Security researcher: ‘anonymous’ service Whisper collects data from users
Whisper can indeed track users. Well-known security researcher Jonathan Zdziarski said this on Friday after Whisper denied that this was the case. Whisper did this after a critical article by The Guardian.
Zdziarski joins this in a fierce discussion that arose on Thursday after the publication of the article by The Guardian. The British newspaper wrote that the US Department of Defense, among others, would follow soldiers who express their displeasure via the Whisper app.
According to The Guardian, Whisper can track individual users by storing location data. A mapping tool would be built into the app for that. That tool allegedly allows tracking of Whisper users who allow location sharing using GPS. According to The Guardian, who has disabled the location function can still be found by analyzing IP addresses of WiFi networks.
The British newspaper also reported that the location data is shared with the US Department of Defense via a searchable database. In that database, Whisper would link the locations to messages and times, so that someone who uses the app is no longer anonymous.
Security researcher Zdziarski, who is best known for reporting vulnerabilities in iOS, now confirms after his own research that Whisper links a unique number to each user. According to him, this already happens the moment someone starts the application for the first time. In addition, according to him, the app can indeed find out the location with GPS, up to a distance of less than a hundred meters from the exact location.
Despite the findings, Whisper adamantly denies that it tracks users. In a statement that CEO Neetzan Zimmerman via Twitter on Friday spread, the company makes it clear that as far as Whisper is concerned, virtually all of the allegations are untrue. While it can indeed store the location for a period of time, the company wouldn’t associate it with anyone. Also, it would not share personal data with government agencies.
Incidentally, Whisper did adjust the terms of use this week. It now states that it can track users even when location services are turned off. According to The Guardian, this happened after editors told the company they were working on an article about Whisper.