Your WhatsApp and Signal are snitching on your location right now
Forget fancy hacking tools. Researchers found that WhatsApp and Signal basically broadcast your location and habits because they are too polite to keep quiet about delivery confirmations. It is a fundamental design flaw that makes privacy feel like a joke.
Security researcher Max Günther discovered that these apps leak sensitive data via the Round Trip Time (RTT) of delivery notifications. Because your phone automatically confirms receipt of a message—even if it hits your spam folder—the time it takes for that signal to bounce back reveals whether you are actively using your phone or idling.
By running a simple script to measure these millisecond delays, an attacker can determine your location, your network status, and even your daily routine with terrifying precision. This is a zero-click attack, meaning the victim does not have to tap, open, or do anything at all for the tracker to start building their digital profile.
While Meta and Signal have implemented basic rate-limiting to slow down such automated probes, the underlying issue remains a core part of how messaging protocols work. Günther argues that this is a fundamental flaw shared by almost all modern communication platforms, making a total fix impossible without breaking the core functionality of instant messaging.
Privacy is apparently just a feature we negotiate with physics. As long as applications prioritize instant status updates over user anonymity, the very signal that confirms a message reached its destination will continue to act as a homing beacon for anyone with a basic script.
Source: PCMag
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.