4 ms·

Tiktok has direct messages, they don't even call them private. It's better that they're honest about this, nobody should believe for a second that WhatsApp or

Tiktok has direct messages, they don't even call them private. It's better that they're honest about this, nobody should believe for a second that WhatsApp or FB messages are truly E2EE. DM on social media shouldn't be used for anything remotely private. It's a convenience feature, nothing more.

throw0101c 7mo ago
> Tiktok has direct messages, they don't even call them private. It may not be called that, but what are users expecting? Some folks may later be surprised when a warrant gets issued (e.g., from a divorce judge).
- giancarlostoro 7mo ago
  If you are a grown adult and dont do research on “messaging apps” (which Tik Tok is not) then thats really on you.
  - oarsinsync 7mo ago
    If you are a grown adult and don't do research on "<insert any topic that could have a material negative impact on your life, but that is not currently on your radar as being a topic that could have a material negative impact on your life>" then that's really on you. Unfortunately, this doesn't scale.
    - wizardforhire 7mo ago
      Well it does scale… just not in the way that is good for democracy.
    - hogwasher 7mo ago
      It definitely ignores that many people don't have time. If someone is working over 40 hours per week, plus maybe doing unpaid labor taking care of kids or elders, where are people supposed to find the time and energy to brush up on a million different topics they don't even know they might not know enough about? Especially if they might also have medical issues, or hobbies, or want to have any time at all to relax. Obviously, one way to improve the situation would be to make sure people are paid fairly and not overworked and have access to good and affordable or free childcare and elder-care and medical care, but corporations don't want that either. If anything, they're incentivised to disempower workers and keep them uninformed, and to get as much time out of them as they can for as little money as possible.
  - foobarchu 7mo ago
    This viewpoint isn't a slippery slope, it's a runaway train. "You moved into a neighborhood with lead pipes? That's on you, should have done more research" "Your vitamins contained undisclosed allergens? You're an adult, and it didn't say it DIDN'T contain those" "Passwords stolen because your provider stored them in plaintext? They never claimed to store them securely, so it's really on you"
    - sleepybrett 7mo ago
      this isn't anything new, however. No messaging has been actually private since forever, that's why encryption was invented. To keep secrets and to pass those secrets in a way that can be observed without revealing the secret. Telephones can be tapped, people sold special boxes that would encrypt/decrypt that audio before passing it to the phone or to the ear. Mail can be opened, covertly or not. AIM was in the clear (I think at one point, fully in the clear, later probably in the clear as far as the aol servers were concerned)... Unless the app/method is directly lying to users about being e2ee it's not a slippery slope, it's the status quo. Now there are some apps out there that I think i've seen that are lying. They are claiming they are 'encrypted' but fail to clarify that it's only private on the wire, like the aim story.. the message is encrypted while it flys to the 'switchboard' where it's plain text and then it's put wrapped in encryption on the wire to send it to the recipient. The claim here that actually makes me chuckle is somehow trying to paint e2ee as 'unsafe' for users.
    - AlexandrB 7mo ago
      Legislating that everyone must always be safe regardless of what app they use is a one-way ticket to walled gardens for everything. This kind of safety is the rationale behind things like secure boot, Apple's App Store, and remote attestation. Also consider what this means for open source. No hobbyist can ship an IM app if they don't go all the way and E2E encrypt (and security audit) the damn thing. The barriers of entry this creates are huge and very beneficial for the already powerful since they can afford to deal with this stuff from day one.
      - londons_explore 7mo ago
  - red-iron-pine 7mo ago
    80% of the population does not and will never do that level of deep dive on apps same discussion for any form of technology be it TVs or changing their car's oil the deliberate app-store-ification of all things computer is also designed to keep people from asking those questions -- just download in and install, pleb. it's why the Zoomers can't email attachments or change file types: all of the computers they grew up with were designed so they never had to understand what happens under the hood.
    - johnisgood 7mo ago
      And I think because of all the handholding we are left worse off.
      - hogwasher 7mo ago
        Most people couldn't tell you how their car works, at least not enough to fix it. Is that handholding, too? People can't be knowledgable about everything. There's just too much information in the world, and too many different skills that could be learned, and not enough time. A carpenter can rely on power tools without understanding fully how the tools work, and it's fine, as long as the tools are made to safe standards and the user understands basic safety instructions (e.g. wear protective eyewear). To me, making sure that apps don't screw with people, even if they don't understand how the apps work, is roughly the equivalent of making sure power drills are made safely so they don't explode in peoples' hands.
        throw0101c 7mo ago
        > Most people couldn't tell you how their car works […] Most people couldn't tell you how their furnace or water heater works, or flush toilet (siphonic effect).
        johnisgood 7mo ago
        And I never said that people should be knowledgeable about everything... ... and this is not what I was referring to either. Less handholding -> more learning... but even then, what I meant is that you do not have to be knowledgeable to know that your "private messages" are not really encrypted and can be read by the admin (in case of forums, for one), and so forth.
throwaway290 7mo ago
> nobody should believe for a second that WhatsApp or FB messages are truly E2EE That's interesting. You think all firms that audited WhatsApp and Signal protocol used by WhatsApp and all programmers who worked there for decades and can see a lie and leak if it was true are all crooks? valid opinion I guess, but I won't call it "no one should believe for a second (curious you didn't mention Telegram, it is actually marketed as secure and e2e and it has completely gimped "secret chats" that are off by default and used by like almost nobody.)
- giancarlostoro 7mo ago
  I forget if its WhatsApp that technically lets you sync chats in unencrypted form to iCloud which is the “loophole” around this, though you can lockdown your iCloud even tighter, not sure it Apple can do much if you fully lock down your iCloud, not sure if this has been legally tested? Its not a very advertised feature its just a setting.
  - throwaway290 7mo ago
    Right now it got a switch to enable e2e for backups, but yeah I think default backup is probably a workaround...
  - gzread 7mo ago
    The Android version syncs all your chat logs to Google Drive without encryption by default. That's the backdoor.
  - oarsinsync 7mo ago
    WhatsApp iPhone syncs to iCloud unencrypted by default[1]. iMessage also syncs to iCloud unencrypted by default[2]. [1] Depends on you paying for iCloud storage, so that you have space for a full phone backup to occur. [2] Might be "free" with "iMessage in iCloud", an option to enable separately.
    - throwaway290 7mo ago
      > WhatsApp iPhone syncs to iCloud unencrypted by default[1]. Not true. You must choose to enable it or not when you set up new phone. On mine it does not back up
eloisant 7mo ago
Honestly I'm tired with every app trying to become the everything app. Now TikTok wants to be a messaging app. Snapchat has a short video feed just like TikTok. WhatsApp only has a text feed, how long until they also add a video feed?
- vedaba 7mo ago
  Meta already has video feeds in facebook and instagram though, I imagine they wouldn’t want to detract users from those
dvngnt_ 7mo ago
> nobody should believe for a second that WhatsApp or FB messages are truly E2EE. Meta still tracks analytics which isn't good for privacy, but I'm not aware of any news of them or 3rd parties reading messages without consent of one of the 1st parties? Signal is probably much better though
- pixl97 7mo ago
  >I'm not aware of any news of them Yet. Until they say "We delete these messages after X time and they are gone gone, and we're not reading them" Assume they are reading them, or will read them and the information just hasn't got out yet. I mean we keep finding more and more cases where companies like FB and Google were reading messages years ago and it wasn't till now we found out.
  - nindalf 7mo ago
    > We delete these messages after X time They never had the plaintext of the messages in the first place, so they don't need to delete them. That's what end-to-end encrypted means.
    - hogwasher 7mo ago
      Whether Facebook/Meta can read the plain text of the messages or not depends on whether that encryption is "zero knowledge" or not, aka: does Facebook generate and retain the private encryption key, or does it stay on the users' devices only, never visible to Facebook or stored on Facebook servers? In the former case, Facebook can decrypt the messages at will, and the e2ee only protects against hackers, not Facebook itself, nor against law enforcement, since if Facebook has the decryption key they can be legally compelled to hand it over (and probably would voluntarily, going by their history).
      - Rubberducky1324 7mo ago
        They use the Signal protocol. The keys are not generated by Facebook, and are never on their servers. They are generated on the devices themselves.
s3p 7mo ago
Way to dunk on OP I guess but nobody is playing semantics here, it's just whether people think this is a messaging channel with one intended recipient

throw0101c 7mo ago

> Tiktok has direct messages, they don't even call them private. It may not be called that, but what are users expecting? Some folks may later be surprised when a warrant gets issued (e.g., from a divorce judge).

giancarlostoro 7mo ago
If you are a grown adult and dont do research on “messaging apps” (which Tik Tok is not) then thats really on you.
- oarsinsync 7mo ago
  If you are a grown adult and don't do research on "<insert any topic that could have a material negative impact on your life, but that is not currently on your radar as being a topic that could have a material negative impact on your life>" then that's really on you. Unfortunately, this doesn't scale.
  - wizardforhire 7mo ago
    Well it does scale… just not in the way that is good for democracy.
  - hogwasher 7mo ago
    It definitely ignores that many people don't have time. If someone is working over 40 hours per week, plus maybe doing unpaid labor taking care of kids or elders, where are people supposed to find the time and energy to brush up on a million different topics they don't even know they might not know enough about? Especially if they might also have medical issues, or hobbies, or want to have any time at all to relax. Obviously, one way to improve the situation would be to make sure people are paid fairly and not overworked and have access to good and affordable or free childcare and elder-care and medical care, but corporations don't want that either. If anything, they're incentivised to disempower workers and keep them uninformed, and to get as much time out of them as they can for as little money as possible.
- foobarchu 7mo ago
  This viewpoint isn't a slippery slope, it's a runaway train. "You moved into a neighborhood with lead pipes? That's on you, should have done more research" "Your vitamins contained undisclosed allergens? You're an adult, and it didn't say it DIDN'T contain those" "Passwords stolen because your provider stored them in plaintext? They never claimed to store them securely, so it's really on you"
  - sleepybrett 7mo ago
    this isn't anything new, however. No messaging has been actually private since forever, that's why encryption was invented. To keep secrets and to pass those secrets in a way that can be observed without revealing the secret. Telephones can be tapped, people sold special boxes that would encrypt/decrypt that audio before passing it to the phone or to the ear. Mail can be opened, covertly or not. AIM was in the clear (I think at one point, fully in the clear, later probably in the clear as far as the aol servers were concerned)... Unless the app/method is directly lying to users about being e2ee it's not a slippery slope, it's the status quo. Now there are some apps out there that I think i've seen that are lying. They are claiming they are 'encrypted' but fail to clarify that it's only private on the wire, like the aim story.. the message is encrypted while it flys to the 'switchboard' where it's plain text and then it's put wrapped in encryption on the wire to send it to the recipient. The claim here that actually makes me chuckle is somehow trying to paint e2ee as 'unsafe' for users.
  - AlexandrB 7mo ago
    Legislating that everyone must always be safe regardless of what app they use is a one-way ticket to walled gardens for everything. This kind of safety is the rationale behind things like secure boot, Apple's App Store, and remote attestation. Also consider what this means for open source. No hobbyist can ship an IM app if they don't go all the way and E2E encrypt (and security audit) the damn thing. The barriers of entry this creates are huge and very beneficial for the already powerful since they can afford to deal with this stuff from day one.
    - londons_explore 7mo ago
- red-iron-pine 7mo ago
  80% of the population does not and will never do that level of deep dive on apps same discussion for any form of technology be it TVs or changing their car's oil the deliberate app-store-ification of all things computer is also designed to keep people from asking those questions -- just download in and install, pleb. it's why the Zoomers can't email attachments or change file types: all of the computers they grew up with were designed so they never had to understand what happens under the hood.
  - johnisgood 7mo ago
    And I think because of all the handholding we are left worse off.
    - hogwasher 7mo ago
      Most people couldn't tell you how their car works, at least not enough to fix it. Is that handholding, too? People can't be knowledgable about everything. There's just too much information in the world, and too many different skills that could be learned, and not enough time. A carpenter can rely on power tools without understanding fully how the tools work, and it's fine, as long as the tools are made to safe standards and the user understands basic safety instructions (e.g. wear protective eyewear). To me, making sure that apps don't screw with people, even if they don't understand how the apps work, is roughly the equivalent of making sure power drills are made safely so they don't explode in peoples' hands.
      - throw0101c 7mo ago
        > Most people couldn't tell you how their car works […] Most people couldn't tell you how their furnace or water heater works, or flush toilet (siphonic effect).
      - johnisgood 7mo ago
        And I never said that people should be knowledgeable about everything... ... and this is not what I was referring to either. Less handholding -> more learning... but even then, what I meant is that you do not have to be knowledgeable to know that your "private messages" are not really encrypted and can be read by the admin (in case of forums, for one), and so forth.

throwaway290 7mo ago

> nobody should believe for a second that WhatsApp or FB messages are truly E2EE That's interesting. You think all firms that audited WhatsApp and Signal protocol used by WhatsApp and all programmers who worked there for decades and can see a lie and leak if it was true are all crooks? valid opinion I guess, but I won't call it "no one should believe for a second (curious you didn't mention Telegram, it is actually marketed as secure and e2e and it has completely gimped "secret chats" that are off by default and used by like almost nobody.)

giancarlostoro 7mo ago
I forget if its WhatsApp that technically lets you sync chats in unencrypted form to iCloud which is the “loophole” around this, though you can lockdown your iCloud even tighter, not sure it Apple can do much if you fully lock down your iCloud, not sure if this has been legally tested? Its not a very advertised feature its just a setting.
- throwaway290 7mo ago
  Right now it got a switch to enable e2e for backups, but yeah I think default backup is probably a workaround...
- gzread 7mo ago
  The Android version syncs all your chat logs to Google Drive without encryption by default. That's the backdoor.
- oarsinsync 7mo ago
  WhatsApp iPhone syncs to iCloud unencrypted by default[1]. iMessage also syncs to iCloud unencrypted by default[2]. [1] Depends on you paying for iCloud storage, so that you have space for a full phone backup to occur. [2] Might be "free" with "iMessage in iCloud", an option to enable separately.
  - throwaway290 7mo ago
    > WhatsApp iPhone syncs to iCloud unencrypted by default[1]. Not true. You must choose to enable it or not when you set up new phone. On mine it does not back up

eloisant 7mo ago

Honestly I'm tired with every app trying to become the everything app. Now TikTok wants to be a messaging app. Snapchat has a short video feed just like TikTok. WhatsApp only has a text feed, how long until they also add a video feed?

vedaba 7mo ago
Meta already has video feeds in facebook and instagram though, I imagine they wouldn’t want to detract users from those

dvngnt_ 7mo ago

> nobody should believe for a second that WhatsApp or FB messages are truly E2EE. Meta still tracks analytics which isn't good for privacy, but I'm not aware of any news of them or 3rd parties reading messages without consent of one of the 1st parties? Signal is probably much better though

pixl97 7mo ago
>I'm not aware of any news of them Yet. Until they say "We delete these messages after X time and they are gone gone, and we're not reading them" Assume they are reading them, or will read them and the information just hasn't got out yet. I mean we keep finding more and more cases where companies like FB and Google were reading messages years ago and it wasn't till now we found out.
- nindalf 7mo ago
  > We delete these messages after X time They never had the plaintext of the messages in the first place, so they don't need to delete them. That's what end-to-end encrypted means.
  - hogwasher 7mo ago
    Whether Facebook/Meta can read the plain text of the messages or not depends on whether that encryption is "zero knowledge" or not, aka: does Facebook generate and retain the private encryption key, or does it stay on the users' devices only, never visible to Facebook or stored on Facebook servers? In the former case, Facebook can decrypt the messages at will, and the e2ee only protects against hackers, not Facebook itself, nor against law enforcement, since if Facebook has the decryption key they can be legally compelled to hand it over (and probably would voluntarily, going by their history).
    - Rubberducky1324 7mo ago
      They use the Signal protocol. The keys are not generated by Facebook, and are never on their servers. They are generated on the devices themselves.

s3p 7mo ago

Way to dunk on OP I guess but nobody is playing semantics here, it's just whether people think this is a messaging channel with one intended recipient