4 ms·

I’m convinced WhatsApp’s e2e is BS. Because multiple times I’ve mentioned something I’ve never even googled and then had Facebook ads for those things show up m

I’m convinced WhatsApp’s e2e is BS. Because multiple times I’ve mentioned something I’ve never even googled and then had Facebook ads for those things show up minutes later. The most notable one being renting an apartment. I viewed an apartment then sent a message to the agent requesting window grills or latches and then had adverts for that stuff straight away. When ever I mention this on HN I get downvoted with lame excuses as to why it happened but none of them are plausible. My friend messaged me saying he needed to go buy kitty litter and I get adverts for cat toys and supplies on Facebook despite not even replying to him? Anyone who believes WhatsApp is really e2e is a fool IMO.

prego_xo 4y ago
It's e2e encrypted, just they have the keys and use them :)
kome 4y ago
this is the point. too much evidence against it and not enough evidence for it. i just don't trust facebook, google, apple etc.
- FabHK 4y ago
  They're not in the same category. Two of those are advertisement firms, one is a hardware company.
jacooper 4y ago
I dont need to believe anything, its proven by mane scientific researches.
- kroltan 4y ago
  Can you link to some?
  - jacooper 4y ago
    Couldn't find the one I have read before. But here are a few that I could find. https://eprint.iacr.org/2017/713.pdf https://eprint.iacr.org/2017/713.pdf https://www.researchgate.net/publication/312778290_WhatsApp_security_and_role_of_metadata_in_preserving_privacy https://www.researchgate.net/publication/312778290_WhatsApp_... https://www.ijrte.org/wp-content/uploads/papers/v8i2S3/B10930782S319.pdf https://www.ijrte.org/wp-content/uploads/papers/v8i2S3/B1093...
BackBlast 4y ago
I had a private family Slack instance, and we observed similar things. A question about buying a particular brand of soap would be spoken in the channel and ads for that exact soap would show up minutes later on Facebook. No searches or other activity, just a text query to a person through Slack. I prefer to think that some of this is chance, or Facebook just guessing really, creepily well. But after the 3rd or 4th time we observed this same scenario play out, trust has eroded, even if I have no evidence as to how this is happening. It's time to change up the tools. I now self-host an open source chat application, and we have not had another repeat of this kind of creepy ad invasion.
- unity1001 4y ago
  > I prefer to think that some of this is chance Don't. People are way too tolerant of serial liars, psychopaths and rapacious corporations.
santamex 4y ago
Isn’t that because they can read sender and recipient? So if you write someone who do a lot of renting stuff they believe you might like it, too? Just a guess.
birdsR2befr33 4y ago
I believe that it's automated, they scan every message with some embedded piece of code (that you can't really verify and have to trust that's harmless), that looks for key words and serve ads. And don't forget that with judicial order you get 24h-real-time access to any whatsapp account in question.
notduncansmith 4y ago
I wonder if there’s some kind of side channel leaking the ad targeting data, for instance if you type something into WhatsApp and they add words that you type into a user-specific autocomplete dictionary (or your lexicographical profile or whatever other aggregate they keep for various business purposes). Then they use those aggregates to target users based on the words they use in conversation without “decrypting their messages” so to speak. Depending on what phone you use, any custom keyboards, etc there may be other ways for typed text to leak.
- Melatonic 4y ago
  Yup. Keyboards can read everything. I always turn off all the special features of the keyboard that seem sketchy even if its from a legit company like Google.
brigandish 4y ago
Did you view the apartment with…? - the agent present - you both had smartphones on you - they both had bluetooth data enabled - they are both signed into location services - you'd added the agent to your contacts or they add you to theirs - you took pictures (and didn't strip the EXIF data) - you exchanged emails with the agent via gmail - you rang each other via a VOIP service - you used a map app to find the place - you found the apartment via an online listing - you found your current place some multiple of a standard contract length ago (e.g. 1 year) - your data in aggregate statistically matches that of other people's who also looked for new apartments The metadata just drips off and they sell it, it's repackaged, bundled up and sold on to others who then target you (personally or as part of a group) in their ad campaigns.
- philliphaydon 4y ago
  The agent is a friend so I had in my contact list for years. We exchange listings to apartments to view so absolutely they know I'm looking at apartments and all that stuff. Getting adverts for apartments is fine because I know I searched and browsed sites etc. The issue is for 2 weeks I looked at apartments. Got some adverts for AirBnb, other property sites, etc. The particular apartment I looked at, I viewed it, walked around it, etc. Went home, pondered to myself about the apartments I had looked at that day... Looked at facebook, etc... Hours later I go to WhatsApp, message the agent, something like. "I really like apartment X but the only issue is the windows don't have grills and its the 23rd floor, would you mind asking the landlord if we can get grills or window latches? If they are willing to do that then I think I'll take that apartment" (give or take on the message as it was 3 years ago? That I took it...) Agent had not read the message yet, infact he didn't read it until well after 6pm. I go to facebook (2-3 minutes?) after messaging him, and I have adverts for grills and window latches. I had not googled them, the only mention ever of grills or latches was a message on whatsapp a few minutes earlier... --------------- Even if they are scanning the messages on the client, as far as I'm concerned it's no longer e2e. They are scanning my personal message, analysising it, building a profile on me, and using it for advertising.
  - Melatonic 4y ago
    What keyboard do you use? That is always the one that worries me.....
dagmx 4y ago
In all your scenarios the likely answer , even with great e2e is that WhatsApp would still know who you messaged and they might have googled the words at some point. Your agent might have searched for latches after you messaged them. Your friend likely searched for cat litter before he messaged you. In each of those cases, E2E may still be active but you’re compromised by the human equivalent of the age old analog hole.
- cupofpython 4y ago
  Jane googles topics A,B,C,D Jane sends unknown message to John John fits the target profile of topic C John gets shown ad for topic C --- coincidentally, Janes unknown message was about topic C. Likely because she too believed it to be applicable to John. --- Going further... Maybe topic A was trending in Janes area. Jane's friend Sally got ads for topic A. sally talked to Jane about topic A. Jane searches topic A A trend emerged where people who searched topic A, very soon afterwards searched topic E. Jane is very late to hear the news about topic A. She gets shown ads for topic E. Jane thinks advertisers are reading her mind because she was thinking about topic E but didnt talk to anyone about it.
itslennysfault 4y ago
I mean the WhatsApp founders literally quit with millions left on the table over "disagreements with facebook senior leadership" and then promptly made a huge donation to Signal. If that wasn't them saying "HEY THEY ARE REMOVING E2E" without violating NDA I don't know what it was.
- dotBen 4y ago
  Whether or not this is a canary for negative impact to the integrity of WhatsApp e2e, this move was enough to move my primary communication to Signal. Jan Koum not only had unvested shares, he was on the BOARD of Facebook and decided to quit. Along with the donation to Signal, I don't think the magnitude of this action was widely appreciated at the time.

prego_xo 4y ago

It's e2e encrypted, just they have the keys and use them :)

kome 4y ago

this is the point. too much evidence against it and not enough evidence for it. i just don't trust facebook, google, apple etc.

FabHK 4y ago
They're not in the same category. Two of those are advertisement firms, one is a hardware company.

jacooper 4y ago

I dont need to believe anything, its proven by mane scientific researches.

kroltan 4y ago
Can you link to some?
- jacooper 4y ago
  Couldn't find the one I have read before. But here are a few that I could find. https://eprint.iacr.org/2017/713.pdf https://eprint.iacr.org/2017/713.pdf https://www.researchgate.net/publication/312778290_WhatsApp_security_and_role_of_metadata_in_preserving_privacy https://www.researchgate.net/publication/312778290_WhatsApp_... https://www.ijrte.org/wp-content/uploads/papers/v8i2S3/B10930782S319.pdf https://www.ijrte.org/wp-content/uploads/papers/v8i2S3/B1093...

BackBlast 4y ago

I had a private family Slack instance, and we observed similar things. A question about buying a particular brand of soap would be spoken in the channel and ads for that exact soap would show up minutes later on Facebook. No searches or other activity, just a text query to a person through Slack. I prefer to think that some of this is chance, or Facebook just guessing really, creepily well. But after the 3rd or 4th time we observed this same scenario play out, trust has eroded, even if I have no evidence as to how this is happening. It's time to change up the tools. I now self-host an open source chat application, and we have not had another repeat of this kind of creepy ad invasion.

unity1001 4y ago
> I prefer to think that some of this is chance Don't. People are way too tolerant of serial liars, psychopaths and rapacious corporations.

santamex 4y ago

Isn’t that because they can read sender and recipient? So if you write someone who do a lot of renting stuff they believe you might like it, too? Just a guess.

birdsR2befr33 4y ago

I believe that it's automated, they scan every message with some embedded piece of code (that you can't really verify and have to trust that's harmless), that looks for key words and serve ads. And don't forget that with judicial order you get 24h-real-time access to any whatsapp account in question.

notduncansmith 4y ago

I wonder if there’s some kind of side channel leaking the ad targeting data, for instance if you type something into WhatsApp and they add words that you type into a user-specific autocomplete dictionary (or your lexicographical profile or whatever other aggregate they keep for various business purposes). Then they use those aggregates to target users based on the words they use in conversation without “decrypting their messages” so to speak. Depending on what phone you use, any custom keyboards, etc there may be other ways for typed text to leak.

Melatonic 4y ago
Yup. Keyboards can read everything. I always turn off all the special features of the keyboard that seem sketchy even if its from a legit company like Google.

brigandish 4y ago

Did you view the apartment with…? - the agent present - you both had smartphones on you - they both had bluetooth data enabled - they are both signed into location services - you'd added the agent to your contacts or they add you to theirs - you took pictures (and didn't strip the EXIF data) - you exchanged emails with the agent via gmail - you rang each other via a VOIP service - you used a map app to find the place - you found the apartment via an online listing - you found your current place some multiple of a standard contract length ago (e.g. 1 year) - your data in aggregate statistically matches that of other people's who also looked for new apartments The metadata just drips off and they sell it, it's repackaged, bundled up and sold on to others who then target you (personally or as part of a group) in their ad campaigns.

philliphaydon 4y ago
The agent is a friend so I had in my contact list for years. We exchange listings to apartments to view so absolutely they know I'm looking at apartments and all that stuff. Getting adverts for apartments is fine because I know I searched and browsed sites etc. The issue is for 2 weeks I looked at apartments. Got some adverts for AirBnb, other property sites, etc. The particular apartment I looked at, I viewed it, walked around it, etc. Went home, pondered to myself about the apartments I had looked at that day... Looked at facebook, etc... Hours later I go to WhatsApp, message the agent, something like. "I really like apartment X but the only issue is the windows don't have grills and its the 23rd floor, would you mind asking the landlord if we can get grills or window latches? If they are willing to do that then I think I'll take that apartment" (give or take on the message as it was 3 years ago? That I took it...) Agent had not read the message yet, infact he didn't read it until well after 6pm. I go to facebook (2-3 minutes?) after messaging him, and I have adverts for grills and window latches. I had not googled them, the only mention ever of grills or latches was a message on whatsapp a few minutes earlier... --------------- Even if they are scanning the messages on the client, as far as I'm concerned it's no longer e2e. They are scanning my personal message, analysising it, building a profile on me, and using it for advertising.
- Melatonic 4y ago
  What keyboard do you use? That is always the one that worries me.....

dagmx 4y ago

In all your scenarios the likely answer , even with great e2e is that WhatsApp would still know who you messaged and they might have googled the words at some point. Your agent might have searched for latches after you messaged them. Your friend likely searched for cat litter before he messaged you. In each of those cases, E2E may still be active but you’re compromised by the human equivalent of the age old analog hole.

cupofpython 4y ago
Jane googles topics A,B,C,D Jane sends unknown message to John John fits the target profile of topic C John gets shown ad for topic C --- coincidentally, Janes unknown message was about topic C. Likely because she too believed it to be applicable to John. --- Going further... Maybe topic A was trending in Janes area. Jane's friend Sally got ads for topic A. sally talked to Jane about topic A. Jane searches topic A A trend emerged where people who searched topic A, very soon afterwards searched topic E. Jane is very late to hear the news about topic A. She gets shown ads for topic E. Jane thinks advertisers are reading her mind because she was thinking about topic E but didnt talk to anyone about it.

itslennysfault 4y ago

I mean the WhatsApp founders literally quit with millions left on the table over "disagreements with facebook senior leadership" and then promptly made a huge donation to Signal. If that wasn't them saying "HEY THEY ARE REMOVING E2E" without violating NDA I don't know what it was.

dotBen 4y ago
Whether or not this is a canary for negative impact to the integrity of WhatsApp e2e, this move was enough to move my primary communication to Signal. Jan Koum not only had unvested shares, he was on the BOARD of Facebook and decided to quit. Along with the donation to Signal, I don't think the magnitude of this action was widely appreciated at the time.