Is the WhatsApp application really that bad in terms of security? It uses signal encryption, I think the only problem must be the metadata that it does not encrypt.

    In terms of security I'd assume it's better than many apps. It's a fairly important app for one of the largest companies in the world, so I'd assume they throw quite a lot of resources for security, keeping dependencies up to date, I expect them to audit any third party they depend on, they probably limit what the developer's computers can install and have access to, they probably have recurrent pen testing...

    In terms of privacy though... Meta is one of the most valuable companies in the world and most of its business is serving ads, and it's way of making the ads more effective is by surveying it's potential audience (anyone with internet access) and the way they increase how many ads each is exposed to is by making their services more engaging (a.k.a. addictive), which they manage to do by surveying the users of their services. So I'd assume any opportunity they have to survey a user, they'll take it. For sure your social graph (contacts), who you talk to, when and how much and through what kind of media (text, voice, calls etc). Then probably more shady things like for example scan through the metada of all the images from your camera roll (through the access to all media files permission) to get when and where you took each picture and therefor build a location history of you. I'd assume they do that, since they put certain features behind the media access permission even when it's not needed. They might even use sensors like the accelerometer as a low-res microphone. Assume anything you give the app access to, they'll use it to survey you in some way.

    But GrapheneOS can reduce the impact of many of those, thanks to contacts and file scopes and the sensors permission, so you can give WhatsApp access exclusively to what you want. I'd only give it internet access and disable everything else. They'll still monitor everything you do within the app, but at least the app won't be able to see anything else.

    WhatsApp is a compromise in my opinion. Everyone uses it where I am, there isn’t an option to change that. But it’s a two edged sword, because at least everyone is using an e2e encrypted messenger. It could be far worse. It could be a mixed bag of iMessages where half the population falls back to sms. Or perhaps another messaging service where the e2e is non existent or its opt in.

    So it’s not exactly signal, but considering the vast user base it could be much worse, at least for hiding the actual content of one’s messages.

    Metadata lost is the compromise, and it’s a big compromise. Assume they take everything. You can use graphene to limit that, but you have no control over the people you speak to and how they’re handling your info. If they have a contact sheet in their os that has your birthday, all your emails, numbers, address etc, then that’s in the hands of meta, and there is little you can do.

    It belongs to Meta and they still collect metadata and will happily hand it over to the government if they are asked to.

      Where I am, even iphone users prefer it to imessage. I deleted my Facebook account a long time ago and I have no social media. I have no problem using Whatsapp to friends and family. Would I use it if I was a journalist talking to a political dissident? Not a chance.

      SoulKeeper

      In the European Union they cannot use that metadata for anything, they have passed laws about it, I am glad that the European Union is passing good laws that guarantee the privacy of users, the most recent is the regulation of AI

          SoulKeeper In the future (when signal is able to offer interporality with WhatsApp I will switch to signal/molly

              • [deleted]

              • Post #9
              • Edited

              hdishs just because laws get passed it doesn't mean they won't be bypassed in more sofisticated ways. They are designed to work best for administration of "justice" by courts not for average citizen. Always assume zero trust.

              Laws are twisted to the point where average Brit breaks the law 32 times a year without even realizing it.

                10 months later

                Sorry to necropost, but I recently stumbled upon this interesting article from 6 months ago that I have not seen discussed on may privacy-related communities.

                I quote from the article:

                "According to the internal assessment, the stakes are high: 'Inspection and analysis of network traffic is completely invisible to us, yet it reveals the connections between our users: who is in a group together, who is messaging who, and (hardest to hide) who is calling who.'";

                "The analysis notes that a government can easily tell when a person is using WhatsApp, in part because the data must pass through Meta’s readily identifiable corporate servers. A government agency can then unmask specific WhatsApp users by tracing their IP address";

                "The internal warning notes that these attacks require all members of a WhatsApp group or both sides of a conversation to be on the same network and within the same country or 'treaty jurisdiction'";

                "The assessment reveals WhatsApp has been aware of this threat since last year, and notes the same surveillance techniques work against other competing apps."

                As quoted, this is not a vulnerability per se in ShitApp, but rather a threat model not considered by almost all messaging apps, since these metadata correlation attacks are always possible if the adversary controls a decent part of the network. That said, the only way this can be avoided is using cryptographic techniques like Signal's sealed sender and metadata minimisation techniques... which ShitApp is of course not using, since it's the champion of metadata generation and collection.
                To quote from this other article:

                "end-to-end encryption only protects against reading messages during their transit. End-to-end encryption is therefore a minimum requirement for a private messaging service [...] For them [Facebook/Meta], the value of a messaging service lies is in knowing the dynamics of the social network: who talks to whom? When? Where are the individuals when they send those messages? How frequently do they talk? Like no other, Meta knows the value of metadata; they changed their name for a reason. Meta knows all too well how to exploit and valorise this data, and mention this in their privacy policy"

                So, for anyone still wondering, WhatsApp is not bad in terms of security; but that is hardly the whole picture, or even the appropriate question. Remember what former National Security Agency chief Michael Hayden said in 2014: “we kill people based on metadata”.

                Sadly, more than 2 billion normies in the world use WhatsApp; and normies do not (want to) understand or cannot understand why apps like this are bad for their privacy and, in turn, for all of our daily lives, let alone be convinced to use more private and secure messaging apps like Signal, SimpleX and Threema that do apply metadata minimisation and encryption techniques.

                You can repeat it like a monk in the coming years, like a prayer wheel. You won't change it. But maybe you'll enjoy it.

                Let everyone do what they want. You don't have to do it.

                hdishs
                WhatsApp (WA) is closed source and uses not (!) the same code as Signal or Molly.
                WA has a backdoor and the keys can be exchanged from the operator without giving the user a chance to know it.

                In Signal you can easily check the encryption via comparing the so called 'Security number'.
                And if there is a Man-in-the-middle-attack, the Security number changes instantly.

                In WA the admin/operator can deactivate the deeply hidden check function to hide manipulations every time it's needed.

                Don't trust WA! It is not only the secret collection and sale of all customer data, but also the hidden backdoor, which means that WA cannot offer any real end-to-end encryption.

                    How about the fact that most normal WhatsApp users enable unencrypted backups of their conversations to Apple or Google, meaning those tech giants potentially have your messages stored in clear-text on their servers, even if you choose to leave backups disabled. Technically, they could be running all your "private" conversations through their AI algorithms and learning quite a bit about you. Of course, I'm probably just being paranoid about that. At least Signal does not have an option to backup messages to the cloud.

                    Eagle_Owl In Signal you can easily check the encryption via comparing the so called 'Security number'.
                    And if there is a Man-in-the-middle-attack, the Security number changes instantly.

                    In WA the admin/operator can deactivate the deeply hidden check function to hide manipulations every time it's needed.

                    Can you please link to any reputable source that claims this? I would like to cease using WhatsApp but I need a strong proof such things are happening.

                      Eagle_Owl Don't trust WA

                      Right.
                      In fact, everyone uses WA and I have neither the desire nor the patience to play the messiah in order to convert people, but I also don't play the fool and therefore refuse to see all these people, as many people think they have to do, I use WhatsApp, but I only babble irrelevant stuff there that isn't worth protecting. I would never share anything controversial there.