WhatsApp’s New Username Feature Sparks Impersonation Concerns
WhatsApp has recently begun rolling out a username reservation feature, poised for a wider release later this year. This new capability allows users to find and message each other by handle instead of relying solely on phone numbers. While intended to enhance privacy, it has already sparked impersonation concerns, particularly among security experts and regulators in India, where WhatsApp boasts over 500 million users.
A Shift in User Identification
The introduction of usernames signifies a notable change in how users are identified on WhatsApp. By moving away from phone numbers as the primary identifier, Meta, WhatsApp’s parent company, suggests that privacy will be improved. However, critics warn that this shift might open doors for new forms of impersonation.
Early Observations and Concerns
In initial testing, TechCrunch discovered that usernames resembling those of prominent individuals and organizations in India were still available for reservation. Examples include “indiamodi” for the Prime Minister, “shahrukh.actor” for Bollywood actor Shah Rukh Khan, and “rbi_verify” for the Reserve Bank of India. Binance’s founder, Changpeng Zhao, also noted his inability to reserve “cz_binance,” a handle he uses on another platform.
Meta assured TechCrunch that usernames for public figures and government entities would be reserved to prevent impersonation, but it remains unclear how decisions are made regarding which usernames to proactively reserve.
Regulatory Scrutiny in India
The feature has caught the attention of Indian regulators, where cyber fraud often involves impersonation schemes. The Ministry of Electronics and Information Technology (MeitY) expressed concerns that the feature could exacerbate online fraud and phishing by allowing malicious actors to contact users without revealing their phone numbers.
The ministry has requested that WhatsApp provide explanations to avoid regulatory action under India’s IT laws, and recommended delaying the rollout until further consultations are completed.
Debate Over Regulatory Intervention
This regulatory intervention has been met with criticism from the Internet Freedom Foundation (IFF), a digital rights group based in New Delhi. The IFF argues that the notice lacks a clear legal foundation and could grant excessive power to the executive branch to influence product design, rather than addressing fraud through enforcement of criminal law.
Privacy, Trust, and Platform Power
Rachel Tobac, CEO of SocialProof Security, views usernames as a privacy gain, reducing the need to share phone numbers and hence, the risk of SIM-swap attacks and phishing. Nonetheless, she acknowledges the potential for impersonation through lookalike usernames. She advises users to select usernames that are not easily guessable to minimize harassment and spam.
WhatsApp acknowledges that usernames are not a universal solution and advises users to choose unique usernames for WhatsApp. Users can also link their Instagram or Facebook usernames to maintain a consistent identity across Meta’s platforms.
The Mozilla Foundation highlights that while usernames could lead to increased scams and impersonation, these issues stem from the platform’s design choices, and checking phone numbers remains a valuable verification tool.
Mozilla also raises concerns about interoperability, noting that while linking Facebook and Instagram usernames may reduce impersonation, it underscores Meta’s ability to integrate identities across its platforms without allowing users to transfer their identities to competitors.
For now, WhatsApp is proceeding cautiously with the rollout, emphasizing user feedback to ensure a smooth launch later this year.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Source: Here
“`
