Show HN: Web client for WhatsApp (opens in new tab)

Still you'd be able to save the number-imei then post on our behalf to Whatsapp.

Sure, absolutely. But those things are no reason to be lax on security. All those people are going to care if rampant spoofing, account hijacking, etc. starts.

The security holes seem to fit that nasty sweet spot where they are easy enough for someone to do, if they target you, but hard to do on a massive scale (matching IMEI/MAC to ph. no.), so it seems unlikely to me that users will actually experience problems. Unless it gets a reputation with users as hackable, this wont actually effect their success.

aka: how dumb things become wildly successful.

That said, what will effect success, and what is "right" are not always the same thing.

No, it IS scary. First, even if an attacker can wiretap my network, and I assume that at least my ISP and government always can, I want my main means of communication to be secure: I PRETEND HTTPS on mail, Twitter, Facebook and so also on WhatsApp before using it. (Also, with https it's not hard, it must not be possible, if it is, is a bug) Second, if you try airodump-ng in a public place you will realize that you don't wiretap a Wi-Fi MAC address, it is screamed in every direction by every device that have Wi-Fi turned on, and note, not associated to an AP, simply turned on. Because this is how the network works, your device keeps yelling "I am /MAC address/ and know these APs, is there anyone near?" So, if a service authenticates me based on a broadcasted value or on a easily retrievable value (I usually don't think that the guy that asked me to make a phone call might obtain some password of mine) I would not call that password-based authentication.

The IMEI can be obtained dialing *#06# on most phones, so anyone that has physical access to your phone once can use it to access your whatsapp account anytime.

It's public to every app on your phone. Imagine if every app on your phone could listen and log as you entered passwords in your web browser?

I like the use of the word "password". If they would at least implement a password, the whole thing would be a lot more secure.

Thanks! I've activated my number. However I cannot get the IMEI. It has very poor UI. There is no UI for dialing.

Edit: there is apps to download which shows your IMEI.

The index.htm page crashes in Chrome (Version 21.0.1180.89) with the "Aw, Snap!" error. The issue seems to be the direct manipulation of the ".class" attribute of some object in JS.

Well, technically it's still there, just checkout 476bb7a.