Hacker News Reader

Comment by shubhamjain | Hacker News Reader

Lets say I have access to a smartphone and I can do everything on it. So if I am able to pull off all the parameters which are used for password, can I impersonate the cell owner? Whatever complex server side code Whatsapp will use, without password, I think it would only be security through obscurity.

View on HN

Although it's not that easy extracting the password from a WhatsApp installation, it's very much possible. [1] However, since WhatsApp supports only one active session at a time, whenever the second user logs in, the other will be logged out.

[1] https://github.com/shirioko/MissVenom

Unrelated to your comment but relevant: I had my friend's number saved on my phone, but we were not in touch for over an year; one day I installed WhatsApp and saw him there - I pinged him; the response came, "Who the fk are you, you b*d! There is no <my friend's name> here. Go to hell!!".

Turns out my friend had changed the number, so the cell number was released and assigned to another user after few months but WhatsApp on my phone thought it was my friend on the other side.

That was when I knew WhatsApp is not revolutionary, it's just lazy, convenient and famous.

So in other words, you got the exact same response as if you had sent a regular SMS message; I fail to see how that is a problem. Yes, WhatsApp uses your regular phone contacts; much simpler than having to exchange usernames with everyone you want to message on WhatsApp. Is it revolutionary? No, it's a simple, cheap, cross-platform messaging app. It does what it's meant to do, and does it pretty well.

Exactly. I don't see how that shows a shortcoming on WhatsApp's part.

It is because using a location and operator dependant phone number as the main gateway to reach someone is prone to errors and no longer necessary.

Whatsapp using it just show how bad its architecture is.

Reply on news.ycombinator.com