News for hackers. Stuff that matters.
Re:Twitter says an attacker used its API to match usernames ... by what_ever on Wednesday February 05, 2020 @06:11PM (#22251864)
How will apps like Whatsapp work then?
Re:Twitter says an attacker used its API to match usernames ... by diebeforei485 on Wednesday February 05, 2020 @08:44PM (#22252768)
I don't give WhatsApp access to my contacts. Few enough people in my life use it, and they all have different profile pictures.

I find it very weird to find, for example, my boss, or certain specific coworkers, on any social app. I don't want them to be able to find me either. This design decision of giving apps your entire contacts book by default has to die, and individual users need more choice instead.

Re:Twitter says an attacker used its API to match usernames ... by what_ever on Wednesday February 05, 2020 @11:47PM (#22253498)
Whatsapp has 1.5B MAU. I don't think people are interested in adding each and everyone manually. I want to know how that would work for majority of those people and not you personally.
Re:Twitter says an attacker used its API to match usernames ... by u801e on Thursday February 06, 2020 @08:55AM (#22255928)
> I don't think people are interested in adding each and everyone manually.

If they are interested, then they'll find a way.

Re:Twitter says an attacker used its API to match usernames ... by a254613e on Thursday February 06, 2020 @02:05AM (#22254059)
That's great for you, but whatsapp is de facto standard messaging app in a lot of countries. Memorizing hundred numbers, or profile pictures (assuming that everyone has one) is just not feasible.

An app (such as whatsapp) getting access to all contacts is a valid use case, even though it doesn't apply to you.

Re:Twitter says an attacker used its API to match usernames ... by netsharc on Thursday February 06, 2020 @07:54AM (#22255616)
And sadly for him, it doesn't matter anyway, presumably most if not all his friends already uploaded their address books, so WhatsApp already knows his real name and phone number and network of friends...
Re:Twitter says an attacker used its API to match usernames ... by majewsky on Thursday February 06, 2020 @06:46AM (#22255312)
No. When you want to chat with a new person, WA just needs the contact of that single person.
Re:Twitter says an attacker used its API to match usernames ... by funfhander on Wednesday February 05, 2020 @06:21PM (#22251932)
I use WhatsApp without allowing them access to my contacts. I have to just add people's numbers manually and I have to memorize who is who based on # and profile picture (thankfully the people I talk to with WhatsApp all have different area codes).

I don't use Facebook nor Instagram, and I only use WhatsApp for 3 Android users, the rest of the people I talk to I use iMessage.

Re:Twitter says an attacker used its API to match usernames ... by zrm on Wednesday February 05, 2020 @06:48PM (#22252100)
> I use WhatsApp without allowing them access to my contacts.

That appears to be impossible for WhatsApp on Android. Someone wanted me to install it a bit ago, I refused to give it access to my contacts and it refused to do anything else until I did.

So I deleted it and we used Signal instead.

Re:Twitter says an attacker used its API to match usernames ... by londons_explore on Thursday February 06, 2020 @02:45AM (#22254252)
It is possible on Android, but if you do, you can't initiate any conversation - the remote party has to speak first.
Re:Twitter says an attacker used its API to match usernames ... by zrm on Thursday February 06, 2020 @11:25AM (#22257339)
We did try that and it supposedly claimed to the other party that I didn't have the app installed. Not that that would have been a scalable solution anyway, since then no pair of people could use it unless one of them gave it all their contacts.

Meanwhile the option remains available to use a different app that doesn't behave that way.

Re:Twitter says an attacker used its API to match usernames ... by what_ever on Wednesday February 05, 2020 @11:48PM (#22253502)
So why should iMessage get all of your contacts by default?
Re:Twitter says an attacker used its API to match usernames ... by funfhander on Thursday February 06, 2020 @12:11AM (#22253581)
I made the choice for Apple to have my contacts by buying an iPhone. If I didn't want Apple to have my contacts (as I do not want Google or Facebook to have mine) I would have not bought an iPhone.
Re:Twitter says an attacker used its API to match usernames ... by Diti on Thursday February 06, 2020 @03:59AM (#22254595)
Personally, I made the choice for Apple NOT to have my contacts (by entirely disabling iCloud). The only company I accept handling my contacts is the one I paid (Fastmail).
Re:Twitter says an attacker used its API to match usernames ... by johnebgd on Thursday February 06, 2020 @01:30AM (#22253889)
Apple doesn’t get all your contacts.

Your local Apple device has a messaging app (iMessage) that can see all the contacts on it.

iCloud puts contacts on Apple servers.

Re:Twitter says an attacker used its API to match usernames ... by jrochkind1 on Wednesday February 05, 2020 @06:27PM (#22251968)
Yes, you sound like a very typical whatsapp user, I can see how whatsapp could work fine without contacts access, since most users are like you. 3 total contacts, all with different area codes -- very typical, I don't know why whatsapp even asks for contact access, probably something nefarious.