Hacker News Reader

Comment by boredatworkme | Hacker News Reader

Can someone help and dumb this down a little bit for me so that I can then explain to some of my friends who couldn't care too much about this change in policy?

For example: What should be my response to questions like: . "What kind of data can now be shared with FB versus what was shared earlier (if any)?"

. "Whatsapp chats are end to end encrypted so how can my data be shared with FB?"

. "As an individual, how different is Whatsapp sharing my data with FB for ad/tracking purposes versus what other networks such as Google do to serve ads? Let's say I'm interested in ice-cream and I chat with someone about it and a couple of days later, I get ads about ice-cream, but I choose to ignore those ads, then how am I impacted/affected?"

View on HN

The article says Whatsapp will now share:

    * User phone numbers
    * Other people’s phone numbers stored in address books
    * Profile names
    * Profile pictures and
    * Status message including when a user was last online
    * Diagnostic data collected from app logs

and already was getting:

    Purchases
    Financial information
    Location
    Contacts
    User content
    Identifiers
    Usage data and
    Diagnostics

Doesn't this mean that anybody agreeing to those terms needs to ask permission from each and everybody in their address book?

And if they don't, can I sue them (at least in the EU) or ask my contact to be removed before the agree to the terms?

technically it is facebook in violation of GDPR considering that all the data in the addressbook is easily considered personal data for a commercial entity and so facebook should ask the permission to each owner of those numbers before collecting them.

https://faq.whatsapp.com/general/contacts/about-contact-uplo...

Based on this they do not store information of users who have not signed up and only store a cryptographic hash. The hash isn't created on the device, so the servers definitely get it.

Just a small detail about cryptographic hash:

https://gdpr-info.eu/art-4-gdpr/

"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"

Cryptographic hash of phone number is still uniquely identifying natural person and is by GDPR still under the definition of personal data. The GDPR authors knew what they were doing - or they were lucky although also other parts of GDPR suggest that they had some technical think-tank behind it.

Anyway, hashing doesn't solve anything, whatever "obfuscation" is used/invented, as long as information points to "natural person" it is considered personal data.

There are just 10^9 phone numbers in Spain. Say 0.01 sec/hash (which is A LOT), you have 10^8 seconds. You can decrypt all the hashes in 0.3 years...

"Cryptographic hash" is as bullshit as "MD5 encrypted passwords".

Or you know just create a rainbow table of all the phone numbers in the world and match the hashes against that. Would probably be faster.

If I'm being optimistic, the hashes of a user's contacts are salted with the user's own phone number, so the space could be 10^18.

Their infra is generating those encryption certificates, so WhatsApp can very well decode the message and store it for further processing.

They will most likely share metadata about you with facebook to sell that data to push more ads into your face.

They may very well sell also data to insurance companies making it harder for you to get insurance.

Options are limited only by who would like to pay for info about you.

Its rather a question about “How much you value your privacy?”

Ps. Ppl using facebook from the go “do not care about their privacy” so I dont know how much more it will affect you.

> Their infra is generating those encryption certificates, so WhatsApp can very well decode the message and store it for further processing.

This is incorrect. The sender's device generates the key with which it encrypts outgoing messages. WhatsApp's infra cannot see the content of any messages sent.

(Source: ex-WhatsApp employee)

The issue I have with that statement is that it cannot be proven. There is no source code of whatsapp, so this could have been changed anytime.

I mean, it's certainly possible to have an administrative backdoor that just shares the local keys. Even when that wasn't the case when you worked there, and even if we believe that you say the truth: we still cannot be certain that this won't change on February 8th.

I mean, whatsapp was remotely exploitable for more than 5 years before it was discovered (just to make a point).

Yes, of course this can't be proven. I'm reasonably confident what I stated still holds but I can't be certain. If that's enough of a turn off for you then your best bet is to not use the service.

Appreciate your response. As a layman, if the service I'm using does not have access to any of the content of my messages, how would you (Whatsapp) be sharing my data? If whatsapp cannot read texts, images, location etc., then what gets shared with FB?

As https://www.whatsapp.com/legal/privacy-policy says, it's things like contact, status, profile pic, name, and so on.

Not buying this. There must be a backdoor for lawful access or the government's would have been after WhatsApp long time ago.

Encryption is useless is the remote party can silently rekey and be re-authenticated as legitimate silently.

WhatsApp could almost certainly perform active MITM

There is no need to rekey or do anything similar. Chats are available locally on the device, WhatsApp may simply implement a side channel to access those (they could already have one to satisfy agencies btw)

There's a configuration option you can enable which shows a message whenever the remote party changes their key (usually meaning they bought a new phone, in my limited experience), so it's not that silent. Yes, it's unfortunate that on WhatsApp this option defaults to disabled (to not confuse the newbies?), while on Signal (which uses the same protocol) this options defaults to enabled.

it doesn't matter. whatsapp client sees the plaintext (duh). nothing stopping the ad arm of FB to process this.

Clearly. As with any encryption, at some point it needs to be decrypted for human consumption, and since someone else wrote the code/maintains to do this it's not impossible something naughty/distasteful will happen with the content. I'm just correcting the notion that the encryption is all orchestrated centrally and that viewing the messages in transit is trivial.

3 years ago, my friend, an Indian fact-checker, showed me a screenshot of a WhatsApp screen, showing warning from WhatsApp that a message contains a dangerous link

This (the warning) is only possible if WhatsApp can read your messages

I'm guessing that they read your message on the app. So their claim (end-to-end encryption) is indeed true and correct.

But their app can and indeed has been reading your messages, for the past, at least, 3 years

Which I personally don't mind, when it's done fully automatically (no humans involved) and only for this kind of uses (to warn users of dangers)

WhatsApp (the app) can obviously read the messages. It can hash the links and check them the same way that browsers do. It doesn't have to happen server-side.

While true, you're being very generous.

It's how Google's safe browsing API works, so it's not unlikely.

Link previews are generated server-side, I think.

The app sends a request to a Facebook API for every link that you send/receive. Usually this returns the little image + text snippet that you see in the app, but obviously this could also return a message that the link is considered dangerous.

As a site owner you can probably see a request from a Facebook bot when a link to your site is shared on WhatsApp. (not sure how long they cache this)

How can you guarantee this? And how about received messages? How can you retrieve all your old messages/conversations when you install the app on a new device? Don't they come from WhatsApp servers? Just curious, not doubting that you are actually an ex-WhatsApp employee.

> How can you guarantee this?

I mean, I can't guarantee it. As others have said, it's not impossible that things have changed since I left or will change in the future. But I doubt it — e2e encryption is a big selling point for WA and something that is dear to the company's heart.

> And how about received messages?

It's the same deal — the sender encrypts the message with the the recipient's public key, and the recipient decrypts it with their private key (which was generated locally and never goes over the network).

> How can you retrieve all your old messages/conversations when you install the app on a new device? Don't they come from WhatsApp servers?

No, you can only get old messages from your old device or from a backup that went to the cloud somewhere (e.g. iCloud or Google backup). The messages on your phone are stored locally in a DB, so if you copy that DB to a new phone it'll have the new messages. WhatsApp doesn't store messages — they are only present on WA infra until acknowledged as received by the destination.

So it won't impact people who don't have an FB account?

I'm not sure it matters. You still have to agree to the policy first. Whether you have an FB account at the moment might change for you in the future right? So FB couldn't be handling all those cases as well. This is a strategic move I think will cover all users.

I think everybody has a (shadow) FB account. FB collects your data and connects it to other data even if you never registered.

How, apart from whatsapp, would it collect your data? The only social account(s) I have are on reddit.

https://news.ycombinator.com/item?id=20606961

Thank you for your response. I think I fully agree with the last line - those who do not care about privacy won't really be affected by this.

I have a question to ask. How would this work? Even if for a second we assume that they're able to read all our texts etc., how can they curate that information with insurance companies? What data might the insurance companies be interested in? I would not (and I'm assuming a lot of people would not) specifically enter my age/health issues/Blood Pressure information on Whatsapp.

> They may very well sell also data to insurance companies making it harder for you to get insurance.

Let's say they record your position every 15 minutes. (Position can be achieved via Wi-Fi AP names, cell towers, GPS). Let's say you commute everyday to work on a highway and your average speed is 100 Km/h with sometimes a top speed of 150 Km/h. Let's say your position shows that you're every workday near a pub from 17:50 to 19:00. Let's say you're never seen near a gym. Let's say you're sometimes near a medical center specialized in prostatic care. [To be continued]

> "Whatsapp chats are end to end encrypted so how can my data be shared with FB?"

I would stress to them the difference between the encrypted contents of a chat the metadata ("it's data about data!") of that chat.

Hopefully they will get it if you give an example of how just sending a message lets them profile you based on metadata like the exact time, geographic location, and recipient of the message, all without needing to see the contents. Encrypted messages sent from Truist Park at 2PM on a Sunday? Probably about baseball, etc etc.

Probably too high-level and wordy to share with a non-tech crowd but this is one of my favorite blog posts on this topic, from the immediately-post-Snowden era: https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

Reply on news.ycombinator.com