News for hackers. Stuff that matters.

A comment on Twitter says an attacker used its API to match usernames to phone numbers. Parent comment

Re:Twitter says an attacker used its API to match usernames ... by diebeforei485 on Wednesday February 05, 2020 @08:44PM (#22252768)
I don't give WhatsApp access to my contacts. Few enough people in my life use it, and they all have different profile pictures.

I find it very weird to find, for example, my boss, or certain specific coworkers, on any social app. I don't want them to be able to find me either. This design decision of giving apps your entire contacts book by default has to die, and individual users need more choice instead.

[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by what_ever on Wednesday February 05, 2020 @11:47PM (#22253498)
Whatsapp has 1.5B MAU. I don't think people are interested in adding each and everyone manually. I want to know how that would work for majority of those people and not you personally.
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by u801e on Thursday February 06, 2020 @08:55AM (#22255928)
> I don't think people are interested in adding each and everyone manually.

If they are interested, then they'll find a way.

[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by a254613e on Thursday February 06, 2020 @02:05AM (#22254059)
That's great for you, but whatsapp is de facto standard messaging app in a lot of countries. Memorizing hundred numbers, or profile pictures (assuming that everyone has one) is just not feasible.

An app (such as whatsapp) getting access to all contacts is a valid use case, even though it doesn't apply to you.

[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by netsharc on Thursday February 06, 2020 @07:54AM (#22255616)
And sadly for him, it doesn't matter anyway, presumably most if not all his friends already uploaded their address books, so WhatsApp already knows his real name and phone number and network of friends...
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by majewsky on Thursday February 06, 2020 @06:46AM (#22255312)
No. When you want to chat with a new person, WA just needs the contact of that single person.
[ Parent | on HN ]