TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

“Someone was typing in a URL and WhatsApp was fetching it off my server”

174 pointsby sr2almost 8 years ago

16 comments

mulanderalmost 8 years ago
Hi HN, op here.<p>I posted this not because I was angry on having a GET request sent to my server on a char by char basis. My main concerns were privacy related, since I posted this some additional things came to light:<p>1) This leaks the IP address of the person writing the msg<p>2) When property=&quot;og:image&quot; is used it also leaks the User Agent and Android version [1]<p>3) When presented with invalid headers as a reply it can cause a crash on IOS, which mean this is a potential RCE vector [2]<p>4) It leaks the exact time an URL is typed into a chat<p>5) It&#x27;s on by default, this is the default behavior in E2E encrypted conversations [3]<p>I don&#x27;t use WhatsApp, I found this out by accident as I just have a habit to tail my logs. I know though that Signal doesn&#x27;t do any of this pre-fetching. I am aware this is a &#x27;feature&#x27; but there&#x27;s no place for it when security is involved.<p>[1] <a href="https:&#x2F;&#x2F;twitter.com&#x2F;0xjomo&#x2F;status&#x2F;874585822158352384" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;0xjomo&#x2F;status&#x2F;874585822158352384</a> [2] <a href="https:&#x2F;&#x2F;twitter.com&#x2F;dr4ys3n&#x2F;status&#x2F;874725257722179584" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;dr4ys3n&#x2F;status&#x2F;874725257722179584</a> [3] <a href="https:&#x2F;&#x2F;mastodon.social&#x2F;@rysiek&#x2F;9146943" rel="nofollow">https:&#x2F;&#x2F;mastodon.social&#x2F;@rysiek&#x2F;9146943</a>
评论 #14558355 未加载
thebiglebrewskialmost 8 years ago
Did you all know that chrome does this too? May sound obvious but I always had assumed that nothing is sent until you press enter for some reason (yeah I know, search prediction would be impossible without that). But one day I was type in a path on a test URL and noticing my server getting hit on - every single letter.
评论 #14555999 未加载
评论 #14555898 未加载
评论 #14556508 未加载
评论 #14567590 未加载
code_duckalmost 8 years ago
In order to produce the link preview, probably. As far as why it&#x27;s character by character, I don&#x27;t know, but that doesn&#x27;t seem very sinister to me. Checking URLs letter by letter is sloppy, especially if you&#x27;re not even trying to do auto completion, but it doesn&#x27;t reveal any more information than a complete url could. Anyway, I would think they are expecting people to paste URLs in, not type them.<p>I&#x27;ve written code to fetch sites and give a preview, for a bookmarking bookmarklet. This involves analyzing the html for title and to select best image to represent the page. That of course necessitates retrieving the page, either through the client or server.
评论 #14555790 未加载
emilfihlmanalmost 8 years ago
E: Disregard. Whatsapp is doing exactly what they should be doing. Telegram seems to proxy the requests.<p>Why is no one saying anything about end to end crypto?<p>Whatsapp shouldn&#x27;t be able to see my messages, isn&#x27;t that what they say themselves?
评论 #14555746 未加载
评论 #14555747 未加载
评论 #14555779 未加载
twissalmost 8 years ago
This makes me think of another potential privacy risk: if you paste a URL in WhatsApp, or click Android&#x27;s share button and select WhatsApp, it doesn&#x27;t add a space after the url. Most users are probably aware that they have to add a space, but if they forget, WhatsApp will probably send the first word of the rest of the message to the server. (Similarly if you paste a URL at the start of an already-written message, but maybe that&#x27;s even more contrived.)
Hosheaalmost 8 years ago
Apparently several other messaging apps behave similarly, from the replies in that tweet there were mentions of Facebook Messenger[0] and Telegram[1].<p>[0]<a href="https:&#x2F;&#x2F;pbs.twimg.com&#x2F;media&#x2F;DCRsz7mXUAAEbKK.jpg" rel="nofollow">https:&#x2F;&#x2F;pbs.twimg.com&#x2F;media&#x2F;DCRsz7mXUAAEbKK.jpg</a> [1]<a href="https:&#x2F;&#x2F;pbs.twimg.com&#x2F;media&#x2F;DCSyWs0XcAAQb2N.jpg" rel="nofollow">https:&#x2F;&#x2F;pbs.twimg.com&#x2F;media&#x2F;DCSyWs0XcAAQb2N.jpg</a>
philippzalmost 8 years ago
On the one hand it provides a greater user-experience if Whatsapp can figure out the URL and preview information about the posted URL (like any social network does today, even we do it at STOMT when you attach an URL to your feedback).<p>On the other hand i do not get why they send it after every character. Makes it even faster but creates a bunch of unnecessary requests. Not very user friendly. They could do it after they recognize a finished URL (as soon as there is a space). And as pointed out in the tweets it COULD harms the users privacy.
评论 #14555627 未加载
slikenalmost 8 years ago
Skype scans messages for URLs and downloads them. Microsoft claims is that they are checking for malware, still creepy.
评论 #14558425 未加载
hakcermanialmost 8 years ago
One aspect is the lack of debounce, but also revealing the endusers ip and user agent. They could proxy external link requests via whatsapp servers without breaking end to end encryption. wonder what iMessage does ?!
评论 #14555864 未加载
评论 #14555801 未加载
adad95almost 8 years ago
I believe this Behavior is for information gathering about odata.
joluxalmost 8 years ago
What does Signal do for link previews? Nothing at all?
kaweraalmost 8 years ago
Prefetching a webpage to generate it&#x27;s preview should at least be optional, controlled through user settings.
ythnalmost 8 years ago
Seems like they need debounce? Most JS utility libraries (lodash, etc) have a debounce function...
评论 #14555678 未加载
luisrudgealmost 8 years ago
probably whatsapp web version? it adds some kind of description if you send an url: <a href="https:&#x2F;&#x2F;i.imgur.com&#x2F;Rkl2cZJ.png" rel="nofollow">https:&#x2F;&#x2F;i.imgur.com&#x2F;Rkl2cZJ.png</a>
awqrrealmost 8 years ago
Did that change happen before of after the acquisition by Facebook?
out_of_protocolalmost 8 years ago
Plain creepy. Also, does it produce a lot of traffic?
评论 #14555620 未加载
评论 #14555591 未加载