[polote]

The thing is, this method works pretty well if people are chatting in real time, if you wait like 10 minutes to answers messages, it is much more difficult to create the links.

Moreover if people are using all the time Whatsapp, it is again much more difficult to do.

But I agree with you, there are many situations where these could work

[antirez]

Unfortunately even under much more noise than the Whatsapp activation patterns, we have seen timing attacks working in incredible reliable ways, with the network in the middle adding random delays, and even when the task at hand was to misure very small differences in time. So I guess that if this attack already seems feasible in certain contexts, it can only get much better using more advanced techniques.