Blocking Whatsapp tracking and tracking in general

Hknet

Hi there!

I'm trying to understand how to block WhatsApp property when it comes to tracking. The sandbox prevents apps from accessing other apps, but presumably through things like MAC addresses or similar, Meta could then link the advertising ID in its system via the Instagram app installed and opened in the same profile that uses the same mac address? That's why there are separate profiles. Right?

If I now use WhatsApp with a separate number on the eSIM and then join the whatsapp groups I was previously in, and people then save my second number in the same contact as my other number, and they probably sync their address book with WhatsApp, does not Meta then allready link my new number to their advertising ID?

To ensure that the Instagram app opened on a different profile does not have the same IP address as WhatsApp, you could now run WhatsApp through a VPN, such as Mullvad or Orbot. In theory, however, wouldn't every app such as Instagram, WhatsApp, and Facebook, even Google Maps need its own profile and a separate IP, meaning its own VPN?

Using chatgpt could also lead to linking via IP address and browser footprinting, don't the tech giants all pass on the advertising IDs to each other? Because if Google or Meta link the two numbers in any way, even if it happens only once, then all the effort to separating the apps even with different eSIM should be obsolete for the future, is that so?

Then there's the WhatsApp bridge via Matrix, but I'm not sure if that offers any advantages with grapheneOS.

Grapi

Hknet

No way. One way or another, you’ll still be traceable through other people who have your number and data stored.

So if you use a smartphone, just behave like a normal, responsible citizen.

If you don’t want that, the only real alternative is to communicate face‑to‑face, with no devices involved.

Delaney

Hknet I'm trying to understand how to block WhatsApp property when it comes to tracking.

You don't.

GrapheneOS already has features that help limit what information you give to WhatsApp, such as contacts. But you can't prevent the app from sending telemetry if you are going to use it.

DohnJoe

Hknet That's why there are separate profiles. Right?

Yes, but actually no.

Dividing the apps in two different profiles might give you the protection you are seeking, but not for the reasons you are thinking.

If you want to have the best privacy "experience", I suggest you to switch to the browser for most services as you can.
Instagram on the browser cannot rely on IPC with other Meta apps, nor cannot grab the same information about your smartphone.

I would suggest to install a VPN that allows you to set some DNS (like mullvad) to "blacklist" socials, advertisement and trackers.
Of course this is not bulletproof and will get rid of ads, trackers and socials only if tied to specific domains.

For the rest, if there is a trustable front-end for a service, I suggest you to use it.
It can be a webapp (EG imginn -> instagram, nitter -> twitter, etc.), or an android app (EG tubular -> youtube, infinity -> reddit, etc.).

If you cannot avoid Whatsapp, just use Whatsapp.
Remember that Whatsapp needs only internet to work properly, all the other permissions are arbitrarily asked, but not needed.

When you receive a picture, you can manually browse your file system and open it without passing through WhatsApp's interface (at least it worked last year before deleting my account), and the same is also true for voice messages, videos, stickers and so on.

Hknet Then there's the WhatsApp bridge via Matrix

Bridging whatsapp to Matrix will allow you to use a different client to read the messages, but remember that your e2e encryption will end with the server you use to make the bridge.
From there (the server) you will have a new e2e connection to your Matrix client.
This means that the owner of the server is potentially able to read all your messages clear text.
This cannot be changed by design and it is true also for signal.

If you can convince your friends to enter Signal, you can migrate your chats there, it is probably your best change on having a good security and privacy posture.
There are other apps (like SimpleX) seemingly even more privacy fodused than Signal, but the chance you are getting your friend there are very low.

VehicularClatter298 There's not much you can block apart from what you decide not to share.

This is a solid and valid point.
The tools you use help you in keeping your stuff private, but the use you do of your tools is one of the most important things you should consider.

VehicularClatter298

Grapi So if you use a smartphone, just behave like a normal, responsible citizen.

Who decides what's "normal" and "responsible"? Come on.

There are many other e2ee instant messengers that don't spy on you like WhatsApp does (i.e. stealing your contacts and keeping track of chat metadata in order to trace relationship maps, and correlating such data with what is extracted from Instagram). Most are also FOSS.

Signal is a well known and respected alternative. Check here for a detailed comparison with other messengers (including WhatsApp).

littlerack

VehicularClatter298 Signal is a well known and respected alternative

It's so "Well known" that a lot of people just dump is as there typically no-one from their contact list to talk to. It's still a niche product, so if you're a tech nerd, you're lucky, but it's dead for normies. Hopefully someday I will finally put a matrix gateway and the gw project will be alive by then

Hknet

ok I see. then I am asking myself, what am I trying to block and why?

mostly the communication of an app sending user-related data for user profiling for advertising developement, I guess. in WA the layer adds that who I am connected with in my communication is for some usage. this is supposed to be the actual interesting data but why is that so?

VehicularClatter298

Knowing who you're connected with, and how often you communicate with them (along with: message size, group names, participants of groups you're in, location...), mainly helps Meta build precise relationship maps about, well, a good part of humanity. If you have Instagram or Facebook accounts, data extracted there adds up as well.

Hknet for user profiling for advertising developement, I guess

This is not only used for advertising: the Cambridge Analytica scandal showed that this enormous information can be sold to third parties who use it to influence politics. The Snowden disclosures also showed that Meta (then Facebook) shares this data with US three-letter agencies.

VehicularClatter298

Hknet what am I trying to block and why

There's not much you can block apart from what you decide not to share.

You could use GrapheneOS's Storage scopes and Contact scopes features; connect to the internet only through a VPN; avoid location sharing via WhatsApp. You could keep WhatsApp isolated in a secondary profile, to avoid it seeing what other apps you have installed on your phone. But still, you're letting the bulk of your social life be tracked.

Also, you could delete all your Meta accounts, wait for the data deletion period to end, then sign up using a new SIM card - which isn't tied to you yet and which you didn't use to sign up to Instagram. Start contacting your family and friends as you did before, though, and you'll end up with the problem you had in the beginning.

VehicularClatter298

Meta has a ton of non-deterministic ways to know it's you (and to link WhatsApp and Instagram / Facebook accounts). Relationship maps - data it already has - are key. Then, there's device model, OS & version. Their apps have tons of permissions and are closed-source, so you can't pretty much know what is done e.g. with visible and connected networks, SMS/call log...

When it comes to deterministic ways, keep in mind that there's no advertising ID on GrapheneOS. What Meta has is your phone number and/or email.
IP addresses are a sort of in-between (chances are you're not the only person on your home Wi-Fi).

brandy078

First of all. Apps can communicate with other apps. But it has to be mutual.
My setup for WA (because actually I still use it to stay informed in some groups, like you) is:

I made an own profile for WA, no background activity.
I registered my account with a prepaid number I use only for WA.
I have Proton VPN - which is the only non stock app in this profile - always on with proton netshield enabled.
WA doesn't have any permissions except network.
No profile picture, info, or anything
no phone book sync, last online ect.
every couple of days I have a look if there is something important happening in those groups.
and I don't communicate on WA. If someone sends me a message I just don't answer on WA. After a couple of days i send an sms with the kindly reminder to call me or write e message on Signal or Threema.

I hope this setup reduces my meta data footprint Zuck can collect to a minimum.
But its still different to your use case, because I don't have Insta or FB.

littlerack

VehicularClatter298 keep in mind that there's no advertising ID on GrapheneOS

If one has play services, there is an ID by default, but you can reset or delete it. https://grapheneos.org/faq#non-hardware-identifiers

ShoulderSurfin

I 100% get it and having had Meta issues recenlty, you are going in the right direction. I don't do WA anymore. I did but I got booted by META for using a VPN. They said I was hacked (I wasn't, just my IP changed and a different location). So after 18 years I am gone and they want YOUR DATA. They demanded passport, drivers license or birth certificate data. I am hell no. Even though I have a Yubikey on my account they could use for verification, it was .. more data. The moral .. if you can do anything to get away from Meta anything, you will be better off.

I know it can be tough in places like the EU where WA is the norm.
However I find that can be VERY tough as most people are not like the people here. I was told 'I am not doing anything illegal' and that SMS is just fine.

Re GrapheneOS .. I would put it in a separate profile or private space if you can. I really like some of the ideas posted above, by brandy078 as in this case, less is more.

Just a side note on my GrapheneOS the only app on my phone that recently was trying to call home .. Facebook. They really try to get your data. Recently Zuck said they want the OS to do more. That is very telling where they stand. Good luck.

Hknet

thanks for your answers. Whatsapp is for me a way to get information of people in groups that I wouldn't get otherwise, on work or among some few friends. I can decide not to do it but I they won't change the messenger so its my decision not to get jobs i.e.. But I dont use it for regular chats, neither instagram. Insta is only for my artist marketing stuff.

But I thought getting a seperate eSIM for whatsapp will keep Meta from getting my identity. But as I read your answers I must say that meta already has my relationship map when I used my old number, and the vision of the advantages fade of using a seperate number. I am switching to a new grapheneOS phone at the moment, but even using my new phone in the same WLAN as my old one will sooner or later let them connect my two numbers very easily.

But then its not a question of letting them get my identiy, its only a question of what information am I accepting to or that I cannot avoid to give away, and the the less I want to give in the big bucket, right?

DohnJoe

Hknet
I would say that a lot of people here would agree that Perfect is the enemy of Good.

Knowing your "Enemy" will help you make better choices and understanding what are the downsides allow you (for example) to sandbox Play Store instead of getting rid of it.