WhatsApp Beaten by Apple’s New iMessage Privacy Update | Hacker News Reader

WhatsApp Beaten by Apple’s New iMessage Privacy Update

forbes.com

353 pointsTomte191 comments

The image halfway down the article showing the privacy “nutritional label” comparison from Signal to iMessage to WhatsApp to Facebook is such a beautiful case study in UI design.

Everything in the label is “bad”. The best label is an empty label. It gives you the instant scale of the kinds of data being collected without any noise or wasted characters, and then if you want to actually look closer and see what’s going on the detailed breakdown of all the different types of tracking is striking.

No legalese. No filler. No double-speak about how it’s improving the product. Just here’s what’s tracked. Perhaps inspired by how the FDA does “black box warnings” when there is crucial information they need to relate about possible dangers of a drug.

Now, gushing praise aside, making sure the labels are truly accurate is the hard part. For example, I’m not sure how iMessage can claim it doesn’t track payments when I use it to actually make payments, but I guess the point is aside from the system that actually processed the payment that iMessage itself is not using any metadata of that payment. Very interesting distinction which boils down to whether a bullet item might show up in the box or not.

> Very interesting distinction which boils down to whether a bullet item might show up in the box or not.

This is the biggest compliment to the UI Apple designed.

Because it's exactly the conversation we should be having, and that users actually care about.

Either you are hitting an API or you aren't. And that causes a bullet item to appear.

What you're doing with that information is debatable -- and Facebook is welcome to debate that they're "really not actually using all the massive amount of information they're collecting."

But users deserve to see the superset of collection clearly, as a starting point.

> Either you are hitting an API or you aren't. And that causes a bullet item to appear.

That's not really how it works.

The same type of data can appear in multiple categories, and there are exceptions that mean you don't have to list certain usages.

https://developer.apple.com/app-store/app-privacy-details/

For example, if your app doesn't ordinarily collect email addresses, but you have a contact form for support purposes that does collect them, you don't need to list email address as being collected.

The privacy label doesn't really cover the app - it covers what the services that the app connects to do. An entirely offline app shouldn't need to list anything on the label, even if it does use APIs like location.

The difference (vs Android) is a default expectation of disclosure, no? Whether enforced or declared?

Google doesn't really care if its app developers lie out of the side of their mouth. Apple is saying they do.

(I'm in no way an Apple fanboy, but I think they deserve kudos for changing the starting point for this discussion)

It's long been the case that companies legally have to disclose what data they collect and what they do with it in their Privacy Policy/Notice. That applies to services on any platform, including iOS, Android, or the web.

I think that the Privacy Label is a "one size fits all" box ticking exercise, that a lot of people are going to ignore/not understand.

When all of the most popular apps state that they collect a lot of data, there's no reason for people to think any given app is "bad".

That was GP's point, IMHO.

Do you think more people read privacy policies from start to finish and understand them, vs will look at Apple's label and understand it?

The perfect is the enemy of both the good and progress.

> That was GP's point, IMHO.

I thought the point was more that until now, app developers have been able to keep how they use data quiet, and that Apple is forcing them to reveal what they do.

That's not really the case, the data is just in a format that people can't be bothered to read (Privacy Notice).

I think that Apple's format is better in some ways, but not others.

There are a lot of possible types of data, but they can each appear in multiple categories. Developers can't justify why they use data in a privacy label, so it's difficult for people to tell exactly how the data collection would affect them (if at all), and whether it's justified or not.

An interesting idea for Apple Pay feature could be to allow its users to and apps to negotiate fees for API hits i.e. allow users to get paid by Facebook if it wants their data.

>Now, gushing praise aside, making sure the labels are truly accurate is the hard part. For example, I’m not sure how iMessage can claim it doesn’t track payments when I use it to actually make payments, but I guess the point is aside from the system that actually processed the payment that iMessage itself is not using any metadata of that payment. Very interesting distinction which boils down to whether a bullet item might show up in the box or not.

It's a classic "lies, damn lies, and statistics" scenario. The graphic might be technically correct but it's misleading in a way to spread a specific message. It irks me that this image keeps being spread all over.

The thing people should actually care about isn't if iMessage stores/uses this information, but if the organization in control of iMessage stores/uses it. It's just like I don't really care if the WhatsApp app stores all this info, the actual problem is if Facebook (the company) uses it for some reason. WhatsApp (the app) just happens to be one of the avenues that this data is collected.

For iMessage, sure, maybe technically iMessage isn't collecting my payment information... but Apple still gets it via the Wallet app. Maybe iMessage isn't storing my location history, but Apple still is through the iPhone location history. Maybe iMessage isn't watching my app usage history, but Apple Screen Time sure is. This applies to all of the things listed as bad under the WhatsApp label.

Secondarily, the graphic is also misleading because the WhatsApp side of it becomes artificially larger since most of the items are listed twice. It immediately causes you to think "WhatsApp collects a lot more" due to the size of the box, but in reality the box could be collapsed to half the size. It just so happens that the way Apple chose to present this information makes it seem like WhatsApp collects twice the data.

Personally (perhaps naively) I do trust Apple with this information more than Facebook, but the graphic is still misleading by implying that it isn't being collected and used in some way.

Does Apple get your payment information? I thought one of the selling points of Apple Pay is that Apple cannot collect your transaction data.

So to avoid confusion: there's two sources of "payment information" that might get confused with Apple. There's Apple Pay (which has no WhatsApp equivalent AFAIK) and Apple Cash (which is the equivalent of WhatsApp Pay).

When using Apple Pay, Apple obviously stores your payment methods and for some cards, the Wallet app stores your transaction history. However, the Apple privacy policy for Apple Pay says they only use anonymized transaction history for their analytics.

But there is also Apple Cash. Apple Cash's privacy policy says that they do collect non-anonymized information on your transactions (and communication history from messages, email, and calls!), but they promise to only use it if they deem it necessary [1]. Take that as you will.

>To assist Apple Payments Inc. in preventing fraud when you are using Apple Cash to send, request, and receive money, Apple Inc. may provide it with approximate use patterns from your device about how frequently you communicate with that person by phone, email, or in Messages. No content of your communication is collected. This information is stored for a limited time, and in such a way that it is not linked to you unless the transaction with which it is associated is determined to require further analysis due to suspicious activity.

Again, I do trust Apple more than I trust FB to only use it when necessary... but they are still collecting it.

1: https://support.apple.com/en-us/HT210701

Thanks! Very helpful

It's also misleading to have an empty box: with Signal your phone number (even if it's a Google Voice or Twilio VoIP number) must be known or the system cannot work. I hear that Signal is apparently working on a feature to allow you to set up an account without a phone number but until that time I think it's in second place behind Wire (which only requires an email address to start an account).

The section of the privacy label highlighted in these articles is about data that apps collect that is then linked to your identity (e.g. to an account).

There is a separate section of the label for listing data that is collected as part of the app's functionality, but then not linked to an account or other user identity - that is where Signal lists phone number.

WhatsApp and Apple Messages collect data and link it to your account(s) with them. Signal collects your phone number, but doesn't link it to anything.

Does that mean a signal user can't change phone numbers without getting a new identity?

I haven't looked at Signal in a while.

In Signal, a phone number is your identity. So intrinsically, yes, you have to get a new identity with a new number: https://support.signal.org/hc/en-us/articles/360007062012-Ne...

And this is a real problem because you don't really own your phone number: it's leased to you for as long as you pay for it but I don't think there is anything to prevent a telco (or VoIP service like Twilio) from taking that number back from you. This is another problem inherent in using a phone number as the source of your identity on a service. Email addresses are better but can still be subject to seizure. Perhaps the answer is what Session is doing: you get a GUID is that is assigned to you and that will never be assigned to anyone else.

Threema generates a short alphanumeric id, that is easily sharable. It will also generate QR code for you, so other people do no have to type them, just scan them.

Not the case, my Signal is linked to my old phone number, it is, in fact, the only piece of my identity web which is.

I wonder, sometimes, what would happen when someone else acquires that phone number and tries to sign up for Signal...

The case with Telegram is they overtake your account, and it might be the same with Signal.

Sorry, maybe that's not clear; I have multiple phone numbers.

Does that mean I have to unregister and reregister to get my other identity? Or does Signal support multiple identities?

You have to unregister and reregister the device to change phone numbers.

Look at the privacy data for the Wallet app, because that's where the data you're referring to is tracked. iMessage itself is just a container.

> Everything in the label is “bad”.

Shouldn't it be in red then?

So long as iMessage only runs on Apple devices, it's not going to be "beating" anything.

There are several posts here pointing out that Apple's rating of it's own products credentials is a bit questionable. I don't really see how this is much different to all those "feature comparisons" where the 'features' are carefully chosen to make the competing products look as bad as possible.

I suspect Apple would tell you that iMessage is part of the whole gestalt of iOS. "If you really like it, maybe you should switch to iOS!"

When conversations about some X feature of iOS happen, there's always a few people who can't seem to grasp this, and wonder why Apple doesn't port this or that to Android. This confuses me. Apple's in the business of selling Apple hardware. To sell software that runs widely elsewhere is to change their business model entirely, and given how successful they've been, that doesn't seem like a great move.

I have no expectation that Apple will make iMessage available on non-Apple devices.

My point is that in the context of the current debate about WhatApp's new T&Cs and the question "what can I use instead of WhatsApp that won't infringe my privacy so much", comparing the two doesn't make sense because for the majority of people iMessage isn't even in the list of possible alternatives.

> comparing the two doesn't make sense because for the majority of people iMessage isn't even in the list of possible alternatives.

However, iMessage is absolutely in the list of possible alternatives for Apple customers, and they matter even if you're not one.

I know more than one person who switched to iPhone, at least in-part, because of social pressure about the green bubbles.

That's probably a lot easier than a lot of other choices for a lot of people can make.

> I have no expectation that Apple will make iMessage available on non-Apple devices.

I think you should be more suspicious of where you got the idea that Apple should be the one to make iMessage available on non-Apple devices, because clearly the only one who benefits from Apple not being on Android devices is Google.

I mean, if I can get a license to send/receive iMessages on non-Apple kit, then surely Google can, ffs.

> iMessage is absolutely in the list of possible alternatives for Apple customers

I'm an Apple customer, and iMessage isn't in the list of alternatives I can propose to my contacts. Because most of them aren't Apple customers. So I can't use it.

As the op said, your contacts could choose to become Apple customers. As the op also said, there are probably easier/cheaper options.

They are not going to become Apple customers. Not everyone is an US teen who has to have green bubbles.

And when you need or want communicate with them, being able to in first place is more important than insisting on specific device vendor.

But that's the point. A walled garden, a locked ecosystem.

You're either in or you're out. And if your friends are all in and you aren't, you'll never get to hear from them again. How's that for social pressure to buy an iPhone?

I'm not saying what Apple's done isn't a good thing. But I am saying that maybe they didn't do it for good reasons.

Why won't your hear from them again? Messages aggregates sms and iMessage. They'll fall back to sms without having to do anything. At most, you just need to deactivate your iMessage when switching to Android.

To the users there's no workflow difference

I'm on an SMS thread with some iOS users. It's just a constant barrage of "someone laughed at an image", "someone liked [200 words of text]". And the best part is that Apple has flipped out and somehow assigned half the iOS participants to SMS instead of iMessage (I think because I do own several Macs/iPads and have an iMessage account, just not on my phone), so they're in the same hell that I am... and it's all my fault.

Trust me, they're not eager to include me in the next conversation.

While I've never done this myself, there are people who avoid adding non-Apple users to group messages

Mainly because the entire chat ends up being downgraded from iMessage to plain SMS, even if only a single non-Apple device joins

> Mainly because the entire chat ends up being downgraded from iMessage to plain SMS, even if only a single non-Apple device joins

Yep. Want to share a video in your group chat that includes a non-Apple user? Everybody gets an MMS that has a postage stamped-size, low framerate video.

So long as <messenger service> is dependent on a single entity running the servers it's fundamentally deficient.

That's a bs argument. The FIRST problem is it ONLY running on one ecosystem. The SECOND problem is that it's still dependent on X (which is ALWAYS going to be a problem unless you are making a blockchain messaging service)

Stop ignoring the first one.

The first one is only one bad consequence of the second.

Nobody owns email, Jabber or Matrix and that's how it should be.

The other day I noticed that you can't even leave a review for an Apple app on their app store.

I don't think other apps can even disable reviews.

Apple apps not bundled as a part of the operating system have reviews.

Think that the App Store for OS bundled apps is just there for cosmetic reasons. You cannot actually update those apps on their own without an OS update either.

Bundled or not is a completely arbitrary attribute defined by Apple to avoid competing.

I can remove the Mail app if I want, but I can't leave a review to say why it sucks. That's not fair to every other email app out there. It's typical Apple behavior.

Same for Apple Music and Maps which have real competitors that Apple would hate to lose to. The only Apple apps you can review are toys like Garageband.

> I can remove the Mail app if I want

You can hide the Mail app. The interface to redisplay it is the App Store.

Removing the mail app would require installing a different OS build.

No, you can remove it just like any other iOS app. Here's the menu to do so on my iPhone 8 [0]. It's the same menu item that you would use to remove Spotify or Google Maps.

[0] https://m.imgur.com/a/lHaFCYo

What if... Apple would've brought iMessage to Android in 2009/2010?

I'd bet they'd have the prevalent communication platform nowadays in WA's place...

Problem is iMessage also relies a lot on SMS, an in a lot of countries this is really, really bad (due to crazy prices, Brazil for example where WhatsApp absolutely dominates, has crazy sky high prices for cellphone communications in general, WhatsApp dominance is because people at first used it as "free SMS" and after they got voice calls, people use it as "free phonecalls")

iMessage only relies on SMS for sending messages to people not using iMessage, and it's rather clear on when it sends messages as SMS instead of iMessage, as the recipient becomes green (before sending) if the message will be sent as SMS.

Just like WA/Signal/Whatever, iMessage requires all recipients to use the service, and it just offers the option to send a message as a SMS message in case the recipient is not on iMessage.

I find the mixing of iMessages and sms' in the same app super confusing. Good on you for knowing which color is which, but most of my friends who are fairly good with computers and internet, don't really understand what is going on.

I think Google tried the same and the Android audience were less forgiving and I think Android is better off because of that.

I would have loved to have SMS and iMessage separate. I use SMS less because of iMessage. When I switched to my Android phone, some people would text me in iMessage and the messages would end up on my iPad, where I had asked for all iMessage notification to be turned off, because I want to receive SMS on my phone.

What's confusing about it? I'm honestly confused by your confusion. When I want to message someone, I use Messages. Whether they have an iPhone or not is irrelevant, because that will be handled in the background.

It's relevant when falling back to SMS would cost you $$$. Not something I have to worry about in the US, but I understand some areas are different (a parent comment mentioned Brazil).

> It's relevant when falling back to SMS would cost you $$$.

Then disable the fallback... It's a very obvious and simple setting.

As someone who doesn't currently use an iPhone... isn't Messages the only approved SMS app for iOS? What happens if you attempt to message a non-iMessage user with that setting disabled?

Then it'll send as a text message.

When initiating a new conversation, the number you add to it appears blue if they can receive iMessages, green if not.

If for some reason iMessages can't be delivered to the receiving party at the moment. Text messages are used as a fallback for them. If you disable the fallback mode. It won't be.

The whole thing is kinda intuitive, and works really smooth IMHO.

Once someone knows about it or find out about charges, sure. But see how many people get hit with accidental roaming charges even though there's a simple and obvious setting to disable it.

But you know before you even send the message if it will go over iMessage or SMS based on the color.

wodenokoto’s post specifically mentioned not knowing which color is for which service. That’s the confusing part. I can’t recall off the top of my head, either, so I tend to agree.

It has the color and also says “text message” or “imessage” over the message. Its pretty clear.

It's even clearer on WhatsApp, because every message is sent over the internet and never via SMS.

Yes & therefore, if someone isn't on WhatsApp, the message doesn't send at all.

I find it pretty incredible that anyone who posts on HN and uses an iPhone doesn't know blue vs. green. If you go up to any random iPhone user on the street and mention "green texters" there's a very good chance they will know exactly what you're talking about.

You keep repeating that color does it for you and other people keep repeating that it does not work for them. Suspend your disbelief. This is no Mensa puzzle, people’s brains just work differently.

The color is just one of the indicators. There is text which indicates whether it is iMessage or a Text message as well.

In iMessage, before one starts typing, the text field says either “iMessage” or “text message”, so one knows how it’ll be sent without relying on the blue/green color scheme.

I miss hangouts SMS integration. It was super easy toggle SMS/Hangouts as the method of sending and clearly displayed grey if it was going to be SMS.

It clearly says “sent as text”when it’s green. There really is no confusion and takes a second to understand.

Except all those others are cross platform. So billions of people can’t use iMessage at all.

The default also is to fall back to SMS meaning people would have incurred costs quite easily.

> The default also is to fall back to SMS meaning people would have incurred costs quite easily.

iMessage has an option for disabling SMS fallback.

I guess i've never considered it a problem. I've had unlimited voice/SMS for close to a decade. Instead of paying by the minute/SMS/MB, the trend here is instead to use additional services (music, netflix, etc) to keep the prices up.

Here in Denmark, a $50/month mobile subscription will get you unlimited voice, SMS, and 20-30GB data, along with Netflix, HBO Nordic and a music service. A basic subscription includes unlimited SMS, <10 hours of voice, and 1-5GB data, and is around $15/month.

Usually during summer/christmas i get unlimited data as well for 1-2 months, and from July until new years eve we had unlimited data. It probably has some "fair usage" limit, but i've never hit it. Also, Netflix consumption doesn't count against your data cap, so you could create a wifi hotspot on your phone and stream netflix over 5G all day without using any data at all.

The GP was saying what if iMessage was brought to Android. Now a large number of people would have access to iMessage the same way iOS people do, thus avoiding SMS charges, and becoming blue bubbles with any other iMessage phones.

So you've sort of missed the point I think.

At least in the US, every major cell phone provider's plans include unlimited texting. So that's not really an issue here.

Wether you perceive that as "free, with some exceptions" or as "costly, with some exceptions" depends not only on the Apple/Android ratio in your network but also on your general wealth (unless your particular brand of wealth absence is entirely based on general lack of monetary self-control)

iMessage does not use SMS at all. It is 100% IP based like WhatsApp.

The Messages app on iOS devices can switch to SMS if the iMessage service is not available. It would certainly be possible for Apple to design an iMessage-only client that will not do that. But they don’t want to.

Apple sells hardware. They are a hardware company, who realized early on that they need to ship great software to go along with their hardware.

They are not interested in new users on devices which don't increase their hardware-sales.

They are also not interested in selling your private information. They. sell. hardware.

> They are also not interested in selling your private information.

Trust me, they are interested. They are a private corporation. They are interested in every potential revenue stream. Today it may not be their strategy because of the potential for it to reduce revenue, but who knows what tomorrow will bring.

Is this where we spitball hypotheticals even if no inclination to execute them has ever been shown?

“Trust me, they are interested in murdering you and extracting your vital fluids for profit. It may not be their strategy today because it could reduce revenue, but who knows what tomorrow will bring”

I haven't seen more than one or two multinational corporations murdering and extracting vital fluids from their customers. Monetizing personal information, however, seems pretty reasonable to expect based on past history.

> Monetizing personal information, however, seems pretty reasonable to expect based on past history.

Which history would that be when it comes to Apple?

History of corporations. I guess, if you want to make the case that Apple is wholly unique, and the entire history of corporate conduct doesn't apply here, then fine. I just don't have the will to debate that one.

You know what's funny here? You seem to be actively defending their decision and putting it in the vein of "well they sell hardware so they are going to do anything they can to get you to use their hardware!!". And that's supposed to make it OK? Fuck that logic.

As other people have mentioned, if iMessage would have opened up to other platforms it would probably be what everyone uses and would be GOOD FOR EVERYONE. But instead, they wall it to their shit. My mom constantly tells me she doesn't get my text messages from android to her 100% apple ecosystem. I can't do anything about it. It doesn't make any sense, but it's on Apple. They probably even leave these "unfixed issues" to get everyone to move to imessage just so they will buy their hardware.

Fuck Apple for their decision on this. Stop defending it. It's a horrible decision.

Do you feel the same way about not being able to play Nintendo games on a Playstation or an Xbox? I mean how dare they try to operate a business.

>Do you feel the same way about not being able to play Nintendo games on a Playstation or an Xbox?

Yeah, because me trying to text an Apple phone from a non-apple phone is the same thing as trying to play a nintendo game on an xbox. Fuck off dude.

I'm sorry, but if you are unable to send a text to an Apple device from a non-Apple device, then you must be broken. If you stated that you cannot send an iMessage from a non-Apple device to an Apple device, then you'd be correct. However, an iMessage is not a text. Any text capable device is able to send a text to any other text capable device. If the app one reads those texts is called WhatsApp, iMessage, or ImTooStupidToKnowTheDifference.app, it doesn't matter.

> My mom constantly tells me she doesn't get my text messages from android to her 100% apple ecosystem.

That is weird and never happened to me. SMS works everywhere. Does she maybe have your number in a blocklist?

How can both Google and Apple cannot have a single rival platform against Facebook? We do have competitors like Twitter, Telegram, Signal but none of them are from Google or Apple. If we had we could have kept Facebook in check.

Have they given up on network effect of Facebook's platforms? If they can't solve network effect problem then I wonder how much hope there is for apps like Matrix or Signal.

P.s. We do have YouTube from Google but that's an entirely different story.

It's a moderation nightmare. Facebook is a toxic name to many people. If I were Tim Cook I would leave social networks well alone to keep the Apple brand clean, if for no other reason.

I don't think Google+ ever got to the scale where that was an issue.

They only have to worry about moderation if they host anything. They can keep Apple clean of social networks while endorsing and supporting an open protocol or format for fetching/presentation into a thin client (something like ActivityPub/ActivityStreams, to pick an existing implementation that could make sense to adopt/adapt). I don't know, I think that'd be a very "Apple" thing to do with integrations into the rest of their client side ecosystem.

> They only have to worry about moderation if they host anything.

I don't think that is the case. At least many users, possibly even most users, would not understand the difference between Apple hosting a social network themselves and Apple promoting a thin client that views decentralized content. If you have an Apple Decentralized Social Networks app, and a parent sees their child viewing objectionable content through that app, a bulk of their ire is going to be directed at Apple; they will likely not even know the name of the entity actually hosting the content.

The "we're not actually hosting it so we're not responsible" argument, I don't think it's ever really worked. I don't think it would work in this case. See: torrent websites.

I think the benefit to Apple also goes down. They give up control, and for what gain?

The trite answer is a modal going something like "the content you're trying to access A) isn't available on your <AppName-Level subscription> or B) isn't in our walled garden of third party providers". I don't like how it sounds but I'm confident they could sell that.

Heck, integrate it into messenger and treat all content like emoji/stickers you must acquire from a controlled source to circulate.

> They only have to worry about moderation if they host anything.

Legally maybe, but it's nevertheless presented under the Apple brand... which means as soon as the first pedos, QAnon cultists, antivaxxers and other undesirable elements take a look, people will reflect that negatively on Apple.

Apple's brand is basically to be "clean and safe" for users. Engaging in the shitshow that is any modern social network would be one of the fastest way to tank their stock price.

Remember Google Plus? They tried but were ultimately found wanting.

Apple was focused on hardware. Their services play is only recent and my best guess is if they ever considered social, they rightfully saw how toxic it is and decided it wasn't worth the effort/risk of tarnishing their brand. Not that I think they'd have a compelling product. Personally, Apple's web products are average at best. See their stock apps.

Apple even tried a social network of sorts with Ping in iTunes. https://en.wikipedia.org/wiki/ITunes_Ping

Apple scraped that so quickly most never knew it existed. I think this shows a company that knows what it does well and has the discipline to stick to it.

Except they allowed Ping to get released in the first place. If they knew themselves so well, that idea would have been left to die on the vine rather than having X number of employees working on it at whatever expense.

Possibly monopoly fears?

What if they did it in 2021? I'd install that app and try to convince my peers to switch from WhatsApp.

But realistically, some people pay the iphone premium to avoid the shame (?!!) of green text bubbles.

>to avoid the shame (?!!)

Or the cost. I have some limited number of SMS messages on my cell plan and then it's 10 or 20 cents or something like that I think. I don't send many texts so I'm pretty sure I don't normally get hit for fees but someone sending the large number many seem to probably would.

imessage isn't a text message. It would use a very very little bit of data per message.

Green messages on an iPhone are messages that weren't sent via iMessage; they were sent via SMS.

That's because the recipient of your message doesn't have iMessage (which is everyone that doesn't have an iPhone). The OP is suggesting that Apple should have brought iMessage to other platforms (Android in particular).

What if Google agreed to license iMessage from Apple?

Sure, in 2009 I bet Google thought they had a chance, but it's 2020 and it's easier than ever to convince Android users to drop the privacy-eroding bug-ridden trash that is the Google ecosystem than it was ever before.

er, actually, its 2021 now. gotta retrain that muscle memory to reach for the 1 instead of the 0.

They tried, you know.

Apple promoted iMessage as an open standard, Google and Microsoft wanted to go with extensions to MMS.

So here we are, off the road not taken.

Just a PSA for anyone else who's left WhatsApp in the past few days. Before uninstalling, I went through the settings and actually "deleted" my account, but after letting one of my few WhatsApp contacts know I had done so, he mentioned I still show up in chats. So let people know if you're leaving, because it seems WhatsApp won't prevent them from messaging someone who doesn't exist.

As an FYI to you and anyone reading this, you could convert your account to a business account using WhatsApp for Business. It has an auto-reply feature that you can enable with a custom message, to inform people you've moved to whatever platform you've decided to move to.

It would just use SMS wouldn't it? So unless you also changed number, you'd still receive the message?

If you "deleted" your account, then the number associated with that account BETTER DAMN WELL BE DELETED too.

I mean your phone number. WhatsApp finds contacts by phone number, and messages them over SMS if they are not themselves on WhatsApp. (At least, I thought it did?)

So I'm saying I assume the situation after deleting WhatsApp is the same as if you'd never had it, SMS.

It wouldn't make sense for User B deleting WhatsApp to cause B's phone number to disappear from User A's contacts.

Signal can send SMS message as a fallback, but I don't think WhatsApp has that feature.

I did not know Signal was able to do that. Seems kind of like it is defeating the purpose of Signal.

Apple is cheating a bit here. Example: I can see my contacts location in iMessage if they are my family. I can also share my location with contacts. Maybe that data comes from FindMy, another app, but it is still processed by iMessage and it is a menu option within the app.

There is a big difference between an App showing you some data, and that same app collecting it, sharing it, and linking it to your identity.

For example, Google maps could show you your location in a map, without collecting that data about you or linking it to your identity, e.g., by having the local app who knows your location ask the google maps server for maps including that location, but without ever sending the location, and with these servers never linking who requested the maps with which maps they requested.

If iMessage is end-to-end-encrypted, and you share your location with a contact, does it count as Apple "collecting" the information for the purposes of the privacy label if it is never stored in a readable way on their servers except to be transmitted and decrypted by the recipient?

I think your overall point still stands that Apple's collection within other services like iCloud can benefit iMessage functionality and may not be disclosed on the privacy label

While it may be end to end encryption I am under the impression that Apple has the keys so they could decrypt the messages if they wanted. I don't have an iPhone but I think when you get a new one your old messages are migrated over. Not sure if that is true but if it is that would almost certainly mean Apple has the ability to decrypt your messages themself.

If you use Messages with iCloud then I think you are correct. If you don't have iCloud enabled for Messages then only your device has access. I never enabled iCloud for Messages for this reason

But if anyone you're talking to has it enabled, your messages are still gonna be on Apple's servers, right?

Yes, good point

The list is things shared by default. You have to manually opt in to sharing your location, even if you're using Family Sharing.

Is that true?

You can avoid having to list things in the nutrition labels if it's opt-in?

That doesn't make sense then the other way. In WhatsApp you don't have to do any payments, so that information shouldn't be included there either.

But is it collected and linked to you via apples I message servers? That’s what the comparison is for, seems WhatsApp grabs all that, sends it to Facebook, and then links it to you

The author, according to the bio-data on the piece, is "the Founder/CEO of Digital Barriers—developing advanced surveillance solutions for defence, national security and counter-terrorism. "

It's ironic that he is lecturing us on privacy matters while developing surveillance solution at the same time.

He also needs a lesson on not "burying the lede". He doesn't get to why Apple is beating WhatsApp (privacy labels) until almost 800 words in .

I sense that I am confused [1]. What is a plausible explanation for this person writing this article?

[1] https://www.lesswrong.com/posts/5JDkW4MYXit2CquLs/your-stren...

By the number of articles he publishes, I'd say that's a company without any type of actual business activity.

If the CEO is spending more time blogging in Forbes than working, than that speaks volumes.

He's a Forbes Contributor, which means he writes for them without being paid or being subject to pre-publication editing. It's widely used by executives to display their "thought leadership" to promote their business. They're also often ghost-written.

So, to answer your question: he's writing about this because he wants to and because he thinks it will help him to gain exposure with an audience who might hire him or his business.

Raising his company's profile.

It's not that many articles (5 since December 19th, 4 of them about facebook privacy and iphone).

Most likely theory: having someone ghostwrite them from his technical marketing department (in response to a prompt from him).

Second most likely theory: He's doesn't have a lot of day to day work.

Aren't they the best people to learn how to be private because it's their jobs to break privacy?

And Forbes is DEFINITELY not GDPR compliant with their cookie preferences:

- denying non-essential cookies is harder than agreeing with them

- they bundle analytics cookies with basic features (such as login)

- if you submit your preferences there is fake timer which "submits your preferences" for a few minutes

I would trust Apple over Facebook or Google any day for the simple reason that Apple makes its money by selling hardware (and being a monopolistic gatekeeper of many of the apps that run on that hardware). WRT the gatekeeper aspect, which I don't like, at least it is very clear what the business model is.

Suffice to say, they aren't depending on our data for marketing purposes to earn money. If Apple opens an advertising division, then I will start to distrust them as much or more than the other two.

Sames goes for Microsoft. I would not be surprised if MS used my data to try to sell me Office or Windows, but I would be very surprised if they were selling my data to outside parties.

In summary, if the company proving the service you use primarily provides "free" services, then they should be suspect. Find out where their revenue comes from. Chances are, it comes from mining your data.

I hadn't really thought about this before, but it's likely WhatsApp's recent change requiring you tie accounts to Facebook is likely linked directly to Apple's privacy policy changes.

“...we do not share contact lists with anyone, including Facebook for its own use.”

Is that just a lie? Or maybe it wasn’t a lie until their most recent ToS change?

Funny that all the anti-Apple news stories (re unfair regulation of its marketplace) started popping up right after they signaled to FB “no more tracking” (via regulation of its marketplace). I don’t think I’d seen a single story criticizing Apple on moral grounds before this.

what does it mean he iMessage keeping “Search History” linked to you? Why? This is concerning...

I'm interested in this too.

This is all voluntary disclosure. Perhaps Facebook is just being a lot more honest... :)

If they would not disclose a) no-one would believe it b) apple would kick them out if they don’t disclose

It's disappointing to me that these new privacy labels from Apple don't regard client IP as "coarse location", only gps/wifi sourced location data.

But if you slap a label onto every app that does any internet communication it has about the same effect as if you'd slap it onto none of them.

Maybe more of them will start embedding Tor.

Coarse location is coarse location, and most users have no idea that most apps know (and log) when they leave their home, arrive at work, travel to another city, et c.

That's the point of a label, is it not?

We label all medicines. Is that the same as labeling no medicines?

This was my response when cookie labels started to pop up. But now general attitude has changed towards cookies because of them (at least among my non-tech friends)!

I had this moment where I realized I was dismissing a bad thing (cookie advertising tracking) just because it was pervasive.

I think labels like this have a real power to change industry norms.

Even cell phone tower location is way more exact than IP in terms of geolocation.

It's a shame they don't have an Android version.

But, then, they wouldn't be able to ensure secrecy of messages sent to Android users.

Why wouldn't they? Is there anything specific about Apple hardware that enables iMessage to work that is missing on Android devices?

Because there's no good business reason for Apple to do so. iMessage is a feature of iOS and MacOS. It's part of the advantage of working on those platforms.

Apple also makes it easy for the iPhone to sync with Windows. There is a Windows version of iTunes (does it still exist?)

The more people on the platform, the better for Apple as network effects make the platform more useful. The same applies to FaceTime.

Those exist because, without them, they'd sell fewer iPhones and iPods.

Porting and supporting iMessage on Windows or Android would not accomplish the same thing.

They control the hardware and the OS completely and can ensure your messages won't leak to other apps unless you explicitly allow it.

Apple can't guarantee the same level of control on Android for all versions and hardware.

iMessage is paid for by your purchase of an Apple phone.

WhatsApp is paid for by ads that are customised by your data.

Ads don't need to be customized to bring in revenue. Sure, it's more money if it's customized, but ads can be non-personalized; even can be entirely embedded in the app, no network needed whatsoever - that's the old newspaper model, and that worked for years.

If the upside to that model is that you manage to become the defacto platform across ios and android, I suspect the reduced add revenue is easily worth it.

Facebook simply wants more, now that they have the somewhat captive audience.

I wasn't meaning to justify Facebook's use of data to customize ads just stating why.

You hit the nail on the head when you said "it's more money if it's customized".

If ads are 'better', they are cheaper to purchasers, will be more profitable and will give Facebook an advantage. Facebook may be big but it is competing with Google and other ad providers. It is in their interest to use every tool possible so they don't become the newspapers of tomorrow.

It will take external pressure or laws to stop them doing this.

That infographic just made me delete facebook and messenger (which I rarely use anyway), unfortunately I use WhatsApp for communicating with family.

They still need to be shown though. WhatsApp without any user tracking and data sharing to the mothership is a pure expense. It doesn’t show ads directly in the app and a messaging platform isn’t very conducive to adding it in either.

They could charge (that was their original business plan), and could likely charge very little, and they could show non-personalized adds. User tracking is not necessary, merely possible.

No, Apple runs its own advertisement platform. This "privacy" PR push is all about forcing developers to advertise with Apple instead of Facebook. What Apple is doing is closing the tab for everyone else while they can look pure as snow because iMessage doesn't need those permissions since Apple already get the data elsewhere in the apple ecosystem. Like opt-out unique advertisement ID on all iPhones, Apple login, iCloud, etc. So iMessage is also bringing in advertisement money, it's just harder to spot.

Apple only uses ‘in app’ data for customising ads. What apps you look at in App Store, what news you read in news app etc.

https://support.apple.com/en-gb/guide/iphone/iphf60a6a256/io...

And how can Facebook get the same data without notifying users? They can't. That is the whole point of the "Privacy push". To make others look bad (as they are, but that is beside the point).

Yeah, it must be, since I never see any ads in Apple apps on my phone.

IOW, this doesn't sound like a real reason.

Try the App Store. Plenty of ads in there.

...for other apps? Not seeing your point.

How do you think they target apps in the Appstore and in search? With Apple Search ads targeting.

Whatsapp is not paid for by ads.

Maybe in the future it will be, but right now there are no ads.

YES IT IS

WhatsApp may not show ads, but Facebook is paid for by ads, the data collecting in WhatsApp is so Facebook can show ads elsewhere.

At least for EU countries that’s not the case:

“Today, Facebook does not use your WhatsApp account information to improve your Facebook product experiences or provide you more relevant Facebook ad experiences on Facebook. This is a result of discussions with the Irish Data Protection Commission and other Data Protection Authorities in Europe. We're always working on new ways to improve how you experience WhatsApp and the other Facebook Company Products you use. Should we choose to share such data with the Facebook Companies for this purpose in the future, we will only do so when we reach an understanding with the Irish Data Protection Commission on a future mechanism to enable such use. We'll keep you updated on new experiences we offer and our information practices.” [0]

[0] https://faq.whatsapp.com/general/security-and-privacy/how-we...

Yes completely agree

and whatsapp used to have a mandatory subscription in mahor western countries (~$1/year) that was profitable. The sub was removed by facebook who were likely interested in the private data value, not the sub profit.

I’d actually pay 1$ a year for most services. Hell 5$ a year for ad free privacy first. But I guess that’a bit as profitable as ads

How would Apple profit from that ? Security aware and all, Apple is still a "for profit" company, and by their own estimates they process > 200.000 iMessages per second (https://www.businessinsider.com/eddy-cue-200k-imessages-per-...).

Increasing the user base would surely increase the number of messages sent, putting additional load on the server infrastructure, making it more expensive to run, and all without making any profit from it.

Apple is much more interested in providing you with a relatively secure messaging platform on their platform, which in turn can attract more users to their platform, increasing their revenue through sold devices.

>How would Apple profit from that ?

...by charging for it? Still "free" for iOS/macOS users (paid for as part of hardware purchase), $6/year for Android users (or whatever infrastructure with some margin costs). I mean, I have no idea exactly what uptake would be like versus "free" (paid for with your data). But given increasing awareness of the issue, and network effects from existing iOS/macOS userbase, it'd be a significant option. And there are billions of Android devices, even at Apple's scale potentially billions of dollars are year for minimal effort isn't nothing.

I mean, I find this objection (which seems to come up multiple times, every single time iMessage-on-Android comes up) to be just so weird. Like it's some huge mystery how anyone could possibly make money from a software service. You can make money from a software service by... charging money for said service. And as something that's purely network-based, even the normal concerns about piracy and the like on Android are irrelevant. Apple can see if it's a paying account and what devices it's being used on server-side.

It's not just about "could Apple create a model where they profit." It's about what they'd lose if they DID go this route.

Apple is (mostly) a hardware company. They make money by selling phones, computers, and related bits like watches. They have traditionally provided a great user experience partly because they control the software AND the hardware on their devices.

So sure, deciding to release an Android app for iMessage might be profitable, but it doesn't serve their overall goals (selling more hardware), and time & treasure spent on the initiative are resources NOT available to work on the next Mac, the next phone, the next iPad, etc.

Ergo, it seems super easy to me to understand why there is no Android iMessage, and why there likely won't ever be one.

Not just that, but Apple has a brand to defend. In all their keynotes, maybe excluding the first iPhone, they don't even acknowledge other phones. You should buy the next iPhone because its better than the previous, not because its better than an android. And because of that stance, they spend zero effort in supporting other platforms. And apparently... That works just fine!

As an old fart that has used just about every operating system out there since MS DOS 3.0, and has served my time for a couple of years as developer for a Linux distribution, I find Apple has a surprising ability to make things work.

I switched to Macs with the Intel transition as I realized that the Linux on the (mainstream) desktop would be Macs and smartphones. I’ve never looked back.

If you’re willing to live with the defaults, learn the new features, and stop trying to make the system behave like it “always has”, chances are it will treat you very well, but you have to be open to change.

Yes it’s vendor lock in, but everything Apple integrates so tightly that even as I’m typing this message on my iPad, I can just press a button and have the unposted comment sent to my Mac to continue there.

When you get used to it, other operating systems seems so simple. I use windows 10 at work, and it still amazes me that the last functional search bar in the launcher was in windows 95. Windows 10 has a nasty habit of replacing my (correctly spelled) search result with a link to edge / bing.

The keys burned into devices at manufacture are used to prevent spam. You can't just poke the API with any random key. They aren't required for the encryption.

Not so beaten that I won't even dare to try iMessage... WhatsApp is simply king, and I'm not even including the network effects...

The key here is that iMessage collects a device identifier. Apple will cross reference this with everything else on your phone and know more than all the other apps put together.

Apple: we're not going to do this.

Random HN commenter: they're going to do this.

I think I'm going to believe Apple until they give me a reason not to.

Where does Apple say they're not going to do this?

OK, now do the trick for having an Apple ID and using an apple product. iMessage is a tiny slice from the data hording that apple is doing when you use their services.

A company in a significant scale that is not hording user data and is 100% pro-privacy and user protection has yet to come.

Hence, my wish that the EU will install a "Great Firewall" to block all the American tech so European tech has a chance to evolve - similar how China did that SUPER SUPER successful.

> data hording that apple is doing when you use their services.

This sounds like some weird conspiracy theory.

What other data is Apple hoarding? They have no real profit motive to hoard a bunch of data since they aren't selling it, which is where most data plays come from, and on top of that hoarding data without any reason is super costly even if you are one of the largest companies in the world.

They sell hardware, software, and "cloud". They SELL it so you are paying with your money not your data.

You have to be a sovereign state before you can protect your tech scene from the US. There is a reason only Russia and China do that.

"EU will install a "Great Firewall" to block all the American tech"

That's just censorship with extra steps

Not censorship. It is kicking American crap out of the EU and doing our own stuff... which cannot be successful, because it is either bought by some American megacorp at early stage or just mobbed out of the market.

Apple is cheating which is the whole point of their privacy PR push. They don't need those permissions for iMessage as they get the data from other sources, like iCloud, unique advertising ID, IMEI, phone number, etc. I'm amazed how even HN users eat this PR raw without a second of doubt. Apple is abusing their market position (100%) to further their own advertisement platform.

Apple isn’t selling my data to advertisers, and I personally believe Facebook and it’s business model are abhorrent. If they can’t yet be legislated out of existence, I’ll happily take Apple’s efforts in the interim.

>Apple isn’t selling my data to advertisers

Yeah, they are instead setting up a walled garden of fuck you. I'm not sure how you can argue it's any better. It's a different class of issues for sure, but it's still bullshit. They intentionally make communication more complicated with non-Apple devices so everyone will buy their expensive hardware.

I pay for the walled garden. You are free to patron other businesses with different models if you prefer.

>I pay for the walled garden.

Good for you. If non-Apple people didn't need to communicate with Apple people, there is no issue. But that's not how things work obviously.

Apple is INTENTIONALLY making it difficult for non-Apple people to work with Apple people. My mom is 100% apple, and she literally has problems receiving texts from non-apple phones. She wants me to buy apple products just to make it easier to talk with her!

If you don't see what they are doing you are just plugging your ears and going "lalalala"

Apple isn’t responsible for SMS infrastructure, and without legislation mandating interoperability, it is what it is. Consider Signal for your cross platform needs. Apple isn’t actively making SMS suck, they’re simply not opening their superior messaging platform to other clients (just as Slack and Discord don’t allow non official clients).

>Apple isn’t responsible for SMS infrastructure, and without legislation mandating interoperability, it is what it is.

What are you talking about? The problem isn't with the SMS infrastructure. It works just fine.

This is not about permissions, but usage, AFAIK. Do you have any evidence for any cheating?

> Apple is abusing their market position (100%) to further their own advertisement platform.

Err, what advertising platform? Apple doesn't have an ad platform. Apple doesn't sell data to ad platforms. Apple doesn't do any of the things you're regurgitating here...

>what advertising platform

https://searchads.apple.com/#choose

They also used to have iAd.

>Apple doesn't sell data to ad platforms

Who said they sell it? That is the whole point. Just like Google they hoard data and sell targeting but doesn't give out the crown jewels.

Reply on news.ycombinator.com