Some questions to WhatsApp users on GOS

brandy078

Hi there all you people using WhatsApp!

This should't be a discusion pro and con using WA.
It's really hard to avoid WA in Germany, most of you surely know...
Only 20% of my Contacts using Signal, only 5% Threema.
Every new group will be a WA group....

I tried to avoid any Meta products for some time, but its not realistic to avoid WA. Not if you want to have a social life.

I'm just curious how you use WA on your device.
Main profile, or a special one just for WA?
What do you do to protect yourself, when using WA or don't you care about the privacy cons?

I look forward to hear many of your suggestions and ideas. :)

W1zardK1ng

brandy078 I use it on private space with contact scope. Private space is locked most of the time. My frequent contacts know they won't get an immediate reply if they message me on WhatsApp so they have signal. For others I reply when I open the app manually and I keep WhatsAppWeb on pc so sometimes in reply from there. WhatsApp web now supports calling.

Kamika242

brandy078

It's really hard to avoid WA in Germany, most of you surely know...

No, it isn't. When Meta declared the weakening of data protection and to play out promotion in the beginning of 2021, I wrote a message to my most used contacts that I leave WhatsApp, the reason why and that they can find me on Signal or Threema (used both additionally already since years). Same day in the evening and overnight 95% of my contacts migrated to Signal and some to Threema.
Now, 5 years later, I don't miss WhatsApp one bit. And yes, I have a social life and this happens excellently without social media and thousands of virtual "friends".

pingu-the-penguin

brandy078

Hey,

brandy078 I'm just curious how you use WA on your device.

I personally use it in my main profile. This comes with the downside of WA being able to see which apps I have installed in the same profile. If this is a risk that you do not want to take, feel free to put WA in it's own user profile like a Private Space (more convenient) or a secondary user profile.

brandy078 What do you do to protect yourself, when using WA or don't you care about the privacy cons?

Unfortunately, you are quite limited in what you can do privacy-wise while using WA. You have a few options that you can combine.

Use WA without Google Play Services so they can't communicate with each other. (Downside is certain functionality such as document scanning or FCM notifications will not work. WA will open its own web-socket for notifications if you choose this route and you would need to give WA unrestricted battery so notifications are timely. This comes at the cost of battery-life)
Mainly security but make sure you enable all GrapheneOS hardening toggles that do not make the app crash. You can enable: Hardened memory allocator, Secure App Spawning, Hardware Memory Tagging (can cause crashes sometimes). You can disable the app being able to use: DCL via Memory, WebView JIT and Native Code Debugging.
Restrict permissions as much as possible or opt for one-time usage permissions. WA requires the phone permission if you want to be making calls so you'd need that. Camera, Microphone and location permissions can be granted on a per-use basis. Use contact-scopes or just save contacts in-app so you aren't giving WA access to your entire contacts list. Use storage-scopes so you aren't giving WA access to all your media files.
Configure privacy and security settings in-app. There is a setting called Strict Account Security which you can enable. https://blog.whatsapp.com/whatsapps-latest-privacy-protection-strict-account-settings.
You can enable End-To-End-Encrypted backups so that your chat backups are not given to WA in an unencrypted form. (There could be more settings in-app that i'm forgetting so it would be a good idea to audit these.
You can use a VPN to hide your IP.
The least effective method is blocking DNS requests as WA can still bypass these restrictions. If you are using a VPN, you should configure DNS blocking in-app using native DNS blocking features to prevent fingerprinting from the mismatch between your VPN provider and your DNS provider.

brandy078

EverettHitch You don't tell me something new. But maybe you missunderstood me. If you can't avoid avoid WA, what would be the minimal invasive way to use it?

jjewel

whatusp is the most important app for me, since everyone i need to reply to uses that, so it goes without questions in my main profile with a shortcut on the center and even unrestricted battery usage to not delay messages received

Tandara

You can set-up a matrix bridge to make it more private. You will lose the ability to call, but text communications work

brandy078

Tandara Would you please explain those benefits a bit, ty

Johnnyloans

Tandara You can set-up a matrix bridge to make it more private.

brandy078

I don't think this would add privacy because your conversation exists in whatsapp on the other person's phone.

Traveling through matrix 20% or 50% of the time won't keep Facebook's hands off of the messages.

Let's say you both have the matrix bridge
Bridge > Facebook > bridge

brandy078

And just to say it again: I'm greatfull for any suggestions.

EverettHitch

W1zardK1ng what an app supports doesn't say anything about its security. That's what we're here for, isn't it? I would never use WhatsApp Web on PC, I haven't found a secure PC to date irrespective of OS.

brandy078

EverettHitch As return you get my my sincere and heartfelt gratitude. But please stick to the topic; otherwise, things will get confusing here.

EverettHitch

brandy078 sometimes what you look for is not what you're looking for. And with that I'm gonna leave you be.

brandy078

EverettHitch Thank you for joining this discusion. Have a great day!

brandy078

Johnnyloans Thank you. But that would avoid to have WA App installed. No benefits because of that?

Johnnyloans

brandy078

Oh yeah true. Sorry tandara

grain0613

I used to use Beeper for WhatsApp, Instagram, etc. But I need the calling function to connect with my family members,... So now I just have a second profile for all my social media apps.

Tandara

Yeah, you can't avoid Facebook having access to your messages since you are literally using their service and servers.

Having a matrix relay helps by not having WA app installed and collecting data in background to track you (device id, installed phone number regions, location, when your profile is running, media drm, Facebook tracking and linking to other apps having FB trackers, and other stuff).

bbcbab

A bit similar to W1zardK1ng I installed WA on my work profile (shelter) which is open all the time. WA is on my 'freeze' list, so I run it a few times a day to check for messages, then each time I freeze it afterwards. Being on the work profile keeps it separated from 90% of my daily apps but, although having it 'frozen' most of the time doesn't really help privacy, it makes me feel better!

legreteco

I'm using WhatsApp normally (main profile). I have play services installed as well (for notifications). Battery usage is default setting for me.

brandy078

Kamika242 I made other experiences.
But please stick on the topic. Thank you.