Microbrowsers Are Everywhere

Re:Microbrowsers Are Everywhere by rocqua on Tuesday December 17, 2019 @08:33AM (#21813244)

>Finally, many platforms - particularly Facebook Messenger and Hangouts use centralized services to request the preview layout. This is in contrast to WhatsApp* and iMessage where you will see one request per user.

Wait, does this mean you can get the IP of most people you can contact on whatsapp by just sending them a link and waiting for their phone to check that link?

I can think of plenty of ways this could be abused!

[ Parent | on HN ]

Re:Microbrowsers Are Everywhere by londons_explore on Tuesday December 17, 2019 @09:27AM (#21813699)

You can get the IP of people on Whatsapp by video calling them and watching the SIP target addresses. They don't even have to answer the call.

You can also get their online/offline state by repeatedly requesting their client re-sends you their profile image, even if they have read receipts turned off.

[ Parent | on HN ]

Re:Microbrowsers Are Everywhere by ec109685 on Tuesday December 17, 2019 @08:53AM (#21813406)

No, it is the sender of the link that performs the link extraction / microbrowsing before sending it over.

[ Parent | on HN ]

Re:Microbrowsers Are Everywhere by notoverthere on Tuesday December 17, 2019 @02:13PM (#21817450)

This. If the link preview fails to load on the sender's device, it'll never appear for either party. The preview is sent along with the message – the receiving device never generates the preview.

If you're quick enough, you can see it in action:

Paste a link in a WhatsApp message. The preview might take about half a second to load. Hit 'send' before the preview has loaded, and it'll never show for that message.

Paste the same link again, but wait for the preview before hitting send. It'll stay attached to that message.

[ Parent | on HN ]

Re:Microbrowsers Are Everywhere by edent on Tuesday December 17, 2019 @08:35AM (#21813260)

No. It is still the WhatsApp server making the request to your website - so you only see the server's IP.

Facebook makes one request and then caches the result. Other servers may not store the result.

[ Parent | on HN ]

Re:Microbrowsers Are Everywhere by will0 on Tuesday December 17, 2019 @08:57AM (#21813429)

[Here's how signal does it](https://hub.packtpub.com/signal-introduces-optional-link-pre...).

TL;DR, the app establishes a TLS connection directly between your phone and the site, but routes it through a proxy on Signal's server, thereby hiding your IP without being able to view the URL. I imagine Whatsapp works in a similar fashion

[ Parent | on HN ]

Re:Microbrowsers Are Everywhere by saagarjha on Tuesday December 17, 2019 @01:18PM (#21816696)

Doesn't that break end-to-end encryption?

[ Parent | on HN ]