Guardian/Whisper
October 16, 2014 10:20 AM Subscribe
Revealed: how Whisper app tracks ‘anonymous’ users
Oh my fucking god. How on earth do you delude yourself into thinking that doing something like this--advertising yourself as a safe place for people to tell anonymous secrets, and then finding ways to make those private secrets public--how do you delude yourself into thinking something like this is ethical?
posted by sciatrix at 10:31 AM on October 16, 2014
posted by sciatrix at 10:31 AM on October 16, 2014
how do you delude yourself into thinking something like this is ethical?
the money?
posted by stinkfoot at 10:34 AM on October 16, 2014 [7 favorites]
the money?
posted by stinkfoot at 10:34 AM on October 16, 2014 [7 favorites]
The Guardian redesign looks like the new Mefi.
posted by marienbad at 10:36 AM on October 16, 2014 [6 favorites]
posted by marienbad at 10:36 AM on October 16, 2014 [6 favorites]
how do you delude yourself into thinking something like this is ethical?
the money?
The NSA Security Letters?
posted by eriko at 10:55 AM on October 16, 2014 [4 favorites]
the money?
The NSA Security Letters?
posted by eriko at 10:55 AM on October 16, 2014 [4 favorites]
Neetzan Zimmerman, the head honcho at Whisper, is currently on Twitter saying The Guardian "will regret" running the story...
posted by sobarel at 10:57 AM on October 16, 2014 [5 favorites]
posted by sobarel at 10:57 AM on October 16, 2014 [5 favorites]
I was glad I deleted it once I realized it was 90% people trying to fool other people into sending naked pictures of themselves. I'm really, really glad I deleted it now. I also got rid of Secret.
posted by codacorolla at 11:01 AM on October 16, 2014
posted by codacorolla at 11:01 AM on October 16, 2014
Frank Warren, founder of Post Secret, had something prescient to say about Whisper a few months ago.
posted by johnnydummkopf at 11:05 AM on October 16, 2014 [3 favorites]
posted by johnnydummkopf at 11:05 AM on October 16, 2014 [3 favorites]
Oh my fucking god. How on earth...do you delude yourself into thinking something like this is ethical?
You...don't? You're just a scumbag?
posted by Diablevert at 11:08 AM on October 16, 2014 [11 favorites]
Neetzan Zimmerman, the head honcho at Whisper, is currently on Twitter saying The Guardian "will regret" running the story...
The Whispers were coming from inside the newsroom?
posted by muddgirl at 11:09 AM on October 16, 2014 [1 favorite]
The Whispers were coming from inside the newsroom?
posted by muddgirl at 11:09 AM on October 16, 2014 [1 favorite]
I wonder if they chose the photos accompanying the article specifically because the guys look like shifty creeps in them or if that's just how they look all the time.
posted by poffin boffin at 11:11 AM on October 16, 2014
posted by poffin boffin at 11:11 AM on October 16, 2014
Neetzan Zimmerman, the head honcho at Whisper, is currently on Twitter saying The Guardian "will regret" running the story...
Yeah, because once they post all the Whispers that came from a Guardian IP address then no one will care about the gross betrayal of trust by Whisper as they'll be too horrified by reading 'stole the last of Dave's teabags' and 'Marie doesn't know it yet but I superglued her phone handset to the phone so when she picks it up she'll pick up the whole phone' and 'always read the Mail but drop it in the bin before i get to work'.
posted by reynir at 11:13 AM on October 16, 2014 [6 favorites]
Yeah, because once they post all the Whispers that came from a Guardian IP address then no one will care about the gross betrayal of trust by Whisper as they'll be too horrified by reading 'stole the last of Dave's teabags' and 'Marie doesn't know it yet but I superglued her phone handset to the phone so when she picks it up she'll pick up the whole phone' and 'always read the Mail but drop it in the bin before i get to work'.
posted by reynir at 11:13 AM on October 16, 2014 [6 favorites]
This just in: calling something "the safest place on the internet" confirmed to be damning with faint praise. Thanks NSA!
posted by mstokes650 at 11:13 AM on October 16, 2014
posted by mstokes650 at 11:13 AM on October 16, 2014
In a way, I'm glad stuff like this keeps happening and poking holes in Silicon Valley's libertarian ethos. Great, we let you run an unregulated app/cab service/hotel service, and look what you fucking did. Enough of these and maybe someone will muster up the cojones to hit them on the nose with a newspaper. (Haha that'll never happen).
posted by Ghostride The Whip at 11:14 AM on October 16, 2014 [10 favorites]
posted by Ghostride The Whip at 11:14 AM on October 16, 2014 [10 favorites]
Whisper later explained that when it wants to establish the location of users who have disabled their geolocation services, the company uses their IP location.If true, that could be exploited.
posted by ChurchHatesTucker at 11:18 AM on October 16, 2014
Whisper's response to the allegations.
Executive summary: no we're not evil, this is all untrue.
Although the response does use the phrase: 'Whisper does, however, surface and curate thematic narratives' so on balance, still evil even if Guardian report untrue.
posted by reynir at 11:24 AM on October 16, 2014 [2 favorites]
Executive summary: no we're not evil, this is all untrue.
Although the response does use the phrase: 'Whisper does, however, surface and curate thematic narratives' so on balance, still evil even if Guardian report untrue.
posted by reynir at 11:24 AM on October 16, 2014 [2 favorites]
How does one surface a thematic narrative? I'm imagining some corporate version of when they harpooned those floaty thingies into the side of the shark in Jaws.
posted by sobarel at 11:28 AM on October 16, 2014 [4 favorites]
posted by sobarel at 11:28 AM on October 16, 2014 [4 favorites]
I have no idea what Whisper is or does, and while it's important to expose this kind of thing, is anybody surprised? Generally-speaking, anonymous things aren't, and anybody who says they "don't store" data is probably lying.
posted by uncleozzy at 11:31 AM on October 16, 2014
posted by uncleozzy at 11:31 AM on October 16, 2014
Any app or service that compels you to hand over the keys to Facebook and/or your email address list in order to participate is Bad News.
I include LinkedIn in that Bad Newseum.
posted by potsmokinghippieoverlord at 11:31 AM on October 16, 2014 [1 favorite]
I include LinkedIn in that Bad Newseum.
posted by potsmokinghippieoverlord at 11:31 AM on October 16, 2014 [1 favorite]
Note that this “Whisper” app and company are not related to Whisper Systems, the company that developed the open-source TextSecure encryption app (or to Open Whisper Systems, the open source group that now maintains it).
posted by mbrubeck at 11:34 AM on October 16, 2014
posted by mbrubeck at 11:34 AM on October 16, 2014
Neetzan Zimmerman, the head honcho at Whisper, is currently on Twitter saying The Guardian "will regret" running the story...
This is hilarious. The implicit threat of blackmail is definitely the appropriate response when trying to convince your users that they can trust you.
posted by almostmanda at 11:38 AM on October 16, 2014 [14 favorites]
This is hilarious. The implicit threat of blackmail is definitely the appropriate response when trying to convince your users that they can trust you.
posted by almostmanda at 11:38 AM on October 16, 2014 [14 favorites]
How do you surface a thematic narrative? I guess you locate it on sonar then circle above it lobbing depth charges over the side until it makes an emergency ascent.
Increasingly, these days, I have a 'This is so tacky I don't want to even give it a second look' alarm that goes off when i read about new social-type services. which klaxon normally sounds in tandem with the "I trust these people with anything of mine because?" sad trombone. Whisper got both, and I'm a bit disturbed that the Graun was thinking of playing with it.
posted by Devonian at 11:43 AM on October 16, 2014 [3 favorites]
Increasingly, these days, I have a 'This is so tacky I don't want to even give it a second look' alarm that goes off when i read about new social-type services. which klaxon normally sounds in tandem with the "I trust these people with anything of mine because?" sad trombone. Whisper got both, and I'm a bit disturbed that the Graun was thinking of playing with it.
posted by Devonian at 11:43 AM on October 16, 2014 [3 favorites]
Their denial is interesting. They keep banging the drum that the service doesn't collect what it deems "personally identifiable information". But they do cop to tracking people geographically to with 500 meters. Isn't that the ballgame?
posted by Diablevert at 11:45 AM on October 16, 2014
posted by Diablevert at 11:45 AM on October 16, 2014
This is creepy.
posted by NSA at 11:48 AM on October 16, 2014 [17 favorites]
posted by NSA at 11:48 AM on October 16, 2014 [17 favorites]
How does anyone delude themselves into thinking that any company anywhere has their best interests at heart?
posted by grumpybear69 at 11:52 AM on October 16, 2014 [4 favorites]
posted by grumpybear69 at 11:52 AM on October 16, 2014 [4 favorites]
How does anyone delude themselves into thinking that any company anywhere has their best interests at heart?
I think saying "hahaha stupid consumers believing a company would adhere to the stated goal that is the only reason anyone uses their service" is maybe misplacing the blame here.
posted by Mrs. Pterodactyl at 11:54 AM on October 16, 2014 [4 favorites]
I think saying "hahaha stupid consumers believing a company would adhere to the stated goal that is the only reason anyone uses their service" is maybe misplacing the blame here.
posted by Mrs. Pterodactyl at 11:54 AM on October 16, 2014 [4 favorites]
How does anyone delude themselves into thinking that any company anywhere has their best interests at heart?
This isn't exactly the question that I have, because since so many people do it, it's obviously not just "lol some people are so stupid amirite". I do often wonder about the social forces that shaped me into a "what? share potentially awful secrets on some rando ap that claims it will not reveal my information? never trust anyone with your secrets, especially not the state or a business!" type of person versus the social forces that have shaped obviously intelligent and successful people into "oh, this ap says that it keeps things secret and doesn't geolocate, that sounds good, and I really need to tell someone about [sensitive thing]" people. It just seems so intuitive to me that if you give someone the power to knife/blackmail/exploit you with only very nebulous legal consequences, that's what they're going to do, no matter what they say - but obviously this is not the typical understanding of the world and it's really hard for me to get my head around that.
posted by Frowner at 12:02 PM on October 16, 2014 [5 favorites]
This isn't exactly the question that I have, because since so many people do it, it's obviously not just "lol some people are so stupid amirite". I do often wonder about the social forces that shaped me into a "what? share potentially awful secrets on some rando ap that claims it will not reveal my information? never trust anyone with your secrets, especially not the state or a business!" type of person versus the social forces that have shaped obviously intelligent and successful people into "oh, this ap says that it keeps things secret and doesn't geolocate, that sounds good, and I really need to tell someone about [sensitive thing]" people. It just seems so intuitive to me that if you give someone the power to knife/blackmail/exploit you with only very nebulous legal consequences, that's what they're going to do, no matter what they say - but obviously this is not the typical understanding of the world and it's really hard for me to get my head around that.
posted by Frowner at 12:02 PM on October 16, 2014 [5 favorites]
I'm not saying that Whisper is in any way in the right - I would argue that their goal of profit put them at ethically questionable odds with their stated goal from the get-go - but seriously: caveat emptor. For-profit enterprises are not your friend.
posted by grumpybear69 at 12:04 PM on October 16, 2014
posted by grumpybear69 at 12:04 PM on October 16, 2014
My prediction:
Whisper data is "fuzzed" within "500 meters of inaccuracy".
-Further Development-
Whisper data not "fuzzed" at all- top levels of organization have access to pinpoint accurate location data.
posted by TheWhiteSkull at 12:04 PM on October 16, 2014 [4 favorites]
Whisper data is "fuzzed" within "500 meters of inaccuracy".
-Further Development-
Whisper data not "fuzzed" at all- top levels of organization have access to pinpoint accurate location data.
posted by TheWhiteSkull at 12:04 PM on October 16, 2014 [4 favorites]
The business model is surveillance and you should never, ever, ever think otherwise.
Though this instance seems especially deceptive and creepy.
posted by phubbard at 12:12 PM on October 16, 2014 [3 favorites]
Though this instance seems especially deceptive and creepy.
posted by phubbard at 12:12 PM on October 16, 2014 [3 favorites]
I have a new project for my White House tour.
posted by ChurchHatesTucker at 12:16 PM on October 16, 2014 [4 favorites]
posted by ChurchHatesTucker at 12:16 PM on October 16, 2014 [4 favorites]
It just seems so intuitive to me that if you give someone the power to knife/blackmail/exploit you with only very nebulous legal consequences, that's what they're going to do, no matter what they say - but obviously this is not the typical understanding of the world and it's really hard for me to get my head around that.
I think most people have the entirely correct understanding that they're too boring and unimportant for anyone at Whisper itself to try and blackmail, and that the people they know in real life who might be enticed to do so are far too technologically inept to obtain Whisper's data. Security through obscurity is a pretty successful strategy, on the whole. Now if there's folks out there like the lobbyist who's Whispering his sexploits, they might prove wrong in their calculations, in that they are big enough fish to be worth the trouble of catching.
posted by Diablevert at 12:31 PM on October 16, 2014
I think most people have the entirely correct understanding that they're too boring and unimportant for anyone at Whisper itself to try and blackmail, and that the people they know in real life who might be enticed to do so are far too technologically inept to obtain Whisper's data. Security through obscurity is a pretty successful strategy, on the whole. Now if there's folks out there like the lobbyist who's Whispering his sexploits, they might prove wrong in their calculations, in that they are big enough fish to be worth the trouble of catching.
posted by Diablevert at 12:31 PM on October 16, 2014
It seems to me that the issue is whether the information is useful for identification or not, and I have a hard time believing that they would be tracking the information if it wasn't.
posted by rhizome at 12:32 PM on October 16, 2014
posted by rhizome at 12:32 PM on October 16, 2014
I think most people have the entirely correct understanding that they're too boring and unimportant for anyone at Whisper itself to try and blackmail, and that the people they know in real life who might be enticed to do so are far too technologically inept to obtain Whisper's data
Maybe this is activist background stuff or maybe it's "being a sad little outcast who was bullied" stuff, but it occurs to me that my understanding has always been "it's not that you're big and important and so on, but that you never know what will trigger investigation, pressure, blackmail, etc, and you never know what is going to become a problem retroactively" - ie, you don't know whether you'll come under investigation because you once had a party which was attended by [dissident person of some kind] or whether there will be some bizarre "let's out all the [people of this persuasion]" thing, or whether it will just be one of those misogynist convulsions where someone is brutally pranking [members of group] at random, or whether something that was very innocent at the time could be made to appear dubious ten years down the road, etc.
Everyone always thinks that they are "not important enough" to get caught up in that stuff unless they're, like, Edward Snowden or someone - it's like thinking that you don't need to worry because you "have nothing to hide". "Not important enough" and "nothing to hide" are always moving targets.
posted by Frowner at 12:44 PM on October 16, 2014 [14 favorites]
Well, let me be clear: I think it's super sketchy that they're lying about this, I'd be mildly freaked out if I was a whisper user who was also a federal government employee, and I think there's plenty of reason for ordinary people to be concerned about what they're doing with this data.
But if you're asking "how can anyone possibly imagine this will be okay" I think the counter is "how can anyone possibly imagine me bitching about my job is going to be of jnterest to anyone at some tech company a million miles away"? The vast majority of people don't happen to attend parties with political dissidents or take part in protest rallies or do much of anything that would put them on law enforcement' radar screen, and so they don't have an ingrained fear of the man.
posted by Diablevert at 12:58 PM on October 16, 2014
But if you're asking "how can anyone possibly imagine this will be okay" I think the counter is "how can anyone possibly imagine me bitching about my job is going to be of jnterest to anyone at some tech company a million miles away"? The vast majority of people don't happen to attend parties with political dissidents or take part in protest rallies or do much of anything that would put them on law enforcement' radar screen, and so they don't have an ingrained fear of the man.
posted by Diablevert at 12:58 PM on October 16, 2014
The Washington Post has an angry reaction by Whisper.
posted by el io at 1:04 PM on October 16, 2014
But Zimmerman, fuming at the accusations, said such backdoors are “technically impossible.”Um, what?
posted by el io at 1:04 PM on October 16, 2014
The supposed CTO of Whisper commented in the Hacker News thread: "This is really bad reporting", "A few notes: 1. we use a legacy maxmind geoip database so we can put the whisper in a general location. that is so inaccurate as to be laughable."
posted by jjwiseman at 1:14 PM on October 16, 2014
posted by jjwiseman at 1:14 PM on October 16, 2014
This is creepy.
posted by NSA
Eponysterical !!
posted by seawallrunner at 1:20 PM on October 16, 2014
posted by NSA
Eponysterical !!
posted by seawallrunner at 1:20 PM on October 16, 2014
I love that British understatement: "The Guardian is no longer pursuing a relationship with Whisper."
posted by twsf at 1:20 PM on October 16, 2014 [1 favorite]
posted by twsf at 1:20 PM on October 16, 2014 [1 favorite]
They are so deluded about what they are doing that they openly described the creepy ways in which they are betraying their users' anonymity and stalking them:
Separately, Whisper has been following a user claiming to be a sex-obsessed lobbyist in Washington DC. The company’s tracking tools allow staff to monitor which areas of the capital the lobbyist visits. “He’s a guy that we’ll track for the rest of his life and he’ll have no idea we’ll be watching him,” the same Whisper executive said.posted by Foci for Analysis at 1:31 PM on October 16, 2014 [3 favorites]
They haven't actually denied any of the claims that the Guardian made re: marketing B2B their ability to track and construct narratives around specific Whisper users, which is in direct contrast with their consumer marketing that Whisper provides users with not just anonymity, but no identity at all.
posted by muddgirl at 1:32 PM on October 16, 2014
posted by muddgirl at 1:32 PM on October 16, 2014
Lest we forget, this is MeFi's Own Whisper.
posted by infinitewindow at 1:38 PM on October 16, 2014 [3 favorites]
posted by infinitewindow at 1:38 PM on October 16, 2014 [3 favorites]
"sex-obsessed lobbyist" narrows it down to what, 5000 people? the capitol isn't a giant dome of whoopee, henry kissinger's "power is an aphrodisiac" notwithstanding?
"you know my uncle, he's as honest as me...
and i'm as honest as a government man can be."
(yes, i've heard them sing it live)
posted by bruce at 2:17 PM on October 16, 2014 [1 favorite]
"you know my uncle, he's as honest as me...
and i'm as honest as a government man can be."
(yes, i've heard them sing it live)
posted by bruce at 2:17 PM on October 16, 2014 [1 favorite]
Sex obsessed lobbyist who happens to visit certain capitol buildings at specific times of the day? Plus any particular identifying remarks he or she makes in their Whispers? Certainly seems like it could be used to narrow down to at least a few candidates.
posted by muddgirl at 2:41 PM on October 16, 2014 [1 favorite]
posted by muddgirl at 2:41 PM on October 16, 2014 [1 favorite]
Call me old-fashioned, but I long for a time when secrets were secrets. There was, however, something delightful about Postsecret when it launched. It was touching and analogue, but the medium through which people interact has changed so much since then that I'm not sure anything on Whisper should even be considered a secret, regardless of their ability to identify people. It feels like just a new flavor of the day form of Facebook like-whoring. Layer in the hundreds of millions of dollars of venture capital and I'm not sure what you have, but it ain't secrets.
posted by milarepa at 3:03 PM on October 16, 2014
posted by milarepa at 3:03 PM on October 16, 2014
My biggest secret? MSG. MSG in everything.
posted by turbid dahlia at 3:15 PM on October 16, 2014 [4 favorites]
posted by turbid dahlia at 3:15 PM on October 16, 2014 [4 favorites]
Some tech start ups are CIA fronts and this is likely one of them.
posted by colie at 3:46 PM on October 16, 2014 [2 favorites]
posted by colie at 3:46 PM on October 16, 2014 [2 favorites]
My biggest secret? I'm always angry.
posted by entropicamericana at 3:58 PM on October 16, 2014 [3 favorites]
posted by entropicamericana at 3:58 PM on October 16, 2014 [3 favorites]
I'm glad stuff like this keeps happening and poking holes in Silicon Valley's libertarian ethos
1. Silicon Valley doesn't have a Libertarian ethos. There are Libertarians in tech, some of them very loud about it, but that's not the same thing.
2. Santa Monica is not Silicon Valley. If you mean tech say tech. If you mean Silicon Valley you mean that area a dozen or so miles south of San Francisco.
posted by aspo at 4:01 PM on October 16, 2014 [2 favorites]
1. Silicon Valley doesn't have a Libertarian ethos. There are Libertarians in tech, some of them very loud about it, but that's not the same thing.
2. Santa Monica is not Silicon Valley. If you mean tech say tech. If you mean Silicon Valley you mean that area a dozen or so miles south of San Francisco.
posted by aspo at 4:01 PM on October 16, 2014 [2 favorites]
Guys, guys, my new startup, SekretLeekr, will NOT, I repeat, NOT compromise user data just to kiss advertiser's asses. We are a sanitary bunch and only give advertisers blowjobs. Also please disregard rumors that we are a CIA front. We are an NSA front.
posted by benzenedream at 5:35 PM on October 16, 2014 [1 favorite]
posted by benzenedream at 5:35 PM on October 16, 2014 [1 favorite]
Whisper CTO says tracking “anonymous” users not a big deal, really
Says Guardian article was “laughable,” then gets schooled by Moxie Marlinspike.
Says Guardian article was “laughable,” then gets schooled by Moxie Marlinspike.
“Based on your own comments here, it sounds like the [Guardian’s] reporting is entirely accurate,” Marlinspike wrote. “You're attempting to justify why you're tracking your users, but you're still tracking them. You've highlighted many of the hard problems in this space: how do you achieve anonymity and unlinkability while doing things like IP hiding, spam filtering, and relevance matching? The issue is that you haven't solved the problems, and are instead suggesting you should get a pass because the problems are hard. It seems simple to me: if you haven't designed something that gives you truly unlinkable anonymity, don't claim to provide it. If you have to track your users to make your app work, don't claim not to track your users.”posted by XMLicious at 4:06 AM on October 17, 2014 [1 favorite]
Marlinspike said that Whisper and apps like it—including the similar Secret unsigned social media app—“end up poisoning the well and confusing users” about privacy, to the detriment of projects like Tor that “are approaching these problems seriously...There's a huge difference between "can't" track and "won't" track. Right now you're claiming "can't," but it sounds like you're squarely in the "won't" category of having your servers "avert their eyes." I think this understandably makes people uneasy, particularly given the data mining direction it sounds like the company is headed.”
the capitol isn't a giant dome of whoopee, henry kissinger's "power is an aphrodisiac" notwithstanding?
As one wag put it, DC is Hollywood for ugly people.
posted by ChurchHatesTucker at 10:19 AM on October 17, 2014
As one wag put it, DC is Hollywood for ugly people.
posted by ChurchHatesTucker at 10:19 AM on October 17, 2014
Neetzan Zimmerman, the head honcho at Whisper, is currently on Twitter saying The Guardian "will regret" running the story...
This is hilarious. The implicit threat of blackmail is definitely the appropriate response when trying to convince your users that they can trust you.
To be unreasonably fair, it's possible he meant, "The Guardian will look stupid and print shame-faced retractions when we demonstrate how wrong their article is."
(Spoiler: The Guardian will not need to print shame-faced retractions.)
posted by straight at 2:31 PM on October 17, 2014
This is hilarious. The implicit threat of blackmail is definitely the appropriate response when trying to convince your users that they can trust you.
To be unreasonably fair, it's possible he meant, "The Guardian will look stupid and print shame-faced retractions when we demonstrate how wrong their article is."
(Spoiler: The Guardian will not need to print shame-faced retractions.)
posted by straight at 2:31 PM on October 17, 2014
Jonathan Zdziarski does some forensics on Whisper for iOS.
posted by rhizome at 7:03 PM on October 17, 2014
posted by rhizome at 7:03 PM on October 17, 2014
« Older 10 Centuries of Music in 4 Minutes | It takes a village Newer »
This thread has been archived and is closed to new comments
posted by muddgirl at 10:28 AM on October 16, 2014 [7 favorites]