He tried to respond to these individuals and groups saying he wasn't the right person

The Italians probably replied:

Non preoccuparti tesoro, alla fine diventerai la persona giusta

Looks like someone fucked up user management which should be exclusive: his account should have stopped working properly when he changed SIMs. This is what happens with Signal, and WhatsApp says it uses the same protocol.

But that signal is only the protocol (and yes an app with the same name), what you do before or after that in regards to messages and user accounts is entirely up to the developer. There's nothing to stop the whatsapp developers getting the text content from the input box encrypting one via the signal protocol to your mate and sending one to facebook.

Oh, definitely. The thing is, if you're going to use the phone number either as the primary key or the basis for one, you must enforce it.

Phone numbers are pretty good candidates for primary keys as they're easy to use to set things up reasonably securely. Alternatives are possible but all of them have their own issues all essentially based around identification problems. That said, [1]Signal is working on a replacement for phone numbers as a way of providing even better anonymity and portability.

Personally, I don't use WhatsApp not for security reasons but for the metadata that the companies harvest to mine and sell. I know this makes me a very tiny hole in a very big jigsaw. This means I also don't have to worry about trusting them with privacy and encryption. I don't but at least I don't have to worry about it!

[1] https://signal.org/blog/change-number/

For what we know they could use IRCd as a backend and keep everything in plain text.

It's not a phone company problem, it's a social media company issue.

They're binding their service to a phone number and not an account, if it was bound to an account then this wouldn't happen.

huge copout from fakebook/whatsapp blaming someone else for their decision to bind accounts to a mobile number.

OK, there are other issues where companies send SMS messages for 2FA too so there are more complexities to it.

There's also a responsibility for the account owner to delete their phone numbers off of their social media.

So it's a mix of social media companies and the people with accounts with those services.

I would think there would be some kind of "migrating to a new number" thing in those apps, not that this wouldn't be used by identify thieves - it's a complex subject thinking more on it.

Giving up and going for a lunch break!

One of my (many! Hey, we’re Irish!) cousins had a problem with Arsebook and Gmail. It seems that Gmail has trouble distinguishing between fname.lname, fname,lname, fname_lname, and probably more. They all seem to resolve as fnamelname. It’s a Google thing. So… someone who had a Gmail account similar to my cousin’s account set up Arsebook, about six years after cousin got his account. I repeat, cousin had the account for years before m’man linked a Arsebook account. And cousin started getting Arsebook notifications. Lots of Arsebook notifications. Sending messages to the owner of the Arsebook account didn’t help, cousin ended up going to Arsebook and changing the password. A few days later, the notifications started again; m’man had reset his password. Cousin went into Arsebook and ‘deleted’ the account (yeah, right, Arsebook is the Hotel California, you can check out but you can never leave) which stopped the notifications… for about a week. He did it again. This time the notifications stopped. We figure that m’man changed the account info so that it stopped pointing to cousin’s account.

One would have thought that the fact that cousin could change the password and then could ‘delete’ the account would have told m’man that perhaps all was not well, especially after messages ask him to stop, cease, and desist from spamming cousin with notifications and to, like, you know, change the account info, had been repeatedly sent. Arsebook users ain’t too bloody bright.

does it not ?

"Facebook doesn't have control over telecom providers who reissue phone numbers"

That may be true, but if so then why have Facebook effectivly handed over the security of their entire platform to "telecom providers" outside their control?

This may be by design rather than a bug, but it's bloody stupid thing to do.

Same thing used to (well still might do) happen with Google Workspaces. I once create an organisation workspace using a domain which turned out was once owned by someone else who had also set up a Google Workspace. This was back in the days when you could have 50 email address before you had to pay for it so I'm guessing no one bothered to clear the account up behind them.

Is it really that different to moving house, forgetting to change your address all over the place, then getting upset when a complete stranger (the new occupant) is still receiving (and presumably able to read) your post?

Or selling a mobile phone/computer without wiping everything on it first?

Yeah, it's annoying that companies seem to want to tie accounts to phone numbers, but if you change your number and don't update all this stuff, mea culpa etc...

How do you delete a whatsapp account when your phone number's been disconnected and you need the phone number to delete it?

Losing a phone number usually wont be by choice. Many people lose their phones and a good percentage will not have registered their prepay contact details so can't get the number back. Some people have to travel abroad at short notice so cant topup, others have a "life event" that prevents topping up or paying the bill. Some are being abused by partners or fleeing violence or natural disasters so are forced to change phones and numbers.

Claiming the account should have been deleted to avoid being compromised is like saying you should have sold your car to prevent it being stolen.

I can understand how they say you need to delete your account and other things to keep it safe but I wonder how members of group chats are kept.

If they use a list of phone numbers to maintain the membership then it is unlikely deleting your account would take you out of the group.

This just goes to show that phone number is a terrible key... one person can have more than one phone number and one phone number can belong to more than one person (hopefully at different periods of time)

If a number is dead to WhatsApp then it eventually gets removed from the group. The issue here is when the number is given to someone else before this time elapses.

and this is not 'extremely rare' at all - we all will die.

Hopefully not before Arsebook and the likes die!

Ugo was a long-time WhatsApp user in Switzerland with his account tied to his Swiss phone number.

...

Note that this person seemed to be Italian, most/all messages were in Italian…

They do speak Italian in Switzerland too.

It's a beautiful part of the world (Ticino).

The new French number that Ugo got after transferring his number using WhatsApp was previously owned by an Italian speaker judging by the profile and the groups he got added to.

Really WhatsApp should reset the profile and remove the number from any existing groups when transferring an account to a new number which was in use but hasn't been used for some time, not blame the teleco.

Hope I get the ex-number of a really hot, beauty who likes to share photos on Fapbook. . :-)

Mind you knowing my luck I'll probably get the ex-number of some kiddie fiddler... Or worse Boris Johnson.

Well I never. End to end encryption is useless when the phone company can re-allocate your number or clone it.

Altogether now. "That's not a bug, it's a feature."