Tracking friends and strangers using WhatsApp

https://robertheaton.com/2017/10/09/tracking-friends-and-strangers-using-whatsapp/

by robheaton • 9 years ago

828 150 9 years ago

Havoc• 9 years ago

I suspect a fairly small percentage of users is active enough that you get usable hourly data.

polote5• 9 years ago

I agree with you, whatsapp is not like Tinder or Facebook you don't open it every 2 minutes to check if there is something new.

koolba• 9 years ago

Do you really check Tinder for new "content" every two minutes?

vegbrasil• 9 years ago

It is in a lot of countries.

raarts• 9 years ago

That depends on the country. In the US, people still tend to text a lot, but in most of Europe, Whatsapp totally replaced texting.

notzorbo32• 9 years ago

That's even worse, because it makes it easier to correlate when two people are Whatsapping with each other. If they both happen to be online at the same time a lot...

poisonarena• 9 years ago

I live in Colombia, before then Mexico, and yes you do check on it every 2 minutes everyone does, at least in Latin America

avip• 9 years ago

That's a per-country thing. There are countries where Whatsapp is the de-facto standard for passing information.

lbebber• 9 years ago

It depends where; in Brazil, for instance, WhatsApp groups are becoming the main social network for a large amount of people—nevermind 1:1 chat.

yoavm• 9 years ago

I guess it really depends where. I believe here, where WhatsApp is pretty much the _only_ method of communication, people most definitely check it every few minutes, and especially before they go to bed.

tcmb3• 9 years ago

Honest question, isn't this what notifications and icon badges are for? It's easy to see if there's anything new without opening the app.

Related question, does WhatsApp send the heartbeat only when I open the app, or every x minutes as long as it has a network connection?

himlion• 9 years ago

In some countries WhatsApp is the main form of communication between friends and people are on it every waking minute.

thedaniel• 9 years ago

I suspect the opposite - given that whatsapp dominates texting in europe, and twice as many people live in europe as the USA (which is upon what i suspect you base your assumption here)

_Tev2• 9 years ago

Oh come on, "whatsapp dominates texting in europe"? You do not know every country ;) Based on my experience it would actually be opposite, but I am not going to extrapolate to whole continent.

mateus1• 9 years ago

Brazilian here, I probably check Whatsapp +50 times a day and I'm not a heavy user.

anonu• 9 years ago

I think there's more than 1.3 billion users on WhatsApp - its massive - I am personally checking it constantly (> once an hour)

It's certainly a more popular app outside of the USA. They initially gained traction because they were willing to make apps for things other than iphones and androids - which gave them a huge following in the developing world where people may still use 10+ year old candy bars.

ohmicmann• 9 years ago

This is so true. Where I live most of people started using Whatsapp on old Nokia phones running SymbianOS. It was one of the few decent apps available.

youeeeeeediot• 9 years ago

Always wondered what would happen if someone was to happen to have every valid US/CAN number in their contact list (all 3-4 billion), since WhatsApp doesn't validate you actually know the contact just that you have their phone number.

carroccio• 9 years ago

They ban your IP. Anyway with some effort you can deanonimize a lot of numbers (eg: status/name/profile photo).

CommentCard3• 9 years ago

Is there a known upper limit on the number of #s one account can have?

I suppose you could use that limit to set up enough WhatsApp accounts on proxies to effectively have access to all registered #s?

j_s3• 9 years ago

Stalking Your Friends with Facebook Messenger | https://news.ycombinator.com/item?id=9609286 (May 2015, 185 comments)

when you send a message from the Messenger app there is an option to send your location with it

the mobile app for Facebook Messenger defaults to sending a location with all messages

chis• 9 years ago

Facebook doesn't do this anymore.

http://money.cnn.com/2015/06/04/technology/facebook-messenge...

marindez2• 9 years ago

What I don't like about WhatsApp is that even if you hide your last connection time, everybody gets to see whether you're online.

arunc• 9 years ago

I was exactly thinking about this last night. It's bad that WhatsApp doesn't hide the online status.

squigg• 9 years ago

I loved this article. It is beautifully written, given both the hacking curiosity on display as well as the real-world privacy impact it demonstrates. Most of my family use whats-app and would be mortified if they actually understood most of this. Not saying they would stop using it, as the trade-off is a great social app, but it would make them think more broadly about how the world is changing.

tcmb3• 9 years ago

Nobody has to stop using WhatsApp, the scenario described in the article can be prevented simply by changing the app's privacy settings.

polote5• 9 years ago

Wrong, if you deactivate the feature 'last seen at' it doesn't change anything because you can still get the same information with the feature 'is online now' and this feature can't be deactivated

slig2• 9 years ago

AFAIK, it will display that the user is online (i.e: the user is using the app) regardless of the privacy setting.

jxramos• 9 years ago

It takes a real turn towards developer centered humor with the opening line "With even more time on your hands than ever before, you go just a bit mad and start...". Great Deus ex Machina type segue into all out yummy tech craziness he relishes out.

KGIII4• 9 years ago

It sort of reminds me of gonzo-style journalism. I took a look at their other articles, well some of them, and like their style. I'm not sure if it would appeal to a larger audience, but I liked it.

tomfitz• 9 years ago

The author has a few well written pieces. These two are hilarious: https://robertheaton.com/2014/10/25/tales-from-a-san-francis...

https://robertheaton.com/2014/07/14/getting-nothing-done-a-m...

option_greek• 9 years ago

Of course, the elephant in the room is that all this info and much more is with WhatsApp, Facebook, Google and what ever garbage app is installed on your phone. I agree that the article is more about targeted surveillance towards certain users but that is where NSA and secret letters come in :).

jimmies4• 9 years ago

If you trust those """services""" to be secure and trust that they care about your privacy, then you will be betrayed sooner or later, in ways you can't think of -- just like in the article.

Fun fact, years ago I accidentally found out that my girlfriend at the time cheated on me on Snapchat, without me actually exploiting anything. She told me to join it with her, telling me that is going to be fun. Snapchat kept track of useds' activity and gamified it to incentivize you by scoring your activity then. Each person has a public activity score when you tap on their profile. One day, I noticed that her Snapchat had more than twice the score that I had. So I clicked on her profile and there it is some strange dude having a score higher than me, it turned out that was her """"ex"""" (I actually never asked her even for his name before, I found out only after that). I never consciously looked for anything, I trusted her 100%, the score was just there on my screen.

Thanks Snapchat for their stupid gamification efforts, otherwise I would have wasted more time on her. But since that accident, I never trust proprietary shit that has money to make, ads to sell, governments to please, and incentives to grow, even it says its selling point is to protect your privacy, like Snapchat. It's not about the "end to end encryption" or "finer privacy control" or "only allow when app is in foreground" or "restricted sharing" or "MIT open sauce license" or "export your data" or "only listening to hotwords" or "open APIs," it's about the intent. If the intent was to expand and make money, then all those techs won't be the magic pill that suddenly cures the ill intent. Anyway, privacy my ass, man.

rconti4• 9 years ago

Wait, when you view her profile (as a friend), it shows who has the highest 'score' in terms of contact with her? Wow, that IS a lot of data if they break it down by contact pairs.

Puer• 9 years ago

Snapchat used to publicly display each person's "best friends" list, but not anymore.

jimmies4• 9 years ago

Yep. It was called Snapchat score or something. It had a list of top 3 people or so and how much score they had with each other. It was unreal.

This was back in spring-summer 2015.

yinyang_in• 9 years ago

Dude was just curious, what services do you use now ?

thanatropism• 9 years ago

I'm increasingly inclined to keep my phone on airplane mode for most of the day.

Now, I just need to train people into calling me only between x:00 and x:05. But I don't get many calls anymore, everybody texts...

sqren• 9 years ago

Very well written article - and I love your drawings! I did a similar story a while back on how you can track your friends sleep patterns using Facebook Messenger [1]. I'm sure there are lots of other services that have this problem, and most users are blissfully unaware.

[1] https://medium.com/@sqrendk/how-you-can-use-facebook-to-trac...

jagjotsingh• 9 years ago

Loved the article. The increasing pace with the article gives you a rush which was amazing!

Very well written.

antirez2• 9 years ago

A few weeks ago there was a similar discussion, and I commented the following:

If you think there is no problem, you are wrong. The blog post does not show all the information leaks that this implies. Example: I can modify the script to monitor all the numbers I've in my phone, so that based on the online/offline status in a few weeks I can be able to guess who is having conversations together, discovering cheatings, work affairs, ... EDIT: Practical example. After collecting enough data about user X I create a table about the probability of this user being online in a given few-minutes time ranges. Then I check the online frequency of that user compared to the online statuses of another user Y. If the difference compared to the expected probability is significant, than I can suspect the two are chatting. Another thing I can use is that attivation delay of the online status, since often X sends a message to Y and this results in, a few seconds after, Y to be online, and then the contrary.

[then an HN user said she/he was not sure this was serious because maybe the users casually had similar patterns, so I replied:]

If you check the model I described in my comment, it should filter the "bus problem", since it will detect a chat only if, compared to the standard "bus time" probability of the user A chatting, it is chatting more if in the same range also B is chatting. If you add to this that people on Whatsapp usually do not talk to the exact minutes, it is definitely possible to create a robust system for guessing with good probability of two have often conversations. Also note that the phone numbers in input are not random, are the ones of a connected circle of persons. Add to this the fact that we can split the ranges even, potentially, by few minutes, and you can even detect interesting stuff for people having continuos chats with multiple persons like teenagers. Another thing that is possible probably is also "groups detection", since at new messages a set of users will activate at the same time.

[And the attack can be refined a lot with more powerful mathematical approaches]

polote5• 9 years ago

The thing is, this method works pretty well if people are chatting in real time, if you wait like 10 minutes to answers messages, it is much more difficult to create the links.

Moreover if people are using all the time Whatsapp, it is again much more difficult to do.

But I agree with you, there are many situations where these could work

antirez2• 9 years ago

Unfortunately even under much more noise than the Whatsapp activation patterns, we have seen timing attacks working in incredible reliable ways, with the network in the middle adding random delays, and even when the task at hand was to misure very small differences in time. So I guess that if this attack already seems feasible in certain contexts, it can only get much better using more advanced techniques.

amelius• 9 years ago

A similar indirect way can be used to extract information out of Google's database. For example, launch an ad-campaign for any product, directed at people who love cats. Now if people click on the ad and buy the product, you know they must love cats.

thecrazyone4• 9 years ago

This might seem like a brilliant idea, but you'll run out of money before you map all people for all things.

If you have so much money (spit balling here), you could buy google itself I think

There are easier ways to get data on people like their social profiles, and other online breadcrumbs like yelp reviews, any digital footprint really.

Another way is to buy databases of people. People have databases of HNIs, etc that you can purchase. This of course doesn't lend itself to much analysis but if the main purpose was to market to them or something like that, then databases work best :)

j_s3• 9 years ago

Most Tor busts follow a similar pattern, watching both ends of the connection.

There is a real need for a "tor delay" metadata-disruption-as-a-service, where random strangers invoke one another's web callbacks and report back the result in exchange for Bitcoin (Strangers on a Train -style). Someone put it on the block chain and start an ICO!

dx034• 9 years ago

same risk as hosting an exit node. It could take a while convincing police that you obfuscated traffic patterns without any involvement in the crimes they're after. I think most people wouldn't want to take that risk.

kuschku5• 9 years ago

This isn’t just necessarily a problem with WhatsApp. The same applies to IRC, if you set away states.

Even if you don’t set away states, one can simply monitor every channel you’re in, every message you send, and then quickly determine what timezone you’re in, when you sleep, when you’re on vacation, etc.

Here’s an example graph of a user, every dot is a message: https://i.imgur.com/DrgVvVw.png and here one from a user with more regular sleep patterns: https://i.imgur.com/a1xdSqR.png (notice the timezone transition when daylight savings time starts? And notice how the user takes about 2 weeks to adjust?)

KGIII4• 9 years ago

In chat applications, those features were the first to get disabled. As I recall, one of the MSN Messenger features required you to sign in before you disabled it.

Anyhow, I'd disable showing online status, typing status, or automatically changing status based on activity.

This was a decade and a half ago, probably longer. The principle remains the same. No, no I don't want you to know when I'm in front of my computer, typing, or otherwise. If I want to appear online, I'll manually do so.

NeoBasilisk• 9 years ago

Yikes, that second person is almost robotic in their sleep patterns.

thecrazyone4• 9 years ago

wow! I find the images creepy and amazing at the same time :)

PS: It's not so much the images themselves but what they mean i.e. this analysis :)

anilakar2• 9 years ago

Once I hacked together a similar program to log the terminal activity of fellow students on the university UNIX and Linux servers: https://github.com/andyn/actspy/blob/master/actspy.c

The main objective, however, was not to stalk innocent users but to catch an anonymous IRC troll who was using an identless shell server in order to hide their real account name. Every time the troll wrote to IRC, the activity logger program showed typing activity from a certain user. After a few message exchanges during quiet night hours I was able to reliably pinpoint them.

whamlastxmas• 9 years ago

So what happened after finding out who it was?

ycombinete• 9 years ago

Please finish this story.

FractalNerve• 9 years ago

I'm using an xposed mod to continually be online on WhatsApp, even when my phone's screen if off. Would this thwart such attacks? I mean it would be an anomaly, but other than that I don't know what other information you could get, except the last Online/Offline never changing.

It confuses my friends though, who write me more at night times than usually, luckily though I've a DnD mode that saves me from waking up. (confuses gf too)

dedmen3• 9 years ago

I tried to do something like that over 2 years ago. I never got to work on the analyze part of the data. I still have a 2GB database of online/offline, status (text status thingy) and profile picture changes. Someday I'll get back to that data and analyze it.

throw2016• 9 years ago

People avoid thinking too much about things that are working as advertised. How many people wonder about how exactly their cars work or the global financial system works yet they are impacted by both of these. They may reserve curiosity for other things depending on their interests.

And here the problem begins, a lot of software engineers seem to conflate this disinterest to stupidity and think this gives them a right to do whatever they want with other people's data.

There is a fundamental lack of understanding and respect of other people rights and privacy and an easy dehumanization that is disconnected from human society and the evolution of fundamental rights like like the right to privacy. Regulation will catch up and eventually address this as more people become aware but is a troubling reflection of a large part of the software ecosystem.

janwh• 9 years ago

Nevermind the clever writing but the issue has been known for years—and beautifully exploited with the selfhostable ready-made solution WhatsSpy Public since Feb 2015: https://gitlab.maikel.pro/maikeldus/WhatsSpy-Public/ It's not actively maintained anymore but Maikel deserves some credit for it.

gsich4• 9 years ago

Wanted to post the same. Note that this project used an own client, instead of scraping the webinterface. Which is by far superior, because you don't need an active charged phone and can scale much better. yowsup is still around and working.

kevingrahl• 9 years ago

Do you happen to know if it’s still working without heavy modifications?

gsich4• 9 years ago

Probably not, it used Chat-API [0], but the developer is kind of an asshole. But I admit, people just post stupid issues all the time. However I don't share the developers opinion that this was abused. My friends and I haven't received spam messages on Whatsapp. I admit that may be a small sample size, but still.

[0] https://github.com/mgp25/Chat-API

KamogTechs• 9 years ago

Nice and very well written article,most of my friends use whatsapp and would be mortified if they actually understood most of this.

RobertoG• 9 years ago

Even without, unfortunately (I'm sure they are wonderful), knowing your friends, I bet you a cookie that they don't care.

JamieF1• 9 years ago

Reminds me of an article I wrote up about tracking who's talking to who on WhatsApp: https://medium.com/p/finding-out-if-2-people-are-chatting-to...

abcdabcd987• 9 years ago

I think I did almost the same thing three years ago. See: https://www.v2ex.com/t/121272 (in Chinese only, sorry. I should translate it to English when I'm free)

kyranjamie• 9 years ago

Enjoyed the article, but my favourite part is the reference to Garth Marenghi's Darkplace in the description.

kzisme• 9 years ago

Maybe I'm in the minority, but I haven't ever used WhatsApp. Is there a huge benefit to using it over SMS, or something similar?

marindez2• 9 years ago

It's free (unlike SMS or MMS) and back in the day it was the only service that worked reliably on all mobile platforms and didn't use PINs or usernames--just the phone numbers in your contact list so it was plug&play: just install it and you can talk to everybody.

zuppy2• 9 years ago

Group messages don't really work over sms with different device types. Same for attachments, multimedia, location data.

zaat4• 9 years ago

* SMS delivery isn't guaranteed.

* SMS don't have read receipt.

* SMS depends on cellular connectivity.

* SMS and MMS have very limited media transfer support.

* SMS don't have feature similar to groups.

hnaccy• 9 years ago

* SMS don't have read receipt.

I feel like this is a pro.

zuppy2• 9 years ago

* SMS don't have read receipt.

Yes, they do. iPhones don't seem to do that, but old GSM phones did it (like my first phone, Ericsson T20, which got released in 2000). Androids have read reports in the default message app, if I'm not mistaken.

komali22• 9 years ago

I find services like WeChat or Line to be superior based entirely on the fact that you can have an actual username. I'm still not sure why whatsapp forces you to use and exchange long sets of numbers to get someone's contact.

Obviously WeChat is not secure in any way, though ;)

kintamanimatt• 9 years ago

Particularly for those living in Europe, or those that have a lot of international friends - all with phone numbers from different countries - it's a godsend. My phone bill would be ridiculous if I were texting my friends in Sweden or Brazil from my Dutch SIM. iMessage for similar reasons.

Also the group messages are great. My housemates and I all talk via a WhatsApp group. It makes it far easier to hold a coherent group conversation when some of us aren't at home. SMS would be a ballache.

Oh and GIFs, voice messages, and videos can be sent in messages. Free calling too. I can call my friends in Australia for nothing, and it's not a bullshit experience like Skype.

I almost never send true blue SMS any longer.

diegorbaquero• 9 years ago

I made an MVP 2 years ago: https://www.producthunt.com/posts/whatsapp-tracker

salqadri• 9 years ago

Huh; why on Earth does WhatsApp make the default visibility of your "last seen" to "everyone"?! Also, speaking of 'tracking', I'd love to be able to track the sources of fake news forwards, but I assume such a technique would not work for anything like that.

colanderman• 9 years ago

Facebook sends data to your browser using straightforward HTTP requests that you can easily write a program to mimic.

Shameless plug, I wrote a plugin for Chrome [1] and Firefox [2] to do just that.

(Facebook is the opposite of WhatsApp – you can disable your online/offline status, but not your idle time.)

[1] https://chrome.google.com/webstore/detail/social-network-cha...

[2] https://addons.mozilla.org/en-US/firefox/addon/social-networ...

aecorredor• 9 years ago

Just turn off last seen. Duh.

mnafees2• 9 years ago

https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-... ;)

antoaravinth• 9 years ago

I might be wrong here, but what if I change my settings to "not show the last seen status"? I guess in that case this doesn't work. Yes, I believe checking "Online" status frequently does give some information about my activity. Correct me if I'm wrong here.

helloindia• 9 years ago

I was thinking the same. I haven't seen any of my friend with last seen status enabled.

slig2• 9 years ago

If you disable on your account, you can't see the last seen status of your friends, even if they have it enabled.

cl289• 9 years ago

Just to clarify as a non-user: there's an online status, and a 'last seen' data point, and both can be queried by any user for any user given their telephone number, as often as the querying party likes? And the online status is when the app is open on the phone?

itsyogesh• 9 years ago

AFAIK If you have them in your contacts and they haven't blocked you, you can access both those data points. If they have disabled last seen, you can still get the the 'online' and 'typing' status.

rajesh004• 9 years ago

isn't this privacy breach?

mnafees2• 9 years ago

A few days ago I tried to track people on WhatsApp even if their "Last Seen" was hidden. https://hackernoon.com/uhoh-did-i-break-whatsapps-last-seen-...

jesperlang• 9 years ago

When stuff like this happen I wonder if we can try to trick the system, overloading it with information, faking things. Couldn't we just somehow make sure we are online all the time (some script pinging the app), then the data would become meaningless..

anfogoat• 9 years ago

The only issue here is that WhatsApp lets you see the status of people who don't have you as a contact. The rest is utterly underwhelming.

One thing I loved about ICQ-esque IM services was that you could clearly see whether a contact was online or not. I still feel weird starting a conversation on WhatsApp because of the lack of clear visual cues of the contact's status.

kinnth• 9 years ago

Brilliantly written Rob Heaton! Bravo!

samfriedman• 9 years ago

Similar "online status tracking" has been used for Facebook messenger in the past. I know Facebook removed send-location by default, but I'm not sure if the API still allows pulling online status.

https://defaultnamehere.tumblr.com/post/139351766005/graphin...

bikamonki• 9 years ago

Whatsapp's opening an API for businesses soon. More abuse on your data. Wait for it.

collyw• 9 years ago

Just turned that "feature" off in mine. I am glad people point out stuff like this.

Is Facebook still spitting out similar crap? I checked the console and there is a reassuring looking message there, but I am not up to date.

dedmen3• 9 years ago

I don't see why people suddenly panic about it.. That's not a new thing. I wrote my own Tracking app over 2 years ago. I still have the code and database laying around. I was using https://github.com/tgalal/yowsup back then. Back then you could even see when people requested your online-status. Meaning you could see when they opened your chat. Back then I used that to see if my message have been read because the message-read notification didn't exist back then.

nebulos• 9 years ago

Well written.

Tracking friends and strangers using WhatsApp

Related Stories