Slashdot Mirror
How Whisper Tracks Users Who Don't Share Their Location
blottsie (3618811) writes "On Thursday, the Guardian reported that secret-sharing app Whisper was tracking users' locations even when they opt-out of sharing their location. [See also this earlier, related story.] Whisper has denied the accusations—but this may be a matter of semantics. Whisper allegedly uses an outdated version of GeoIP by MaxMind, which uses your IP address to estimate your location on a map. Whisper's Chad DePue said in a comment on Hacker News that the tool is "so inaccurate as to be laughable," suggesting that determining something as broad as your country or state won't bother the basic user (and he could be right, but what is and isn't an upsetting degree of user information is another argument entirely)."
well, it it was accuracy to the planet, I would not be upset. ... or Uranus.
Unless I had a mistress on Mars
...better delete your Apache logs, lest you be accused of tracking people's "locations."
to a degree I'm upset.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
My connection is on a dynamic IP address. The best any of those services can do is tell you what city my ISP's router is in, and one of the three services tested by iplocation.net (the service pointed to by TFA) managed to get it wrong. And, I'm not the least bit impressed by the claim that the author's location was correct withing 5 miles, as that still leaves anybody looking for you with just over 78.5 square miles to search.
Good, inexpensive web hosting
We all know how weak those location services are. This isn't really the huge issue some people want it to be.
Whisper isn't about keeping random people from finding you, it's about keeping your friends from finding you. Because if you wanted them to know what you're posting, you'd use Facebook.
And the locations accuracy is very often enough, in conjunction with the content of the message, to reasonably suspect someone or even identify them.
Note to Chad: The issue is not how accurate the information is or isn't. This issue is that a truly anonymous service has no need for this information.
If you are providing an anonymous service, then accept the incoming socket, provide the service, and then promptly forget everything about the session. If it is logged, those logs can be requested or outright stolen by the world's TLA's. Even performing a GeoIP lookup without logging it has the potential to leak information from your service that can be collected by mass surveillance and correlated with other information.
Do not collect information that is not relevant to the service being provided. Period.
principles? Wrong planet, buddy. This is business...
“He’s not deformed, he’s just drunk!”
The issue is one of trust.. not tech details. Also, considering the rends it suggests there is no truth in anything related to business and/or gov and/or communications.
Simple.
It also says there is a technical backdoor that allows Whisper to pinpoint the location of users who have declined to share their location with the app, and that Zimmerman and another executive had requested staff to exploit it. But Zimmerman, fuming at the accusations, said such backdoors are "technically impossible."
Nonsense. The word "backdoor" is not really appropriate here, but of course there are methods (and they are very technically possible) to divine someone's location even if they've declined to share it. Geolocation has become astonishingly accurate in areas where ISPs and telcos are selling their subscriber phsyical-to-IP-address data. I'm not talking about the 500-meter resolution mentioned in the article, but the exact address (or coordinates of the exact address) that the subscriber's service is billed to. Geolocation no longer just ties you to a city, IP address alone will get right down to where you're sitting, or where your ISP/telco thinks you're sitting.*
"That was never said by anyone. I have no idea where that quote came from. I have no idea what they're talking about. I have never, ever, ever asked anybody in my life, and would never ask anybody, for information on a user who opted out of user location. That cannot be overemphasized. That is a 100 percent lie."
This seems like deflection and the denial is a bit over the top. The only words in the quote he's talking about are "latitude and longitude." Really, he's never once, even in passing, asked what his team might know about User X or whether they had coordinates for a post from User Y?
He added that no change was made to the app's privacy policy as a response to the Guardian's story.
So the rewording of multiple clauses and the addition of others, just a couple of days after learning of the Guardian article, is all coincidence? Given the fact that the TOS changes specifically address the issues that the Guardian raised, I'm not buying that at all.
You know, I might be tempted to sympathize with Whisper and with Zimmerman but for one fact, the Guardian reporters were there. They saw and heard these things first-hand. They have no reason to fabricate any of this. Paul Lewis in particular has a pretty stellar reputation and I don't see him throwing it away to write a bogus trash piece about some social app. It looks to me like Whisper was caught with their collective pants down, they've since gone and bought a belt, and now they should just own up to it.
* I have a unique situation where I can prove this and reproduce it. I was roommates with a buddy of mine for 8 months up until August, and because I'm a lazy ass and we see each other every day anyway, I haven't changed my address. My Sprint phone service is still billed to that apartment in the Fairmount Park area (Philly). I have Comcast internet at my new apartment in East Falls. I noticed by accident that Google Maps picks up on my old and new addresses and it's repeatable with these steps,
- Disable GPS and wireless on my phone
- Force my cable modem to get a new IP
- Go to Google Maps on my computer, it defaults to the center of Philly based on generic geodata, Google has nothing specific to link me to yet
- Enable wireless on the phone, leave GPS disabled
- Return to Google Maps on my computer 6 or 8 hours later, it now puts me at my old apartment (where Sprint thinks I live). Something on the Android phone has checked in with Google, Google doesn't have good geodata on my Comcast IP, so it apparently grabs my location through the phone's advertising ID which is tied to my Sprint bill at my old apartment.
- Return to Google Maps 24 hours later, it correctly puts me at my new apartment (where Comcast knows I am). Google has received updated, very accurate geodata from Comcast about my IP, I guess they get fresh data every 12 or 24 hours.
All of this while browsing securely, not accepting any Google cookies, not logging into any Google accounts, no GPS or location services are turned on, etc. It's kind of scary how accurate this has become.
Yet another business getting caught lying to their customers. Welcome to the 20th century, A few more famous liers: Google, Apple, Microsoft, Oracle, Adobe, AOL. What a wonderful century we live in wouldn't ya say?
Jack of all trades,master of none
I downloaded and used whisper the day it was released and continued for 6 months to a year.
During that time I watched the community grow. At its onset it was very small and people were nice. One of my first posts was responding to some young Asian woman who disliked the typical phenotype of rounded face and smaller nose and said she was teased often and wished she had more Caucasian features. I explained that the rounded face was definitely attractive to all males and her nose was adorable. She was pretty beautiful and didn't know it. Responded with a happy smiling selfie referencing me.
People traded compliments and helpful advice about their secrets. On weekends we would get drunk and post nudes. Good times.
A few months as a feature on the App Store and a few pervs found it. They assumed it was a dating app. Now instead of nice replies or selfies or clever staged photo responses any woman received dick pics in response. Report them and they would go away sometimes before the op saw them. The community was degenerating but holding on. Whisper implements nudity detection. Beautiful women gone. Dick pics gone. Fine. Fair enough.
Apparently they continued the dick pic onslaught via pm. But at least it wasn't public. Cest la vie.
I started noticing a very angry creepy guy was less than 1 mile from me. Oh, and a drag queen that posted every thought they had. Typically about wanting butt secs and that they had trouble finding a job and, yeah. White boy butt secs. Great 1 mile away. These are my neighbors.
I started going outside less.
Then whisper advertised on Facebook. Suddenly everyone's "secret" was that their significant other was an asshole. The selfies looked like they were missing a chromosome and the replies to genuine secrets were typically pretty mean. Everyone thought it was Instagram and would post pictures of themselves in a bathroom or their food or talk about how much they loved Arby's or mcdonalds or their shoes.
People made up random crap trying to get to the top of the featured or global list. Everyone was a single mom or go America, I'm a soldier or whatever. People would rip off memes and crap you saw on Facebook and throw it up as their own story.
Fame on an anonymous network? What the fuck?
I started reporting them all.Imagine Facebook content mixed with YouTube comments.
On one occasion shortly after my brother's passing I noticed a familiar stripper post something about her kid and then something about cocaine use. I mention my brother had passed because of coke and she responded with "soz not soz". It had gone from trolling to legitimate pieces of human crap. I was done.
The entire time, I was known as a kind and funny guy. I never formed any lasting friendships (not the point) but I hoped that I had gave helpful advice or made someone laugh. My last post was me with a broken nose splint seemingly trying to bite my chihuahua. A goofy moment, but genuine. Something that was incredibly out of place in the new whisper, but classic in the old atmosphere. Highest rated post I ever got. Maybe there were still normal people out there? Oh well. Deleted.
I can only imagine what it is like now.
But all I can say is that if anyone is still using it they're the type of people who would not care one bit about this. They're like morloks at this point.
> My connection is on a dynamic IP address
Except that it's really not that dynamic. In most DHCP environments, the same IP address is re-assigned to the same MAC address until and unless the DHCP lease expires. When a VLAN is renumbered, or someone explicitly clears the DHCP cach from the local servers and forces a renumbering, you get a different IP address. Go read https://www.ietf.org/rfc/rfc2131.txt to get a better understanding, and actually read the manual pages on the "dhcp" software your environment uses.
Of course, silly claims like this are why corporate security managers are so useless. Because they don't bother to actually know the technology, and they are specifically taught to ignore it for reasons of plausible deniability.
This kind of thing is inexcusable. It is clearly unethical and it should be illegal. Think we'll get a law like that passed? No, I mean one that doesn't tie the hands of our friend, the government, whom we must entrust with secret powers to keep us safe. I just mean shady operators like Whisper..., and Google.
Your IP address is as good as a location these days. Because the same IP will have some device on the NAT, your wifes phone, your ChromeBox, your thermostat even, in Android even if you turn off GPS, it still gives Goog permission to have your wifi sourced location which is as good as GPS in resolution except out in the wilds.
Wifi triangulation is as good as GPS and in towns and cities is often better than GPS. But they may also have the GPS signal.
The CLIENT for this information is buying from many sources and can cross link the various pieces of data. So soldiers are reporting abuses of power thinking their anonymous, and their message is read, their IP and time located, another database used to pull up the location from another source (e.g. a VOIP app, a map lookup etc.), another to pull up their phone, another to pull up their ID, their wife, their friends....
This fake 'private' service is one jigsaw piece in a massive $10 billion surveillance operation.
http://yro.slashdot.org/story/...
There are plenty of people that are on a static IP that is tied to the box in the end of the street or a few streets further away. Not only that, but depending on what other characteristics they may find on your usage of the line/IP, they can still tie it to you without reasonable doubt if they have estmated location. Even "some doubt" may be enough for an employer to finger out you are behind something and things could cost you your job.
I was promised a flying car. Where is my flying car?
I've worked with MaxMind stuff on mobile IP location - as they guy says it's pretty useless. If the user is on wifi it's not too bad, at least the IPv4 stuff could pretty reliably get the state and often city. I never had any luck with IPv6 although they claim to support it better now.
The big kicker is if the user is on cellular - at least in the US most cell networks are natively IPv6, and they tunnel connections through giant NAT devices. This leads to two interesting effects - firstly the IPv4 address you see on the server is located at some random data center usually on the other side of the country from the user. Secondly, the IP (and therefore the data center) keeps changing - sometimes multiple times within a few minutes. Doing any kind of tracking leads to a device which appears to keep hopping back and forth between California and Kansas.
This Microsoft Research whitepaper talks more about these issues.
(and before anyone jumps on me for the privacy implications of trying to do this - in my specific case it was tracking devices in an enterprise environment for security purposes and everyone involved had given informed consent)
---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"