5 ms·

WhatsApp is not e2ee. When Facebook displays advertising based on conversations in what’s app. You will never convince me it’s e2ee. It’s fake privacy.

paulryanrogers 4y ago
WA was E2EE, at least at one point. Its key weakness was not notifying of key changes by default.
- philliphaydon 4y ago
  Before being bought by Facebook I would believe it was e2ee. But believe it’s not e2ee between the client and Facebook. They just decrypt analysis and reencypt and forward. Since communication is not peer to peer and goes via FB the key exchange is prob with Facebook not the users.
  - gruez 4y ago
    >They just decrypt analysis and reencypt and forward. Since communication is not peer to peer and goes via FB the key exchange is prob with Facebook not the users. Do you have any evidence for this, or is this your "better safe than sorry" assumption for every e2e messenger that doesn't allow you to verify keys?
    - philliphaydon 4y ago
      After FB bought WhatsApp I’ve had multiple occasions where shortly after having conversations with people about products I haven’t searched for. The only place I’ve discussed it. Is in a whats app conversation. I got advertising in Facebook for those products. For example when looking for an apartment I told my agent (non business account) that I wanted safety catches on the windows. I immediately got advertising for safety catches and window gates. I don’t own cats but in a conversation with a friend who owns cats I said she should get one of those cat tree things and scratch poles. Right away Facebook starts showing me adverts for cat toys. This is not stuff I’ve searched or googled or anything. Just mentioned in WhatsApp. Maybe WhatsApp whats differently in America but in Singapore I get advertising in Facebook from conversations.
      - scrollaway 4y ago
        None of this is evidence of decryption. At best it’s circumstantial anecdotes pointing to Facebook extracting topic metadata out of your convos. This can be done clientside, no decryption necessary. (And it’s easy to prove that it’s being done if that’s the case)
        klyrs 4y ago
        E2EE plus arbitrarily invasive clent-side sniffing/reporting should not be considered "E2EE" by any means. Even if reports to the mothership are strongly encrypted (at which point it becomes harder to determine what's in the reports).
        scrollaway 4y ago
        I agree with you, but the claim that Facebook is decrypting and reencrypting things is a very very very severe one.
        klyrs 4y ago
        I didn't claim they are. But they can. And without transparency, I have very little inclination to trust. I find it plausible that they'd scan for keywords and phone home when they get hits -- advertising businesses are not known for their scruples and fb has not distinguished itself in that regard. Once that machinery is in place, it's ripe for abuse. I don't claim any proof it's happening, but it would be naive to blindly trust that it isn't.
      - gruez 4y ago
        That's... not really good evidence. Your story sounds almost identical to the "facebook/google is eavesdropping on me" stories that frequently make the rounds on popular discourse. Unfortunately, that's basically the Sasquatch of the privacy world (ie. there are many people with anecdotes claiming it exists, but very little in the way of actual evidence like network captures or decompiled binaries). If anything, it's worse than Sasquatch because at least with Sasquatch you could claim that there aren't many of them and/or they're actively avoiding humans so they're hard to photograph, but the "facebook/google is eavesdropping on me" stories implies it's happening to everyone so capturing an instance should only be a matter of technical skill rather than luck.

paulryanrogers 4y ago

WA was E2EE, at least at one point. Its key weakness was not notifying of key changes by default.

philliphaydon 4y ago
Before being bought by Facebook I would believe it was e2ee. But believe it’s not e2ee between the client and Facebook. They just decrypt analysis and reencypt and forward. Since communication is not peer to peer and goes via FB the key exchange is prob with Facebook not the users.
- gruez 4y ago
  >They just decrypt analysis and reencypt and forward. Since communication is not peer to peer and goes via FB the key exchange is prob with Facebook not the users. Do you have any evidence for this, or is this your "better safe than sorry" assumption for every e2e messenger that doesn't allow you to verify keys?
  - philliphaydon 4y ago
    After FB bought WhatsApp I’ve had multiple occasions where shortly after having conversations with people about products I haven’t searched for. The only place I’ve discussed it. Is in a whats app conversation. I got advertising in Facebook for those products. For example when looking for an apartment I told my agent (non business account) that I wanted safety catches on the windows. I immediately got advertising for safety catches and window gates. I don’t own cats but in a conversation with a friend who owns cats I said she should get one of those cat tree things and scratch poles. Right away Facebook starts showing me adverts for cat toys. This is not stuff I’ve searched or googled or anything. Just mentioned in WhatsApp. Maybe WhatsApp whats differently in America but in Singapore I get advertising in Facebook from conversations.
    - scrollaway 4y ago
      None of this is evidence of decryption. At best it’s circumstantial anecdotes pointing to Facebook extracting topic metadata out of your convos. This can be done clientside, no decryption necessary. (And it’s easy to prove that it’s being done if that’s the case)
      - klyrs 4y ago
        E2EE plus arbitrarily invasive clent-side sniffing/reporting should not be considered "E2EE" by any means. Even if reports to the mothership are strongly encrypted (at which point it becomes harder to determine what's in the reports).
        scrollaway 4y ago
        I agree with you, but the claim that Facebook is decrypting and reencrypting things is a very very very severe one.
        klyrs 4y ago
        I didn't claim they are. But they can. And without transparency, I have very little inclination to trust. I find it plausible that they'd scan for keywords and phone home when they get hits -- advertising businesses are not known for their scruples and fb has not distinguished itself in that regard. Once that machinery is in place, it's ripe for abuse. I don't claim any proof it's happening, but it would be naive to blindly trust that it isn't.
    - gruez 4y ago
      That's... not really good evidence. Your story sounds almost identical to the "facebook/google is eavesdropping on me" stories that frequently make the rounds on popular discourse. Unfortunately, that's basically the Sasquatch of the privacy world (ie. there are many people with anecdotes claiming it exists, but very little in the way of actual evidence like network captures or decompiled binaries). If anything, it's worse than Sasquatch because at least with Sasquatch you could claim that there aren't many of them and/or they're actively avoiding humans so they're hard to photograph, but the "facebook/google is eavesdropping on me" stories implies it's happening to everyone so capturing an instance should only be a matter of technical skill rather than luck.