Hacker News Reader

> Every time an article about Whatsapp on HN or Reddit pops up I fearfully look to see if there are legitimate privacy concerns.

There are legitimate privacy concerns. The main concern here is that Facebook builds up a network of who you are in contact with, how often you message them, when you message them, etc.

You are either not aware of this or you don't mind, but calling it illegitimate is not a fair assessment of the risk.

What if this data is leaked, hacked or sold or Facebook is pressured to release it to certain governments and they use this data to find dissidents?

This data, in combination with other Facebook data, could also be used by advertisers to target people specifically with questionable offers and materials, etc. People might object to their data being sold this way.

What if the US regime changes to a dictatorship, I know, it might seem very far fetched that some insane barbarian becomes president, but bear with me. Facebook might be forced to reveal said information and the regime will then use this to find dissidents.

What you should be asking yourself is 'Why is this app, that costs millions to make and maintain, that was bought for billions, free for me?' There is someone out there making a profit. This might not be a big concern to you personally, but it is not an illegitimate concern.

+1 althought I'd replace "why is this thing free" with "what am I paying with"

Good point, because there IS a price.

Backup works android->android and iOS->iOS but not if you want to cross the lines; guess you don’t care about that... but:

If you use Google’s backup for WhatsApp, it is NOT encrypted. Your local backup IS encrypted. It’s not your data - you can’t have it except through the app. But google can (and does) have that data for likely 95% of android WhatsApp users; E2E with this state of affairs is not very useful. (I assume the iOS situation is similar, but don’t know for sure)

Also, a copy of your phone book, continuous IP (and likely location) and all your conversation metadata is stored on Facebook’s servers even if you don’t use the google drive backup.

Yes, WhatsApp is useful and works well, But the E2E aspect is false safety. For many practical purposes, you should assume there’s No encryption. For the purposes that inconvenience you, it’s obviously there.

Yeah the backup is really bad... WhatsApp put so much effort into the E2E encryption and then just dumped the backups on Google. It was all just window dressing.

I bet this is also why the intelligence agencies aren't pounding on them for having E2E encryption, obviously Google is an open book to them. And Google has access to all your history for their own purposes.

Of course you can choose to turn off the backups, but you can't be sure all your contacts are doing the same.

The idea of end-to-end encryption is just too broken. You always need to make sure that the implementation of the idea isn't controlled by the vendor from which it is supposed to protect you. But it is pretty much never the case, all the WhatsApps, Signals, etc. control implementations, updates and openly fight against attempts to decentralize or weaken that control, making sure that ultimately they are the ones deciding whether they get access to your data or not. At best it's just acts as a regular encryption with the vendor.

And while there is definitely no hope for binary blob consumer software to ever have real end-to-end encryption, there is hope that it could happen for open source software, distribution of which is not controlled by software vendors with many competing parties that package and ship it and an incentive not to sneak anything in because of that.

> The idea of end-to-end encryption is just too broken. You always need to make sure that the implementation of the idea isn't controlled by the vendor from which it is supposed to protect you. But it is pretty much never the case, all the WhatsApps, Signals, etc. control implementations, updates and openly fight against attempts to decentralize or weaken that control, making sure that ultimately they are the ones deciding whether they get access to your data or not.

Note that the client side apps are available for researchers to study. If they find a back door, it will be a big publicity issue for the app vendor.

Your concern is still valid though. Both Whatsapp and Signal could announce tomorrow that they drop E2EE or add some feature (like a default on non-disable-able cloud based spellchecker) and there is nothing you could do to protect your correspondence.

Matrix is different here that it encourages independent implementations as well as end to end encryption.

They say, back-up encryption is supposed to work soon.

https://www.digitalinformationworld.com/2020/03/whatsapp-tes...

But even if, WhatsApp remains a closed source app, owned by Facebook. I really see no reason to trust them. Zuckerbergs privacy policy seems unchanged, since he called his user dumb fucs for trusting him with their data, while at the same time, buying the surrounding houses of his Villa, to protect his own privacy.

The only thing holding them back is a bit public image, but the general population do not care much and maybe breaking of privacy laws. But since the governments also really do not want real encryption for everyone, I would rather imagine "gentlements agreement" behind doors, than real investigations, in case for example WhatsApp would secretly send also the key for the backup to someone else.

Whilst it does not work natively, there are working 3rd party products that let you backup on Android and restore on iPhone. Or at least there were 2.5 years ago.

> great desktop app

Beg to differ. The Windows WhatsApp App has full permissions to use your entire machine, change your register, use your camera and mic without notification, read and or modify all your files, scan your network, watch all network traffic, catalog all the apps you have and see what they are doing, and use/access any all peripherals

No, that is not a "great app". Especially coming from Facebook.

Use the web app then. Once you're on the page use one of the "shortcut" features of Chrome or Edge and you can open it as a separate app.

I understand you're trying to be helpful but the parent comment is still correct that one should not trust Whatsapp

Yes and I didn't say otherwise, I simply offered a sandboxed alternative.

FD: I'm an iPhone user. (not a die-hard, but I haven't found a decent android I can get along with permanently).

Aside from the number of people (network effects) on WhatsApp, what does it have over something like telegram, signal or any of the other cross-platform messengers?

Devils advocate for a moment:

Signal is pretty consistent, for a "no frills" chat solution, the UX is worse but it is still consistent across platforms.

Telegram does everything WhatsApp does but "better", native desktop apps, voice calling is clearer, it still very consistent. You can even have "usernames"; the UX is clearly superior. But the security model is questionable.

And if the answer is: "but network effects", why not Facebook messenger? it has the same reach if not greater.

So, why WhatsApp?

(this is a genuine question, I'm not trolling).

>I'm an iPhone user. (not a die-hard, but I haven't found a decent android I can get along with permanently

Try Google Pixel. Always have been an Android user and the Pixel has the Android experience imo.

> Aside from the number of people (network effects)

Network effects is it.

> if the answer is: "but network effects", why not Facebook messenger?

This is a good point, and I'm not really sure, but some guesses:

- Branding. During it's initial growth WhatsApp was a FB alternative and FB was in decline. Even after acquisition, awareness of the ownership wasn't immediately widespread.

- Contextual app differentiation. Facebook didn't separate its messenger from it's main platform quickly enough and even when they did, they're both conceptually considered a single package. People these days like separation of contexts.

- Phone numbers. WhatsApp was hard-linked to your phone contacts from the off, making it familiar to SMS users. Facebook jumping on phone numbers has followed slowly in a less focused manner.

- Less confusion for tech-illiterate. There's no posts or pages or walls. It's just like SMS.

> it has the same reach if not greater.

Anecdotal, but I don't feel this is true anymore. I certainly know a lot more people without Facebook than without WhatsApp.

phone number pairing is not just about familiarity - a person's phone number is still a natural contact handle to put on a signature, business card etc. Being able to then WhatsApp this person is very powerful.

Where I live (Austria), Facebook messenger does not have the same reach as Whatsapp.

Pretty much everyone with a Smartphone has Whatsapp, but there are lots of people without a Facebook Account. These are mostly older people. There are also people (like me, but I know several others) who do have a Facebook account, but don't use it on their phone.

The really nice thing about Whatsapp is the installation experience. Just download the App from Google Play/Appstore. Start it. Confirm your phone number. And you can communicate with all your friends. Facebook is much harder in this regards. Signal is similar, "but network effects".

Not OP but I'll chime in. I have a range of devices myself and within in my social circle. I also live abroad from my family so good communication is key.

My work phone is an iPhone, my personal an Android, and across the family there is a multitude of old and new, Android and Apple.

Telegram is using (or used) some homebrew encryption protocol and I simply don't trust it. As it doesn't have a proper tried and tested encryption I'm not going to use it. (The encryption may have changed by now, as I haven't kept tabs on it.)

Signal is okay. There are 2 main things that irk me. Signal's Windows App is bad. Long loading times, bad UI. Keeps crashing for me. I also frequently video chat with family. Signal's quality is considerably worse than that of other services. The sound is choppy and video may or may not work. This is on all devices I own, regardless of network speed.

iMessage and FaceTime are good but platform locked. The video call quality on FaceTime is the best one across all services for me. The picture and sound is just significantly clearer than anywhere else. If I talk to family members with an Apple device I will generally use FaceTime.

WhatsApp still remains my main one for the simple reason that it gives me the best average experience across all devices and circumstances. Video and phone calls could be better but are acceptable. Chats are easy to use and work. Service quality is generally good. WhatsApp for me stands out because it doesn't really negatively stand out anywhere else. Yes, owned by Facebook is something I'm not entirely comfortable with, but right now, there simply isn't any other application that for me is consistently average across every platform.

> And if the answer is: "but network effects", why not Facebook messenger? it has the same reach if not greater.

The last message in my Facebook messenger is almost a year old when a single person wished me a happy birthday.

My WhatsApp is 'a bit' more active than that with 9 different groups / people in the past 7 days.

I know only a single person that doesn't use WhatsApp. He uses Signal over privacy concerns.

In my experience Facebook messenger usage is a rounding error.

I really dislike the Whatapp desktop experience, specifically the fact it's still going through Bluetooth using the phone even though I am on my desktop. Sometimes I leave my phone on another level in the house (yes I don't carry it around 24/7) and then Whatsapp desktop simply won't work as the distance is too great.

I prefer desktop apps that are 'standalone' such as Telegram's or Skype's.

It doesn't actually use Bluetooth. When you scan the QR code your browser pairs with your phone and messages are relayed back through WhatsApp servers between the two, so as long as both have an internet connection it should work regardless of where they are.

gotta repair every day though, from what I remember

Yep, it actually works terribly in my experience. It's very slow even for web apps, is unreliable in staying paired, and (at least for me) often has issues with file attachments. I would much prefer a standalone app like Signal or Telegram.

Works like a charm for me. I can't even remember when I paired this browser. Must have been months ago.

> Afaict, all my messages are still E2E encrypted, and all my stuff is saved to my Google Drive.

There’s two things here: who controls the endpoints and who controls the key exchange. For now, I’m less concerned with reading your texts on the end than anything else any other Facebook app does to ping back and track you. The key management to me seems to be less than paranoid.

Curious how your enthusiasm develops when they start injecting ads into their application chats. I haven't seen a single ad all year and will keep it that way.

> was early on the reply-swipe functionality

I’ve been using WhatsApp daily for years, how did I not know this? Thanks! (This is why I read HN)

What about metadata ?

Add to that great voice and video calls.

Skype is still way better for those. I use both regularly, WhatsApp has choppy video and phone-like audio whereas Skype has smooth video and HQ audio. I only use WA with contacts that don't have skype.