Hacker News Reader

Comment by thebiglebrewski | Hacker News Reader

Did you all know that chrome does this too? May sound obvious but I always had assumed that nothing is sent until you press enter for some reason (yeah I know, search prediction would be impossible without that). But one day I was type in a path on a test URL and noticing my server getting hit on - every single letter.

View on HN

Yes, Chrome does it as well, but I expect that as it's a web browser. I know the tradeoffs when browsing the web and expect that my requests will be visible across the Internet. That's just how web browsing works.

However, WhatsApp is selling a solution that is meant to provide privacy. When I write a URL in an SMS, my phone does not try to preemptively retrieve it to display a preview. WhatsApp may be encrypting the message, but it's identifying me to a server while I'm composing it, which is enough to completely destroy any level of privacy or anonymity that I would expect.

Maybe not SMS but newer versions of iMessage will prefetch urls to generate a preview. I don't recall if it happens as you type (like WhatsApp) or after you hit send though.

> WhatsApp is selling a solution that is meant to provide privacy.

Yep you are right. They even tout this in their Security Page.

https://www.whatsapp.com/security/

> WhatsApp's end-to-end encryption ensures only you and the person you're communicating with can read what is sent, and nobody in between, not even WhatsApp. This is because your messages are secured with a lock, and only the recipient and you have the special key needed to unlock and read them.

http://izquotes.com/quotes-pictures/quote-zuck-yeah-so-if-yo...

I suppose that I'm not surprised. You can't audit WhatsApp's source code, and even if you could, you can't guarantee what you're putting on your device matches the source code. Yet another closed source, inherently untrustable system.

Even with open source you don't know what you're putting on your device matches the source code (unless you're part of the 0.00001% that would compile their own mobile apps).

Even if WhatsApp is not about privacy there seems to be a difference here.

Am I misunderstanding, or are these requests happening just because someone is typing a message that happens to contain some string that looks like a URL. At least with a browser, you are entering things that are supposed to ultimately result in HTTP requests.

Some browsers may send what you type in the address bar to a search engine - I know that Chrome does. So again, I wouldn't be surprised if this is done - that's what web browsers do. They don't make a claim of providing privacy and security.

Yes, I did know that. The difference is WhatsApp is selling encrypted-onboard privacy. Which is now, prima facie, a lie.

Facebook has literally told courts they can't decrypt WhatApp traffic. I wonder if that court case in Brazil is still pending.

By comparison, no one ever said "There's no way Google could read my search terms".

A more accurate comparison would be regarding Allo.

Oh, cool yeah just pointing it out!

Yeah this is a much bigger deal, for sure, as it's a messaging app - just pointing out similar case in a different application.

You've got me angrily reading the article while asking myself if WatsApp would be stupid enough to lose that mostly won case. (It's in our supreme court, I hope they will announce it illegal to widely block a communication channel and to coerce companies into releasing broken crypto.)

No, WatsApp didn't get informed of what URL you entered on the message. The site owner gets a notice, as does the user's ISP, and a lot of people in between. But WatsApp can not tell what URL was typed.

Yeah but tbh, its still not e2e encrypted. It just means WhatsApp is ignorant.

So they are in the clear legally, but morally, its still dubious to do that given its effectively disclosing what is often a substantial portion of the conversation.

The message contents are e2e encrypted.

And, transmitting an URL usually has no use beyond accessing it. They are doing what the user expects, it's just lacking some communication and power-user tools to override the default behavior.

I'm not sure that's what a user would expect; if anything, I'd think users would expect the opposite, that internet requests potentially with identifying information are not being sent to third parties based on what they've typed into the box without hitting send.

The system is clearly passing message data, not metadata, back to the app servers in the clear. Full stop.

> And, transmitting an URL usually has no use beyond accessing it. They are doing what the user expects, it's just lacking some communication and power-user tools to override the default behavior.

Let us just say there are certain things that can cause legal complications merely accessing it and not reporting it is technically still a crime.

WhatsApp is probably the last entity that I would be worried about reading my message. WhatsApp is trying to sell you a promise where nobody, other than the recipient, can know the content of your messages. Having the owner of a site whose URL is included in a WhatsApp message in real time as it is compose breaks that promise - now the site owner and many more people (DNS server operators, both ISPs at the very least) have information about the content of that message.

If my sleuthing is on point, the case in Brazil is still in progress, with the latest notation on 09/06/2017 (May 9th).

http://www.stf.jus.br/portal/processo/verProcessoAndamento.a...

Yeah, that link prediction stuff is one of the things I turn off immediately after installing a browser.

Contrary to apparently most other commenters, I had no idea! Thanks!

Reply on news.ycombinator.com