Privacy Trade Off in WhatsApp Usernames
Meta recently introduced optional usernames for WhatsApp, allowing users to connect with people without sharing their phone number. While the feature enhances privacy by hiding phone numbers, the Dutch consumer organization Consumentenbond has warned that users need to be careful about their username choice. When users opt to reuse their existing Facebook or Instagram handle on WhatsApp, Meta requires them to link their accounts through Accounts Center. This linking enables information sharing across Meta’s connected platforms and makes it easier for others to connect a user’s WhatsApp identity with their other public Meta profiles.
Social Engineering Risks and Recommendations
Reusing the same username across Meta’s apps creates a social engineering risk. If someone can see or guess a user’s Meta style username, they may connect the WhatsApp identity to Instagram or Facebook profiles and use information from those social media accounts for impersonation or targeted fraud. Meta has reserved usernames for public figures and some variations, but many prominent names were still available during the reservation period. Security experts recommend choosing a unique WhatsApp only username rather than reusing handles from other Meta platforms. Users should also treat their username as a public identifier, pick something hard to guess, and enable contact restrictions like the username key feature which requires anyone trying to contact them for the first time to know both the username and a separate key.
Source: Malwarebytes
