Gotta love the osint skills 💯

If you use WhatsApp, assume your number is already in someone's database.
Source: www.wired.com/story/a-simp...

What you can do NOW: Go to WhatsApp Settings > Privacy and set your profile photo, about info, and status to "My Contacts" or "Nobody." This won't hide your number, but it limits what strangers can see. This is recommended as well for platforms like Telegram & Signal.

Meta's response? They thanked the researchers and called it "basic publicly available information." They fixed rate limiting in October 2024, but provided no evidence they stopped malicious actors from doing the same scraping over the years...

Who's at risk? Scammers of course have a goldmine. But worse: researchers found 2.3M WhatsApp numbers in China & 1.6M in Myanmar...countries where the app is banned. Governments could hunt down users. People in China have been detained just for having WhatsApp installed.

Not only numbers were exposed. 57% of accounts had profile photos, 29% had public bio text. In India, 62% had exposed photos. In Brazil, 61% had photos exposed. Most users don't enable privacy settings (More on this soon...)

A researcher warned WhatsApp about this exact vulnerability in 2017. Meta dismissed it, saying privacy settings were "working as designed" Fast forward 8 years later, still vulnerable until October 2024 😅

Here's how simple it was: WhatsApp lets you check if a phone number is registered. Researchers automated this for every possible number combination at ~100 million checks per hour. Meta had ZERO effective rate limiting in place (because why would anyone want that?)

Did he say that? Where did he say that?

The problem with that, too, is if there's a clear enough pattern of life with the phone, you can use the absence of its movement and identification at a second location as probative information.

People radically underestimate the sophistication of OSINT tools that aren't "looking at posts on the internet" and with a few pictures of your location and trajectory through an area, someone could connect you to your device in maybe an hour or so.

Osint? It stands for Open source intelligence. For starters: en.wikipedia.org/wiki/Open-so...

Yes more pls 🙏 How should citizens be intentional and skeptical online as law enforcement and government surveillance expand in “Trump’s America”? How should we be vigilant w encryption and digital hygiene since SSA data, AI, Palantir, and Israeli tech increase risks?

This seems a helpful resource: