Twitter says an attacker used its API to match usernames to phone numbers

Re:Twitter says an attacker used its API to match usernames ... by funfhander on Wednesday February 05, 2020 @06:21PM (#22251932)

I use WhatsApp without allowing them access to my contacts. I have to just add people's numbers manually and I have to memorize who is who based on # and profile picture (thankfully the people I talk to with WhatsApp all have different area codes).

I don't use Facebook nor Instagram, and I only use WhatsApp for 3 Android users, the rest of the people I talk to I use iMessage.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by zrm on Wednesday February 05, 2020 @06:48PM (#22252100)

> I use WhatsApp without allowing them access to my contacts.

That appears to be impossible for WhatsApp on Android. Someone wanted me to install it a bit ago, I refused to give it access to my contacts and it refused to do anything else until I did.

So I deleted it and we used Signal instead.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by londons_explore on Thursday February 06, 2020 @02:45AM (#22254252)

It is possible on Android, but if you do, you can't initiate any conversation - the remote party has to speak first.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by zrm on Thursday February 06, 2020 @11:25AM (#22257339)

We did try that and it supposedly claimed to the other party that I didn't have the app installed. Not that that would have been a scalable solution anyway, since then no pair of people could use it unless one of them gave it all their contacts.

Meanwhile the option remains available to use a different app that doesn't behave that way.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by what_ever on Wednesday February 05, 2020 @11:48PM (#22253502)

So why should iMessage get all of your contacts by default?

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by funfhander on Thursday February 06, 2020 @12:11AM (#22253581)

I made the choice for Apple to have my contacts by buying an iPhone. If I didn't want Apple to have my contacts (as I do not want Google or Facebook to have mine) I would have not bought an iPhone.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by Diti on Thursday February 06, 2020 @03:59AM (#22254595)

Personally, I made the choice for Apple NOT to have my contacts (by entirely disabling iCloud). The only company I accept handling my contacts is the one I paid (Fastmail).

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by johnebgd on Thursday February 06, 2020 @01:30AM (#22253889)

Apple doesn’t get all your contacts.

Your local Apple device has a messaging app (iMessage) that can see all the contacts on it.

iCloud puts contacts on Apple servers.

[ Parent | on HN ]

Re:Twitter says an attacker used its API to match usernames ... by jrochkind1 on Wednesday February 05, 2020 @06:27PM (#22251968)

Yes, you sound like a very typical whatsapp user, I can see how whatsapp could work fine without contacts access, since most users are like you. 3 total contacts, all with different area codes -- very typical, I don't know why whatsapp even asks for contact access, probably something nefarious.

[ Parent | on HN ]