3 ms·

How is WhatsApp safer to use than Microsoft Teams?

by Goronmon 1y ago

cubefox 1y ago
WhatsApp is always end-to-end encrypted, Teams only in certain cases.
- JumpCrisscross 1y ago
  > WhatsApp is always end-to-end encrypted, Teams only in certain cases Which is an anti-feature given this application: you want a certain level of oversight and control over what staffers communicate.
  - cubefox 1y ago
    Their statement doesn't sound like what you said at all: > The Office of Cybersecurity has deemed WhatsApp a high-risk to users due to the lack of transparency in how it protects user data, absence of stored data encryption, and potential security risks involved with its use (Of course that statement seems to be highly confused overall. What "stored data encryption"?)
    - alwa 1y ago
      Does WhatsApp encrypt the data on the device after it’s received and decrypted at your phone’s end (then stored indefinitely)? I thought the term of art was “encrypted at rest,” but “stored data encryption” makes sense to me too. I was of the impression that Whatsapp’s messages (and its backups, photos, etc) kind of just hung around in plaintext once they reached the device. Which would seem to be a problem should the device be stolen, or observed by other applications on the phone or a tethered device, or twiddled with sneaky hardware (e.g. [0]) that might use physical means to access the device’s file system. Although as I understand it, the privacy claims are kind of window dressing anyway, and Meta has been more than willing to share plenty of WhatsApp’s data with all and sundry… even before AI-in-the-same-search-bar came along [1] [0] https://shop.hak5.org/products/omg-cable https://shop.hak5.org/products/omg-cable [1] https://www.propublica.org/article/how-facebook-undermines-privacy-protections-for-its-2-billion-whatsapp-users https://www.propublica.org/article/how-facebook-undermines-p...
      - cubefox 1y ago
        > Does WhatsApp encrypt the data on the device after it’s received and decrypted at your phone’s end (then stored indefinitely)? The operating system (Android/iOS) encrypts everything anyway. Why would you double that? More to the point, do any of the other "safe" apps, like iMessage, do that?
- thesuitonym 1y ago
  If you think end-to-end encryption is the only thing that matters in security, then yeah sure, WhatsApp is more secure. Personally, I'd be embarrassed to let people know I thought that way, but to each their own.
  - cubefox 1y ago
    So you would potentially prefer an app without end-to-end encryption to WhatsApp? What are these important security features?
    - Volundr 1y ago
      Message retention, audit logging, SSO to name a few off the top of my head.
    - macNchz 1y ago
      Lack of complete e2ee is a feature for many large organizations—they still want everything encrypted, they just want a master key to be able to audit communications for compliance/investigations/insider threat identification. They also want strict control over who does what with the app, and where all of the associated data lives. Teams is just a totally different product from WhatsApp in that regard, with all sorts of functionality that will never exist in WhatsApp—tons of control over user identity and access management, integration with all sorts of other security tooling, etc.
    - kube-system 1y ago
      E2EE is mostly useful for consumer applications, where you trust the endpoint (yourself), but not the intermediary servers (some megacorp that doesn't care about you). The situation is entirely different when you are managing very large organizations. In those situation, you don't necessarily need the need the data to be invisible to the intermediary servers, because you might either just be able to control them yourself, secure them with NDAs, etc. And if the server is controlled by you, then you might not even want the data to be invisible to yourself. But, your primary risks may be the compromise of endpoint devices, mistakes or leaks by your users, or a lack of controls over data exchange. Also, many organizations may need to provide records of their internal communications in order to comply with legal requirements. You might be surprised to know that enterprise offerings of many apps that otherwise support E2EE, often have a way for administrators to intentionally turn those features off.

How is WhatsApp safer to use than Microsoft Teams?

cubefox 1y ago

WhatsApp is always end-to-end encrypted, Teams only in certain cases.

JumpCrisscross 1y ago
> WhatsApp is always end-to-end encrypted, Teams only in certain cases Which is an anti-feature given this application: you want a certain level of oversight and control over what staffers communicate.
- cubefox 1y ago
  Their statement doesn't sound like what you said at all: > The Office of Cybersecurity has deemed WhatsApp a high-risk to users due to the lack of transparency in how it protects user data, absence of stored data encryption, and potential security risks involved with its use (Of course that statement seems to be highly confused overall. What "stored data encryption"?)
  - alwa 1y ago
    Does WhatsApp encrypt the data on the device after it’s received and decrypted at your phone’s end (then stored indefinitely)? I thought the term of art was “encrypted at rest,” but “stored data encryption” makes sense to me too. I was of the impression that Whatsapp’s messages (and its backups, photos, etc) kind of just hung around in plaintext once they reached the device. Which would seem to be a problem should the device be stolen, or observed by other applications on the phone or a tethered device, or twiddled with sneaky hardware (e.g. [0]) that might use physical means to access the device’s file system. Although as I understand it, the privacy claims are kind of window dressing anyway, and Meta has been more than willing to share plenty of WhatsApp’s data with all and sundry… even before AI-in-the-same-search-bar came along [1] [0] https://shop.hak5.org/products/omg-cable https://shop.hak5.org/products/omg-cable [1] https://www.propublica.org/article/how-facebook-undermines-privacy-protections-for-its-2-billion-whatsapp-users https://www.propublica.org/article/how-facebook-undermines-p...
    - cubefox 1y ago
      > Does WhatsApp encrypt the data on the device after it’s received and decrypted at your phone’s end (then stored indefinitely)? The operating system (Android/iOS) encrypts everything anyway. Why would you double that? More to the point, do any of the other "safe" apps, like iMessage, do that?
thesuitonym 1y ago
If you think end-to-end encryption is the only thing that matters in security, then yeah sure, WhatsApp is more secure. Personally, I'd be embarrassed to let people know I thought that way, but to each their own.
- cubefox 1y ago
  So you would potentially prefer an app without end-to-end encryption to WhatsApp? What are these important security features?
  - Volundr 1y ago
    Message retention, audit logging, SSO to name a few off the top of my head.
  - macNchz 1y ago
    Lack of complete e2ee is a feature for many large organizations—they still want everything encrypted, they just want a master key to be able to audit communications for compliance/investigations/insider threat identification. They also want strict control over who does what with the app, and where all of the associated data lives. Teams is just a totally different product from WhatsApp in that regard, with all sorts of functionality that will never exist in WhatsApp—tons of control over user identity and access management, integration with all sorts of other security tooling, etc.
  - kube-system 1y ago
    E2EE is mostly useful for consumer applications, where you trust the endpoint (yourself), but not the intermediary servers (some megacorp that doesn't care about you). The situation is entirely different when you are managing very large organizations. In those situation, you don't necessarily need the need the data to be invisible to the intermediary servers, because you might either just be able to control them yourself, secure them with NDAs, etc. And if the server is controlled by you, then you might not even want the data to be invisible to yourself. But, your primary risks may be the compromise of endpoint devices, mistakes or leaks by your users, or a lack of controls over data exchange. Also, many organizations may need to provide records of their internal communications in order to comply with legal requirements. You might be surprised to know that enterprise offerings of many apps that otherwise support E2EE, often have a way for administrators to intentionally turn those features off.