4 ms·

60 comments in the discussion already and no one is slightly curious about what kind of investigation they can do, if the messages are end-to-end encrypted? OP

60 comments in the discussion already and no one is slightly curious about what kind of investigation they can do, if the messages are end-to-end encrypted? OP: any chance your wife's phone was sim-swapped or cloned? I believe that this is the only thing that could trigger an alarm. Also, just drop WhatsApp if you can. Install Element on your phone and ask your wife to do the same, if you want you can sign up for a 14-day trial on Communick [0], or just use the free service from matrix.org [1] [0]: https://communick.com https://communick.com [1]: https://app.element.io https://app.element.io

treme 4y ago
why stop there? get them to install linux on their pc, help them tunnel through Tor and setup pgp for them.
- rglullis 4y ago
  Baby steps... Baby steps... Seriously, though. My mother, well in her 60's and far from being a tech-savvy person, managed to install Element and login to her account simply by following the instructions on the email I sent her when I signed her up. The whole thing with saving recovery key is a bit confusing, but not a showstopper. I don't get why people need to act like they can't even try a different service.There was life before WhatsApp, there can be life without it. Worst case scenario, you tried something new.
- GWBullshit 4y ago
  Yeah, no. You even so much as search for TOR on a search engine, you're on a list. You go to their site, you're on another list. You click the "download" part of the page, you're on another list. You click "download", you're on another list. You open up the package in your downloads folder, you're on another list. You install the package contents, you're on another list. You run it, you're on another list. People who never gave much thought to who developed TOR and believe it offers "privacy" have got to be among some of the most naive tech users to exist.
  - rglullis 4y ago
    Then yet another reason to encourage everyone to do it. A list where half of the world can be found is as good as no list at all.
    - GWBullshit 4y ago
      I sorta get your point; there was some tech freedom advocate or something during the early 2000s that offered a free script on his website which would automatically auto-meta-tag/SEO optimize your site with a small essay's worth of every conceivable flag word/term/name you could imagine; his proposal was similar: if everything gets flagged as a priority to have a human analyst scrutinize it, then by definition nothing could be a priority any more. I can't help but wonder if "they" didn't start a separate list altogether with his name at the top.
  - 29083011397778 4y ago
    I agree, but this is both a different threat model, as well as running into "Too much data leaving you with a haystack worth of needles" kind of thing. I mean just in general, Canada is on a list [0]. Not just some citizens or government officials, but the nation itself. [0] https://www.wksu.org/government-politics/2022-06-02/ohio-house-republicans-vote-to-put-canada-on-a-federal-watch-list https://www.wksu.org/government-politics/2022-06-02/ohio-hou...
    - GWBullshit 4y ago
      This made me laugh; thank you. It's totally Trudeau, Canada needs to be closely scrutinized – some very dangerous things have been happening there over the last half-decade or so, and not just in a religious sense.
spijdar 4y ago
> what kind of investigation they can do, if the messages are end-to-end encrypted? When a user flags a conversation/user, it sends a number of historical messages with the report. End-to-end encryption doesn't prevent the end user from forwarding the messages to a third party.
- hda111 4y ago
  And the messages are just entries in a local sqlite database. Can’t I just forge a message locally and report it in hope the other person will be banned? At least in the Signal app (WhatsApp uses a similar crypto) all messages have plausible deniability, nobody can prove they are real or forged because the signature will be deleted as soon as the message is received.
GWBullshit 4y ago
But did you read the OP's comment? His wife uses it not because she wants to necessarily, but because her relatives in OTHER COUNTRIES are on it already. You'd be surprised how popular WhatsApp is in other areas of the world, especially since it offers peer-to-peer fund transfer. The problem is not his wife finding an alternative, the problem is finding such an alternative AND convincing all her relatives to install/start using it also. The only thing that would make that worthwhile for a sizable group of people would be if they could also be able to convince other existing users on their previous platform of choice to ALSO ditch that platform for the new one. Sort of a catch-22.
- rglullis 4y ago
  > the problem is finding such an alternative AND convincing all her relatives to install/start using it also. Once upon a time, WhatsApp was also a system with a microscopic user base. And AIM, and MSN, and ICQ, Skype... You have to start somewhere. For me, I told those closer to me that I wanted to get out of WhatsApp and offered to help my immediate family and some friends who wanted to try Element as well. Others said that they were on Telegram, which I am still keeping around, so it was not-ideal-but-acceptable. The interesting thing happened when there was an outage of Facebook Messenger, and some of my wife's friends got interested in trying out Element too... slow and steady can win this race.
  - GWBullshit 4y ago
    I see your point. I think the main selling point of WhatsApp in other countries is the peer-to-peer funds transfer feature; family sending each other a bit of money to help get through temporary rough spots is deeply embedded in the cultures of areas of the world where WhatsApp is popular. What I can't believe (this being run by Y Combinator) is how nobody seems to have come up with a meta-service top-layer; technical objections could be bypassed with a simple "You agree to temporarily waive the encryption capabilities of your core platform while using our platform" disclaimer, and then the meta-service could offer it's own encryption as an alternative. I'm not saying such a service would be able to duplicate all features of the ones that integrate with it, but ... I mean it would just make things so much simpler if you could link in your "whatever account" to such a meta service and then just add contact info of others on other services and just be able to speak/chat with them instead of signing up for a multitude of services just to keep in touch with extended family. I'm sure it's not as technically easy as I made it sound, but I'm also sure there would be a market for that; I can't imagine people who regularly keep in contact with family members dispersed across the world scoffing at a modest monthly fee for such a service, especially since the definition of "modest" would be aimed at U.S./European users who need to keep in contact with family members in other parts of the world.
tempestn 4y ago
I'm not sure how I'd determine if her phone had been cloned. There hasn't been any other evidence of anything strange, besides this whatsapp ban.
tinus_hn 4y ago
First they can tell if you’re using an unofficial client and ban you for that. Secondly other users can report spam by you, with their keys so WhatsApp can read the messages.

treme 4y ago

why stop there? get them to install linux on their pc, help them tunnel through Tor and setup pgp for them.

rglullis 4y ago
Baby steps... Baby steps... Seriously, though. My mother, well in her 60's and far from being a tech-savvy person, managed to install Element and login to her account simply by following the instructions on the email I sent her when I signed her up. The whole thing with saving recovery key is a bit confusing, but not a showstopper. I don't get why people need to act like they can't even try a different service.There was life before WhatsApp, there can be life without it. Worst case scenario, you tried something new.
GWBullshit 4y ago
Yeah, no. You even so much as search for TOR on a search engine, you're on a list. You go to their site, you're on another list. You click the "download" part of the page, you're on another list. You click "download", you're on another list. You open up the package in your downloads folder, you're on another list. You install the package contents, you're on another list. You run it, you're on another list. People who never gave much thought to who developed TOR and believe it offers "privacy" have got to be among some of the most naive tech users to exist.
- rglullis 4y ago
  Then yet another reason to encourage everyone to do it. A list where half of the world can be found is as good as no list at all.
  - GWBullshit 4y ago
    I sorta get your point; there was some tech freedom advocate or something during the early 2000s that offered a free script on his website which would automatically auto-meta-tag/SEO optimize your site with a small essay's worth of every conceivable flag word/term/name you could imagine; his proposal was similar: if everything gets flagged as a priority to have a human analyst scrutinize it, then by definition nothing could be a priority any more. I can't help but wonder if "they" didn't start a separate list altogether with his name at the top.
- 29083011397778 4y ago
  I agree, but this is both a different threat model, as well as running into "Too much data leaving you with a haystack worth of needles" kind of thing. I mean just in general, Canada is on a list [0]. Not just some citizens or government officials, but the nation itself. [0] https://www.wksu.org/government-politics/2022-06-02/ohio-house-republicans-vote-to-put-canada-on-a-federal-watch-list https://www.wksu.org/government-politics/2022-06-02/ohio-hou...
  - GWBullshit 4y ago
    This made me laugh; thank you. It's totally Trudeau, Canada needs to be closely scrutinized – some very dangerous things have been happening there over the last half-decade or so, and not just in a religious sense.

spijdar 4y ago

> what kind of investigation they can do, if the messages are end-to-end encrypted? When a user flags a conversation/user, it sends a number of historical messages with the report. End-to-end encryption doesn't prevent the end user from forwarding the messages to a third party.

hda111 4y ago
And the messages are just entries in a local sqlite database. Can’t I just forge a message locally and report it in hope the other person will be banned? At least in the Signal app (WhatsApp uses a similar crypto) all messages have plausible deniability, nobody can prove they are real or forged because the signature will be deleted as soon as the message is received.

GWBullshit 4y ago

But did you read the OP's comment? His wife uses it not because she wants to necessarily, but because her relatives in OTHER COUNTRIES are on it already. You'd be surprised how popular WhatsApp is in other areas of the world, especially since it offers peer-to-peer fund transfer. The problem is not his wife finding an alternative, the problem is finding such an alternative AND convincing all her relatives to install/start using it also. The only thing that would make that worthwhile for a sizable group of people would be if they could also be able to convince other existing users on their previous platform of choice to ALSO ditch that platform for the new one. Sort of a catch-22.

rglullis 4y ago
> the problem is finding such an alternative AND convincing all her relatives to install/start using it also. Once upon a time, WhatsApp was also a system with a microscopic user base. And AIM, and MSN, and ICQ, Skype... You have to start somewhere. For me, I told those closer to me that I wanted to get out of WhatsApp and offered to help my immediate family and some friends who wanted to try Element as well. Others said that they were on Telegram, which I am still keeping around, so it was not-ideal-but-acceptable. The interesting thing happened when there was an outage of Facebook Messenger, and some of my wife's friends got interested in trying out Element too... slow and steady can win this race.
- GWBullshit 4y ago
  I see your point. I think the main selling point of WhatsApp in other countries is the peer-to-peer funds transfer feature; family sending each other a bit of money to help get through temporary rough spots is deeply embedded in the cultures of areas of the world where WhatsApp is popular. What I can't believe (this being run by Y Combinator) is how nobody seems to have come up with a meta-service top-layer; technical objections could be bypassed with a simple "You agree to temporarily waive the encryption capabilities of your core platform while using our platform" disclaimer, and then the meta-service could offer it's own encryption as an alternative. I'm not saying such a service would be able to duplicate all features of the ones that integrate with it, but ... I mean it would just make things so much simpler if you could link in your "whatever account" to such a meta service and then just add contact info of others on other services and just be able to speak/chat with them instead of signing up for a multitude of services just to keep in touch with extended family. I'm sure it's not as technically easy as I made it sound, but I'm also sure there would be a market for that; I can't imagine people who regularly keep in contact with family members dispersed across the world scoffing at a modest monthly fee for such a service, especially since the definition of "modest" would be aimed at U.S./European users who need to keep in contact with family members in other parts of the world.

tempestn 4y ago

I'm not sure how I'd determine if her phone had been cloned. There hasn't been any other evidence of anything strange, besides this whatsapp ban.

tinus_hn 4y ago

First they can tell if you’re using an unofficial client and ban you for that. Secondly other users can report spam by you, with their keys so WhatsApp can read the messages.