[JoeCortopassi]

Am I missing something? "Give me your number and password, and I'll show you that WhatsApp is insecure". Really?

There is definitely a place to out a company that fails to secure things consistently, but asking for credentials in this way absolutely wrecks your credibility to anyone but the most trusting of people that already knows you. No one should input anything into this form, even if it's credible. To do so, is assuming that it is not being stored in any way (unprovable), and that it is following security best practices (on a site that's not even operating on a secure connection). I'm sure you are a standup guy, but I hope we never get complacent with blindly accepting "hack checkers" like the ones that popped up around other notable hacks recently

[wajdis]

It's so easy to get the password. Anyone with you on the same WIFI can get your WIFI Mac address about passwords: https://plus.google.com/109599361571767865655/posts/5ijzy29i...

[damian2000]

Might be a good idea to publish the source to your tool in a gist or something along with this explanation...

First impression for most users would be that this is credential harvesting webpage with who knows what running behind it.

[wajdis]

The page has been updated, and the source code is here: https://github.com/whatsapp/WhatsAPI/

[dutchbrit]

Based off https://github.com/venomous0x/WhatsAPI

Have you played with the node.js clients?

[Cyril-Boh]

Tried using this source. Can't seem to get the number and MAC combination right.

Using my own phone and account BTW.

[wajdis]

What's ur device ? (Android or iOS ?)

[tejasm]

edit

Worked for my android. Still not working for iOS.

[Cyril-Boh]

iOS

I was using \test\whatsapp.php.

[taylorbuley]

FTP. AIM. These are equally if not more insecure for the same reasons. Not to mention that if you're on my network a "Whatapp" account is the least of my concerns.

[mirashii]

No, they're not.

1) Your mac address is available to even passive sniffers without the key to an encrypted network. In some circumstances you don't even need to be connected to a network to grab someone's mac address (iPhones in particular love looking for networks loudly).

2) FTP and AIM passwords can be changed. Yes, a passive sniffer on the same network can still get them, but this is a significantly harder task than getting someone's mac address, and there's no way to change the goal.

3) Brute force attacks become within the realm of possibility. Have someone you know has an iPhone 5 and uses WhatsApp? The first chunk of the mac address is assigned by vendor, so you've already narrowed the search space down drastically by half to needing to guess 6 hex digits.

[chimeracoder]

> Not to mention that if you're on my network a "Whatapp" account is the least of my concerns.

How about if you're on someone else's network (work, a friend's, an airport, etc...)

[vowelless]

But it isn't easy to get the IMEI #. In my opinion, it does provide some sort of security.

[DrJokepu]

It's trivial to get these values from software and it is (was) a very common practice amongst app developers, advertisers etc. to collect this information and store it in a database. I can guarantee you that the IMEI in the majority of these databases is stored as plaintext. Due to the easy access to these numbers as well as the large number of massive existing databases of them, IMEI numbers are simply not suitable password equivalents in any way and merely suggesting the contrary makes our world a less secure place.

[wajdis]

The IMEI is harder, but any one who can grap your phone can enter *#06# to get your IMEI. Also, it's available on the box of your device, and many apps store the IMEI to identify your device.