4 ms·

Generally I'm for stronger data protection, but German officials relationship to WhatsApp is a bit silly, I always wonder what their conrete worry or attack sce

Generally I'm for stronger data protection, but German officials relationship to WhatsApp is a bit silly, I always wonder what their conrete worry or attack scenario is. That a rouge employee at WhatsApp can see your metadata or access your telefone book? That the US government can see your metadata? Criminal and state actors have access to most of that information anyway.

lysium 6y ago
Cambridge Analytica showed there is a huge private market for data. Why should any government put its connections into a private corporation? Just because some criminals or state actors can obtain that information illegally does not mean we should provide that data willingly and legally. As a side note, I find it strange that you are for stronger data protection and at the same time think it is "silly" to avoid data collection companies such as WhatsApp.
- captainmuon 6y ago
  > As a side note, I find it strange that you are for stronger data protection and at the same time think it is "silly" to avoid data collection companies such as WhatsApp. For example, I would advocate to allow anonymous phones again. Since a few years you can only get a SIM card with identity verification in Germany. I would also disallow third parties to create profiles of anybody, and I would ban the sale of such data. Currently as a company you can even make queries to the local "Einwohnermeldeamt" (registration office) and for a fee get address and other data of residents. I'm opposed to that, as well as the data collection going on at credit score agencies. Personally I think what German officials are doing is often data protection theatre, akin to security theatre. But I think WhatsApp is somewhat unavoidable, and after weighing the pros and cons I don't think it is reasonable to ban it (I know it is banned e.g. by many municipalities, schools, and trade unions for communication with citizens). It's better to allow it so you can reach people for whom this is the medium of choice, as long as you always provide a safer alternative of course. If I could decide, I would also require every messenger and social network above say one million users to provide federation. Being able to access your own data the way you want is just as important an aspect of "data protection" as locking it down! And it would force competition and prevent one entitiy from being too big to avoid.
deleted 6y ago
[deleted]
est31 6y ago
Already the fact that you are talking to a psychologist is worth a lot to insurances and job candidate assessment platforms. Or to a midwife. Pregnant women are worth a lot in the adtech industry because especially if it's their first baby, they are about to buy lots of things they haven't bought before. Classical example is diapers. This is from the metadata alone. But Whatsapp goes further: it also encourages Google Cloud backups. Quite many people enable it. That way, the content becomes accessible to Google. Other apps like Threema don't have the option of online backups of message content. You can back up some stuff online, but it's only stuff like your list of contacts, stuff that for Whatsapp already resides on the servers. For the content, you must use offline backups.
- captainmuon 6y ago
  > But Whatsapp goes further: it also encourages Google Cloud backups. Quite many people enable it. That way, the content becomes accessible to Google. What's the bigger danger for most people? - You talk about pregnancy on WhatsApp, and they - illegally - extract this information so that some website can show you diaper ads? (I'm not even considering the possibility that this information would leak to an employer or heathcare - because such a leak, or anybody doing anything with that info would be considered completely outrageous here.) - Or: your phone breaks and you loose extremely important information stored in chats - passwords, photos, and so on? For most normal people I know, #2 is the greater hazard. So I , too, would encourage them to back up their stuff in the cloud.
atoav 6y ago
> I always wonder what their conrete worry or attack scenario is There are laws in place who require German institutions to keep data privacy to a certain standard. This standard cannot be guarantueed when using e.g. Whatsapp. Of course one could argue the Germans are too paranoid when it comes to privacy – but keep in mind where this comes from: Germany knows first hand what impact state lead data collection can have from it's own history on not one but two occasions (the Nazi-apparatus and the Eastern German STASI surveillance). This historic backdrop lead to a widespread mindset that one should collect as little data as necessary (search for privacy by design or Datensparsamkeit). This mindset is also enshrined in law. If you work in an government entity IT-department who is responsible for complying to these laws recommending a messenger which does "something" to your users data (where this "something" can change at any point), is something you could do, but on the other hand you could also just tell them not to use it at all (or to use Signal etc).
bad_user 6y ago
WhatsApp is a proprietary app and Facebook did plan to implement client-side agents that would extract info from content, or blacklist it. This means Facebook has the capability of backdooring WhatsApp and by extension the US government has this capability. This isn't just about the metadata, you would be naive to think so. Proprietary apps, especially those that get automatically updated, will always have this loophole. [1] https://www.schneier.com/blog/archives/2019/08/facebook_plans_.html https://www.schneier.com/blog/archives/2019/08/facebook_plan... > "Criminal and state actors have access to most of that information anyway." You don't have evidence for this and regardless, metadata access can be prevented and it's in a country's best interest to protect its affairs from governments of other countries or from organized crime.
- throwaway3603 6y ago
  > WhatsApp is a proprietary app and Facebook did plan to implement client-side agents that would extract info from content, or blacklist it. This was debunked. Read Schneier’s correction: https://www.schneier.com/blog/archives/2019/08/more_on_backdoo.html https://www.schneier.com/blog/archives/2019/08/more_on_backd...
- captainmuon 6y ago
  > This isn't just about the metadata, you would be naive to think so. Proprietary apps, especially those that get automatically updated, will always have this loophole. I would say most applications that goverment offices in Germany use to interact with citizens are proprietary. For example Outlook as a mail client. SAP is used in some administrations. Many cities and police departments have presences on Facebook and Twitter and communicate with people there. Nobody has any issue with using proprietary SMS apps or iMessage. In fact, open source in administration is currently so rare that it is newsworthy.
rapsey 6y ago
> German officials relationship to WhatsApp is a bit silly, I find HN hivemind relationship to these apps quite silly. A government should never entrust any information to a third party it has zero control over. An individual consumer and a government employee working with classified information have vastly different responsibilities. > I always wonder what their conrete worry or attack scenario is The security of these public apps are akin to a glass cannon. Strong in one scenario, hilariously weak in another. State actors can easily circumvent and extract full text messages and not just metadata.
- captainmuon 6y ago
  It's not clear from the article, but the debate in Germany is about local offices using WhatsApp to interact with citizens. Like people asking about garbage collection dates, or informing about school closings. Things you might as well post on a wall or send with a postcard. Anything remotely sensitve, like getting a certificate of residence, has to be done in person anyway. You're right when it comes to government officials working with classified information. But otherwise its completely normal to subcontract IT to third parties, even (especially) in the US.
  - im3w1l 6y ago
    Many people on HN say over and over that Facebook is a private company and they can ban you whenever they want for any or no reason. A company that behaves this way cannot be trusted of course. If I get banned I cannot know about closed schools and garbage collection dates? And with no way to appeal or get redress. Of course completely unacceptable.
mytailorisrich 6y ago
> That the US government can see your metadata? Not only metadata but the whole data transmissions. Whatsapp may claim that transmissions are encrypted end-to-end but they control the app itself so can do whatever they want. The app distribution channels are also controlled by American companies. So any government conducting communications through Whatsapp has in effect outsourced its communications to the US. For important communications governments do not even trust off-the-self smartphones.
- WJW 6y ago
  To add to this point: The US government is not at all trusted in Germany (or most of the EU) at the moment. "America first", combined with numerous withdrawals from international bodies like the WHO and the climate agreements has given the impression that the old allies are no longer beneficial to the European cause.
  - rsynnott 6y ago
    And even before that the Snowden thing had a profound impact.

lysium 6y ago

Cambridge Analytica showed there is a huge private market for data. Why should any government put its connections into a private corporation? Just because some criminals or state actors can obtain that information illegally does not mean we should provide that data willingly and legally. As a side note, I find it strange that you are for stronger data protection and at the same time think it is "silly" to avoid data collection companies such as WhatsApp.

captainmuon 6y ago
> As a side note, I find it strange that you are for stronger data protection and at the same time think it is "silly" to avoid data collection companies such as WhatsApp. For example, I would advocate to allow anonymous phones again. Since a few years you can only get a SIM card with identity verification in Germany. I would also disallow third parties to create profiles of anybody, and I would ban the sale of such data. Currently as a company you can even make queries to the local "Einwohnermeldeamt" (registration office) and for a fee get address and other data of residents. I'm opposed to that, as well as the data collection going on at credit score agencies. Personally I think what German officials are doing is often data protection theatre, akin to security theatre. But I think WhatsApp is somewhat unavoidable, and after weighing the pros and cons I don't think it is reasonable to ban it (I know it is banned e.g. by many municipalities, schools, and trade unions for communication with citizens). It's better to allow it so you can reach people for whom this is the medium of choice, as long as you always provide a safer alternative of course. If I could decide, I would also require every messenger and social network above say one million users to provide federation. Being able to access your own data the way you want is just as important an aspect of "data protection" as locking it down! And it would force competition and prevent one entitiy from being too big to avoid.

deleted 6y ago

[deleted]

est31 6y ago

Already the fact that you are talking to a psychologist is worth a lot to insurances and job candidate assessment platforms. Or to a midwife. Pregnant women are worth a lot in the adtech industry because especially if it's their first baby, they are about to buy lots of things they haven't bought before. Classical example is diapers. This is from the metadata alone. But Whatsapp goes further: it also encourages Google Cloud backups. Quite many people enable it. That way, the content becomes accessible to Google. Other apps like Threema don't have the option of online backups of message content. You can back up some stuff online, but it's only stuff like your list of contacts, stuff that for Whatsapp already resides on the servers. For the content, you must use offline backups.

captainmuon 6y ago
> But Whatsapp goes further: it also encourages Google Cloud backups. Quite many people enable it. That way, the content becomes accessible to Google. What's the bigger danger for most people? - You talk about pregnancy on WhatsApp, and they - illegally - extract this information so that some website can show you diaper ads? (I'm not even considering the possibility that this information would leak to an employer or heathcare - because such a leak, or anybody doing anything with that info would be considered completely outrageous here.) - Or: your phone breaks and you loose extremely important information stored in chats - passwords, photos, and so on? For most normal people I know, #2 is the greater hazard. So I , too, would encourage them to back up their stuff in the cloud.

atoav 6y ago

> I always wonder what their conrete worry or attack scenario is There are laws in place who require German institutions to keep data privacy to a certain standard. This standard cannot be guarantueed when using e.g. Whatsapp. Of course one could argue the Germans are too paranoid when it comes to privacy – but keep in mind where this comes from: Germany knows first hand what impact state lead data collection can have from it's own history on not one but two occasions (the Nazi-apparatus and the Eastern German STASI surveillance). This historic backdrop lead to a widespread mindset that one should collect as little data as necessary (search for privacy by design or Datensparsamkeit). This mindset is also enshrined in law. If you work in an government entity IT-department who is responsible for complying to these laws recommending a messenger which does "something" to your users data (where this "something" can change at any point), is something you could do, but on the other hand you could also just tell them not to use it at all (or to use Signal etc).

bad_user 6y ago

WhatsApp is a proprietary app and Facebook did plan to implement client-side agents that would extract info from content, or blacklist it. This means Facebook has the capability of backdooring WhatsApp and by extension the US government has this capability. This isn't just about the metadata, you would be naive to think so. Proprietary apps, especially those that get automatically updated, will always have this loophole. [1] https://www.schneier.com/blog/archives/2019/08/facebook_plans_.html https://www.schneier.com/blog/archives/2019/08/facebook_plan... > "Criminal and state actors have access to most of that information anyway." You don't have evidence for this and regardless, metadata access can be prevented and it's in a country's best interest to protect its affairs from governments of other countries or from organized crime.

throwaway3603 6y ago
> WhatsApp is a proprietary app and Facebook did plan to implement client-side agents that would extract info from content, or blacklist it. This was debunked. Read Schneier’s correction: https://www.schneier.com/blog/archives/2019/08/more_on_backdoo.html https://www.schneier.com/blog/archives/2019/08/more_on_backd...
captainmuon 6y ago
> This isn't just about the metadata, you would be naive to think so. Proprietary apps, especially those that get automatically updated, will always have this loophole. I would say most applications that goverment offices in Germany use to interact with citizens are proprietary. For example Outlook as a mail client. SAP is used in some administrations. Many cities and police departments have presences on Facebook and Twitter and communicate with people there. Nobody has any issue with using proprietary SMS apps or iMessage. In fact, open source in administration is currently so rare that it is newsworthy.

rapsey 6y ago

> German officials relationship to WhatsApp is a bit silly, I find HN hivemind relationship to these apps quite silly. A government should never entrust any information to a third party it has zero control over. An individual consumer and a government employee working with classified information have vastly different responsibilities. > I always wonder what their conrete worry or attack scenario is The security of these public apps are akin to a glass cannon. Strong in one scenario, hilariously weak in another. State actors can easily circumvent and extract full text messages and not just metadata.

captainmuon 6y ago
It's not clear from the article, but the debate in Germany is about local offices using WhatsApp to interact with citizens. Like people asking about garbage collection dates, or informing about school closings. Things you might as well post on a wall or send with a postcard. Anything remotely sensitve, like getting a certificate of residence, has to be done in person anyway. You're right when it comes to government officials working with classified information. But otherwise its completely normal to subcontract IT to third parties, even (especially) in the US.
- im3w1l 6y ago
  Many people on HN say over and over that Facebook is a private company and they can ban you whenever they want for any or no reason. A company that behaves this way cannot be trusted of course. If I get banned I cannot know about closed schools and garbage collection dates? And with no way to appeal or get redress. Of course completely unacceptable.

mytailorisrich 6y ago

> That the US government can see your metadata? Not only metadata but the whole data transmissions. Whatsapp may claim that transmissions are encrypted end-to-end but they control the app itself so can do whatever they want. The app distribution channels are also controlled by American companies. So any government conducting communications through Whatsapp has in effect outsourced its communications to the US. For important communications governments do not even trust off-the-self smartphones.

WJW 6y ago
To add to this point: The US government is not at all trusted in Germany (or most of the EU) at the moment. "America first", combined with numerous withdrawals from international bodies like the WHO and the climate agreements has given the impression that the old allies are no longer beneficial to the European cause.
- rsynnott 6y ago
  And even before that the Snowden thing had a profound impact.