8 ms·
WhatsApp is more secure than iMessage: Mark Zuckerberg
- nathanaldensr 4y agoHow about this: neither are secure. If you want security, use PGP or something like Wickr (if you trust Wickr's security claims).
- rreyes1979 4y agoMy wife was planning a trip with a friend on Whatsapp and for the first time in her life mentioned something about renting a car. She never searched for it in Google or anywhere else but not 24h after that, car rental ads for the specific city she will be visiting started to appear in her Instagram feed. So I guess when Zuck talks about security that doesn't include privacy.
- zamalek 4y agoIf it is, then why would he be so desperate for us to use it?
- randoglando 4y agoI would assume he has a bone to pick with Apple (see the not-so-subtle jab at Connect as well).
- iphone14pro 4y ago
- snickmy 4y agothis is technically correct. Yet missing the bigger point of the privacy war between Apple & Meta
- fshbbdssbbgdd 4y agoMaybe the fact that Apple is worse in one of the few areas the user can actually verify should make us second-guess our preconceived notions? What if Apple is just better at PR?
- howinteresting 4y agoThis is generally true, though there's an asterisk: https://www.rollingstone.com/politics/politics-features/whatsapp-imessage-facebook-apple-fbi-privacy-1261816/ https://www.rollingstone.com/politics/politics-features/what... Whatsapp adding end to end encryption for backups is a big deal, though. The FBI pressured Apple to not do so for iMessage.
- avarun 4y ago> The other tech giant that can be compelled by law enforcement to hand over potentially large amounts of sensitive messaging data is Apple. iMessage, Apple’s text-message service, comes loaded on the iPhone and is used by 1.3 billion people worldwide. According to the FBI’s “Lawful Access” guide, if served with a court order or a search warrant, Apple must hand over basic subscriber information as well as 25 days’ worth of data about queries made in iMessage, such as what a targeted user looked up in iMessage and also which other people searched for that targeted user in the app. That doesn’t include actual message content or whether messages were exchanged between different users. > But the amount of data available to law enforcement is potentially far greater — greater even than the user data provided by WhatsApp — if a targeted user backs up their iMessage activity to iCloud, Apple’s online storage platform. If that’s the case, the FBI document says, then law enforcement can request back-ups of the target’s device, including actual messages sent and received in iMessage if they’re backed up in the cloud. > While Apple describes iCloud as an encrypted service, it comes with a giant loophole. Apple holds an encryption key that can unlock user data in iCloud, and so police departments or federal agencies can request that key with a search warrant or a customer’s consent to access certain user data. “You’re handing someone else the key to hold onto on your behalf,” says Mallory Knodel of the Center for Democracy and Technology. “Apple has encrypted iCloud but they still have the keys, and as long as they have the key, the FBI can ask for it.”
- robg 4y agoAnd yet, nothing Zuck says will help me to trust him. Makes me wonder what Meta / Fb could be with a different leader. He’s not a product visionary.
- Jyaif 4y agoHe created facebook and is responsible for the purchase of Instagram. That makes him a product visionary in my book.
- AlexandrB 4y agoThe question is whether he still is one or the market has moved past him. No one stays relevant forever.
- rvz 4y agoThere you go. Founding the fastest $1 trillion dollar company in the 21st century sounds like what a product visionary would make and Zuckerberg is undisputed over that claim, while many have told him the Instagram purchase was a mistake, after finding another billion users again. The proclaimed death of Meta Platforms. Inc has been greatly exaggerated (again).
- lavventura 4y agoHe created facebook but over time the number of people using it dramatically decreased and it will never be same again. All the ads make me feel controlled by their product. Everday I ask this question to myself. Will the world a better place without Facebook and Instagram?
- jonas21 4y ago> over time the number of people using it dramatically decreased Eh? https://www.statista.com/statistics/264810/number-of-monthly-active-facebook-users-worldwide/ https://www.statista.com/statistics/264810/number-of-monthly...
- 4y ago
- joshe 4y agoWhatsApp also doesn't get screwed up by weird carrier sms integration like iMessage does. Just traveled overseas and used a different sim card with my phone. Not only does this screw up iMessage while overseas (it shouldn't), but for 2 weeks after getting back iMessage would occasionally just not receive texts. Did 3 Network resets and the last one (at 2 week mark) finally fixed it. I'm sure this is more verizon's fault, but Apple needs to work around it.
- oneplane 4y agoYou must have never had to transfer WhatsApp on a new carrier and find out that the carrier MITMs your SMS and you cannot activate that way and you have to ask your carrier for that. Not common in the US or western EU I suppose, but there are lots of countries that aren't in those areas and they have carriers too...
- aoetalks 4y agoI had this problem too. Call your carrier and convert your domestic SIM to an eSIM and pop a new physical one in. Turn off roaming on main SIM card and iMessage still works, but uses the data of the other SIM card.
- heystefan 4y agoUgh, this is the worst. And then people are like "why are you suddenly messaging me from this other account".
- dzhiurgis 4y ago
- dabedee 4y agoExcept you can never trust Facebook to care for user's metadata in a privacy-preserving way, which, to me at least, seems like a security risk. While the actual messages are encrypted, everything else (i.e the metadata such as your contacts, your connections, etc.) is not and is probably used/mined by Facebook. Why anyone would trust that company to do the right thing at this point is beyond me.
- tapoxi 4y agoThis is why I recommend friends & family use Signal, and they've actually adopted it due to the really easy on-boarding. It's probably the best iMessage alternative out there.
- zaik 4y agoThat's why I run an XMPP server for family and friends. It's the IETF standard, no vendor lock-in and has Signal-style encryption nowadays.
- ticviking 4y agoHow hard was it to onboard less tech savy friends and family?
- gchamonlive 4y agoI am not sure op actually runs that server or was just being sarcastic
- zaik 4y agoNot that hard. Everyone already knows how email works: you have to get an address first, download a client and login. I then showed them where to register (https://providers.xmpp.net https://providers.xmpp.net) and how to download Conversations. It got easier once a good chunk of my friend group was already available there.
- deleted 4y ago[deleted]
- dilap 4y agoOn the face of it, this is true. Since most people enable iCloud backups of messages, which are not encrypted, you should basically think of iMessage as unencrypted, unless you are very sure both you and the person you are messaging do not have iCloud backups enabled. On the other hand, I'm not sure how much to trust Zuck's claims of WhatsApp encryption, or if external people have attempted to verify the claims, but it seems like such a big deal to lie about, that it's probably true? Of course, that's only going to provide you passive protection from things like automated scanning of messages. If you become a target, it seems as though there are always exploits floating around which can be used to hack your phone, and then all bets off.
- sfvegandude 4y agoiCloud backups are encrypted, just not end to end. Which is as good as not encrypted.
- oneplane 4y agoHow good it is depends on the actor/threat model. I'd say that server-side encryption is always a good thing when you include someone trying to steal disks from a SAN array to see if there's tasty data on it. On the other hand, if your adversary wants to get your stuff, they will find a way. The whole cryptography thing is just imposing cost on a potential attacker, not a universal warranty against any possible attack. Someone can still locate you and beat you with XKCD's $5 wrench for your password. Ideally we'd have end-to-end encryption on everything without adding complexity for end-users. But a lot of that stuff seems to be hard to build and at least just as hard to retroactively bolt on to a system. iMessage (iChat) goes back a long time and supports many platforms (yes, within the apple ecosystem, that is) which means they can't easily nuke every legacy API at once.
- sfvegandude 4y ago> if your adversary wants to get your stuff, they will find a way. This is true, and to add to it: for state level actors, “wanting to get your stuff” expands to passive collection of data as well as well trodden paths to more targeted surveillance. End to end at least throws up a few more barriers.
- madeofpalk 4y agoMark Zuckerberg says his product is more secure than his competitors. I would expect him to say that, regardless of the 'truth'.
- AlexandrB 4y agoHe's probably right but, based on past experience, there's significant risk of Meta changing this in the future for revenue-generation reasons. Trust is hard to earn and easy to lose.
- annadane 4y agolol. Zuck, you spied on people with Onavo and kicked Acton and Koum out of the company, you have no moral standing whatsoever
- BiteCode_dev 4y agoOr, maybe or, they are both closed source and given the USA mass spying and secret tribunal we gotta assume they all have a backdoor. And that this backdoor has been found and exploited by black hats and corrupted employees or politicians.
- super256 4y agoExcept for the fact that a new exploit which allows RCE is found every year. It's beyond me how WhatsApp has had so many exploitable memory bugs compared to e.g. Signal or Telegram. Is it really just because security researchers would rather look at WA than Signal because of it's bigger user base?
- geophertz 4y agoExcept for the fact iMessage is well known for its RCEs as well: search for "iMessage RCE" you will find them. Furthermore (this may not be the case anymore), iMessage is more privileged than other apps and so once exploited an attacker has a far greater reach.
- super256 4y agoYup. That's why I don't use iMessage. :)
- nvrspyx 4y agoProbably because they're a large target and because it's more financially worthwhile. I imagine their bug bounty program pays out more, plus I know they've awarded $50,000 per research grant in the past.
- exabrial 4y agoIndependent Fact Checkers have confirmed this is false.
- geophertz 4y agoWould you mind sharing who those independent fact checkers are?
- danpalmer 4y agoI think it's a joke, this is the text that Facebook puts at the bottom of some false information. As with all jokes though, I think there's an element of truth to it. May not be independent fact checkers, but discussion in this thread covers the iMessage comparison and I wouldn't say it's as clear cut as Zuckerberg would like to make out.
- alphabettsy 4y agoApple should make iMessage backups E2E encrypted but I otherwise trust Fb far less.
- lvass 4y agoClient-side encrypted, rather.
- deleted 4y ago[deleted]
- mandeepj 4y agoNot true https://www.livemint.com/news/india/whatsapp-says-indian-govt-exceeded-powers-with-encryption-breaking-rule-11622092323703.html https://www.livemint.com/news/india/whatsapp-says-indian-gov...
- filmgirlcw 4y agolol. (I know we should have more substantive comments, but honestly, anything Mark says, I assume is false on its face)
- tpush 4y agoHe's not wrong in this case, though.
- mikro2nd 4y agoI agree with you regarding Zuckerberg -- he's in the same camp as every politician (imho). Nevertheless, if you don't have anything substantive to say, it's always an option to just not say anything. Just saying.
- filmgirlcw 4y agoI usually do refrain. This time, I just couldn't. In all honesty, replying with "lol." was at least the safe for work version of what was actually in my head.
- boomboomsubban 4y agoThen adopt Signal's GPL and prove it. Or any other free license. Until then, any claims are hollow.
- sleepybrett 4y agoShouldn't he be cracking a whip over at the 'legs in vr' division?
- wronex 4y agoI've been trying to figure out how end-to-end encrypted communication is supposed to work in these apps. From what I can gather you need two things, a central server, and public key encryption. To start a conversation your first task is getting the public key of your intended recipient. This is supplied by a central server that acts as a public key repository and message relay/store. Then you can send your message by leaving it at the central server for later delivery to the recipient (encrypted with their public key.) This is also the start of some form of key exchange in the hopes of switching to symmetric encryption for future communication. I see problems with this setup. The central server is responsible for relaying communication since there is no directly link between those trying to communicate. It is also responsible for handing out public keys. It is literally a man in the middle. What is stopping the central server from lying about the public keys? What is stopping the server from decrypting everything? Hopefully my understanding of this is wrong. It is certainly incomplete.
- deleted 4y ago[deleted]
- godelski 4y agoI think people are missing the point here. The reason he is calling it more secure is because it is multi-platform. iMessage isn't secure if you aren't talking to another iMessage user. Apple's walled garden is a great strength but also their Achilles heel. But of course, this is why I use Signal instead. If I'm going to use a 3rd party app, why not use one that is actually secure.
- annadane 4y agoBut given his history of acquiring the product he has no right to talk; what he did is blatantly criminal
- godelski 4y agoI'm not sure what that has to do with my comment though. I think we are all in agreement that Zuckerberg is not a "cool dude". But that seems relevant for a different thread and not a response to what I wrote.
- zhackay 4y agoIsn't WhatsApp messages sent to Apple's Push Servers without e2e encryption. Just stating the obvious
- laylomo2 4y agoThe Zuck cares about our security and privacy? Cute.
- quitit 4y agoThat's not a statement that is supported by Whatsapp's own privacy policy, and it's deliberately vague to subvert from how Meta uses your available data for advertising purposes. To use a few examples: - When sharing your location with a contact. This feature is provided by sending your location to Meta, not directly to the contact through E2EE. Even when not sharing your location Meta will approximate your location from your IP address and other available information such as the phone number area codes. For both of these scenarios Meta feed this information back into their system for other uses. - Your contacts, and all metadata are taken by Meta for their usual purposes. - Any kind of status update is immediately provided to Meta. Whatsapp's E2EE applies to only a specific subset of the app's functions. - There are a range of automatically collected pieces of information that the app provides whatsapp, anecdotal evidence also indicates that whatsapp reports back conversation keywords. Such reporting usually presents unseen security risks to users. Meta have been attempting to dilute the conversation about privacy and security by providing sly talking points for how their products are "private" and "secure". For example: They have stated that facebook is private because their servers are well maintained against hackers. They're currently heavily advertising whatsapp as secure because it offers E2EE messaging - neither of these statements address the underlying issue with Meta: it's an advertising company based on invasive data collection. Meta build profiles on users which are unacceptably detailed, we wouldn't trust our own elected representatives with such detailed profile building.
- randoglando 4y agoFrom a personal standpoint, why should I care about having profiles built for ad targeting anyway?
- quitit 4y agoThis would be a long reply that duplicates a lot of information you can find online about the dangers resulting from such profiling, such as how that information is shared and joined with other sources to accurately identify individuals. The short answer is that it's not just ad targeting and Meta have proven repeatedly that they're not good custodians of such data. Additionally this presents scenarios where such information can be subpoenaed - to use a recent example there are now legitimate concerns for such data since the rolling back of abortion rights in the USA.
- deleted 4y ago[deleted]
- emareg 4y agoOnly an open protocol like Matrix will end this race of platforms/apps for users and their data. WhatsApp or iMessage is not a real decision from a user perspective...
- dclaw 4y agoNever use any Zuckerberg products. Delete them all.