WhatsApp Usernames: Reducing PII Exposure or Shifting the Attack Vector?

WhatsApp just announced the global rollout of username reservations, aiming to decouple identity from phone numbers for its 3 billion users. From a security architecture standpoint, this is a significant shift. For years, reliance on MSISDNs (phone numbers) has been the weak link—facilitating SIM-swapping attacks and making OSINT enumeration trivial via API scrapers.

While this feature is optional, it’s a massive step toward better OpSec for sensitive comms. However, I’m curious about the implementation details. If usernames are unique, we need to look at how they handle enumeration. If the service returns a boolean "Available/Taken" without strict rate limiting, attackers could easily script a brute-force attack to find targets, similar to Instagram enumeration techniques.

Here is a basic Python snippet I’m planning to test once the API endpoints stabilize to check for timing attacks or distinct error codes on invalid usernames:

import requests

def check_username_status(username):
    # Theoretical endpoint for username verification
    url = "https://web.whatsapp.com/check_username"
    params = {"u": username}
    try:
        response = requests.post(url, data=params)
        # Analyze response for 'taken' vs 'available' vs 'invalid'
        if response.status_code == 200:
            return response.()
        return {"error": f"Status code {response.status_code}"}
    except Exception as e:
        return {"exception": str(e)}

# Test enumeration logic
print(check_username_status("admin_admin"))

Does anyone have early insight into the rate-limiting WhatsApp plans to implement here? Also, for those managing corporate mobile device fleets, how are you planning to update your DLP policies to handle the new wa.me/username links versus the old numeric formats?