European
would pay different amounts for a call depending on what kind of phone you
were calling, where in the US both parties simply paid for their airtime if
they wanted to use mobile phones.

SMS took off faster in Europe than in the US, but we've had bundled packages
for so long that the individual cost per text wasn't such an issue, and now on
many plans they're unlimited.

I guess the differing cost structure depending on who you're texting and from
where may have spurred the adoption of WhatsApp, whereas in the US, even if
you WERE paying per text, it was the same across a territory of many thousands
of miles and hundreds of millions of people. And, the same way that many folks
in the US do not even have a passport, they tend also not to have a reason to
text internationally. The size and homogeneity of the country benefits the
adoptions of some technologies, but hinders the adoption of others.

------
diegorbaquero
I made an MVP 2 years ago: [https://www.producthunt.com/posts/whatsapp-
tracker](https://www.producthunt.com/posts/whatsapp-tracker)

------
kzisme
Maybe I'm in the minority, but I haven't ever used WhatsApp. Is there a huge
benefit to using it over SMS, or something similar?

~~~
zaat
* SMS delivery isn't guaranteed.

* SMS don't have read receipt.

* SMS depends on cellular connectivity.

* SMS and MMS have very limited media transfer support.

* SMS don't have feature similar to groups.

~~~
hnaccy
>* SMS don't have read receipt.

I feel like this is a pro.

~~~
zaat
While I can see your point, it really depends on usage purpose and taste. For
many this is the most valuable feature of the app.

------
throw2016
People avoid thinking too much about things that are working as advertised.
How many people wonder about how exactly their cars work or the global
financial system works yet they are impacted by both of these. They may
reserve curiosity for other things depending on their interests.

And here the problem begins, a lot of software engineers seem to conflate this
disinterest to stupidity and think this gives them a right to do whatever they
want with other people's data.

There is a fundamental lack of understanding and respect of other people
rights and privacy and an easy dehumanization that is disconnected from human
society and the evolution of fundamental rights like like the right to
privacy. Regulation will catch up and eventually address this as more people
become aware but is a troubling reflection of a large part of the software
ecosystem.

------
salqadri
Huh; why on Earth does WhatsApp make the default visibility of your "last
seen" to "everyone"?! Also, speaking of 'tracking', I'd love to be able to
track the sources of fake news forwards, but I assume such a technique would
not work for anything like that.

------
abcdabcd987
I think I did almost the same thing three years ago. See:
[https://www.v2ex.com/t/121272](https://www.v2ex.com/t/121272) (in Chinese
only, sorry. I should translate it to English when I'm free)

------
youeeeeeediot
Always wondered what would happen if someone was to happen to have every valid
US/CAN number in their contact list (all 3-4 billion), since WhatsApp doesn't
validate you actually _know_ the contact just that you have their phone
number.

~~~
carroccio
They ban your IP. Anyway with some effort you can deanonimize a lot of numbers
(eg: status/name/profile photo).

~~~
CommentCard
Is there a known upper limit on the number of #s one account can have?

I suppose you could use that limit to set up enough WhatsApp accounts on
proxies to effectively have access to all registered #s?

~~~
tcmb
There's another startup idea.

~~~
ballenf
The idea being you incentive WhatsApp users to install your app that then
harvests all their contacts and collates the "last seen" info on all of them.
If they delete your app, you setup a proxy to imitate their device and
continue the monitoring. Have a privacy policy that is super strong but has a
couple "loopholes" that one can drive a truck through.

Is that the idea? Seems doable if you're not too risk averse, have no family
and live in a country with weak extradition laws. Kidding, there's nothing
illegal about any of this stuff or FB, Google and lots of other companies
would not be in business.

FB would have a civil claim against you -- they paid several billion dollars
for the legal right to all that user data!

~~~
CommentCard
You wouldn't need an app or other WhatsApp users beyond your distributed proxy
accounts. You'd be running the monitoring through these proxies.

Creating an app with the sole purpose of backdooring WhatsApp on a user's
phone seems like it'd open you up to a lot of lawsuits. Ethically its a mite
more questionable, but the original article is still unethical in that you're
monitoring people without consent.

Like I said above, I'd do this just so that they'd crack down on it. It's
still a "means justify the ends" argument, however, so you have to be quite
comfortable with moral relativism.

------
dedmen
I don't see why people suddenly panic about it.. That's not a new thing. I
wrote my own Tracking app over 2 years ago. I still have the code and database
laying around. I was using
[https://github.com/tgalal/yowsup](https://github.com/tgalal/yowsup) back
then. Back then you could even see when people requested your online-status.
Meaning you could see when they opened your chat. Back then I used that to see
if my message have been read because the message-read notification didn't
exist back then.

------
thanatropism
I'm increasingly inclined to keep my phone on airplane mode for most of the
day.

Now, I just need to train people into calling me only between x:00 and x:05.
But I don't get many calls anymore, everybody texts...

------
samfriedman
Similar "online status tracking" has been used for Facebook messenger in the
past. I know Facebook removed send-location by default, but I'm not sure if
the API still allows pulling online status.

[https://defaultnamehere.tumblr.com/post/139351766005/graphin...](https://defaultnamehere.tumblr.com/post/139351766005/graphing-
when-your-facebook-friends-are-awake)

------
j_s
Stalking Your Friends with Facebook Messenger |
[https://news.ycombinator.com/item?id=9609286](https://news.ycombinator.com/item?id=9609286)
(May 2015, 185 comments)

 _when you send a message from the Messenger app there is an option to send
your location with it_

 _the mobile app for Facebook Messenger defaults to sending a location with
all messages_

~~~
chis
Facebook doesn't do this anymore.

[http://money.cnn.com/2015/06/04/technology/facebook-
messenge...](http://money.cnn.com/2015/06/04/technology/facebook-messenger-
location-tracking-fix/index.html)

------
anfogoat
The only issue here is that WhatsApp lets you see the status of people who
don't have you as a contact. The rest is utterly underwhelming.

One thing I loved about ICQ-esque IM services was that you could clearly see
whether a contact was online or not. I still feel weird starting a
conversation on WhatsApp because of the lack of clear visual cues of the
contact's status.

------
JamieF1
Reminds me of an article I wrote up about tracking who's talking to who on
WhatsApp: [https://medium.com/p/finding-out-if-2-people-are-chatting-
to...](https://medium.com/p/finding-out-if-2-people-are-chatting-to-each-
other-on-whatsapp-7f13448be665)

------
mnafees
A few days ago I tried to track people on WhatsApp even if their "Last Seen"
was hidden. [https://hackernoon.com/uhoh-did-i-break-whatsapps-last-
seen-...](https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-feature-
dbde54ecf79b)

------
antoaravinth
I might be wrong here, but what if I change my settings to "not show the last
seen status"? I guess in that case this doesn't work. Yes, I believe checking
"Online" status frequently does give some information about my activity.
Correct me if I'm wrong here.

~~~
helloindia
I was thinking the same. I haven't seen any of my friend with last seen status
enabled.

~~~
slig
If you disable on your account, you can't see the last seen status of your
friends, even if they have it enabled.

------
jagjotsingh
Loved the article. The increasing pace with the article gives you a rush which
was amazing!

Very well written.

------
collyw
Just turned that "feature" off in mine. I am glad people point out stuff like
this.

Is Facebook still spitting out similar crap? I checked the console and there
is a reassuring looking message there, but I am not up to date.

------
KamogTechs
Nice and very well written article,most of my friends use whatsapp and would
be mortified if they actually understood most of this.

~~~
RobertoG
Even without, unfortunately (I'm sure they are wonderful), knowing your
friends, I bet you a cookie that they don't care.

------
kyranjamie
Enjoyed the article, but my favourite part is the reference to Garth
Marenghi's Darkplace in the description.

------
bikamonki
Whatsapp's opening an API for businesses soon. More abuse on your data. Wait
for it.

------
kinnth
Brilliantly written Rob Heaton! Bravo!

------
nebulos
Well written.

------
rajesh004
isn't this privacy breach?

------
marindez
What I don't like about WhatsApp is that even if you hide your last connection
time, everybody gets to see whether you're online.

~~~
arunc
I was exactly thinking about this last night. It's bad that WhatsApp doesn't
hide the online status.

------
aecorredor
Just turn off last seen. Duh.

~~~
mnafees
[https://hackernoon.com/uhoh-did-i-break-whatsapps-last-
seen-...](https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-feature-
dbde54ecf79b) ;)

