Specifically, the endpoint allowed asking if a given phone number had a whatsapp account. Scaled up to ~all phone numbers. That doesn't seem like a major vulnerability.
It's a feature for many of us, it is for me, cause when I input a new phone number in my contacts (like let's say a plumber's phone number I found on the internet) I first go to WhatsApp to check if they've got a profile there, in which case I contact them directly using WhatsApp, not via voice-call/SMS.
Why is it OK to allow enumeration of accounts with a given phone number, when it is generally considered to be a privacy and security violation to allow someone to enter email addresses and confirm if they have an account with a service or app?
I've never understood this idea that phone numbers shouldn't be protected the same as email addresses or other personal information.
It's for contact discovery. It's actually pretty similar for email? If you enter an email address in your mail client and send an email to it, in most configurations you'll get some kind of notification if the recipient doesn't exist.
Email, of course, has an unlimited number of possible addresses. Phone numbers are a dense space with limited parameter length. So it is easier to enumerate all phone numbers.
No. Firstly, there was no "leak", the data was never shared. The experiment was conducted by researchers then the data set destroyed. Secondly, there's 3.5b WhatsApp accounts. They just send the same message to everyone and the majority of numbers will have an account regardless.
