Hacker News Reader

Comment by grawprog | Hacker News Reader

I've been clicking the X everytime i get the popup for a few days now. I haven't really thought much about it or actually read it yet. I honestly fucking hate WhatsApp and wish I could convince the few people i talk to on there to use something else, even SMS. I've tried, yet they always message me through WhatsApp. They're not people i can really ignore either.

Anyway, i guess this is mostly a rant. But fuck WhatsApp, they actually manage to somehow be worse than Facebook messenger. At least messenger let's you appear offline.

View on HN

While you're still stuck "using" Whatsapp, I've had great success using the Matrix bridge [0] on the homeserver I run [1]. Your contacts still message you, but you don't have to give Whatsapp your contacts list, other apps installed, or location via ip/wifi network.

It won't work for calling (as it's not supported on Whatsapp Web), but images and groups (which I use) both work perfectly.

[0] https://matrix.org/bridges/#whatsapp

[1] https://matrix.org/faq/#self-hosting

I use that too, works really well. Bit fiddly to set up but it's surprisingly resilient, and at least the WhatsApp app is stuck in it's own VM with nothing else on it.

Doesn't that use the whatsapp web api? Which requires you to have Whatsapp installed on your phone as it routes all communication to the phone where it is decrypted?

Yes (or an Android VM before anyone tries to get pedantic)

It requires a VM (as noted below) or an old phone you no longer use. I wasn't actively using my Nexus 5 anymore anyways, and this is a better use for it :p

And yeah, it's be forwarded and re-sent through the phone/VM. But this is the best trade-off I've found for dealing with people that refuse to leave WhatsApp. I look accommodating and don't just cut out someone I presumably need to care about, but also limit how much data FB gets.

And while I haven't tested this, I'm now curious how always having WhatsApp Web active affects my "Last Seen" time...

Facebook employees need to feed their starving families. No one would pay for Whatsapp (yeah, right^1). You will love the more targeted advertising.

1. https://www.cnet.com/news/whatsapp-to-charge-iphone-users-an...

Do they still charge on Android? My old man seems to be paying to use WhatsApp for some reason... I was confused when he said this to me.

They hardly ever did, and the last time they did was something like 7 years ago. He is probably being scammed.

I never saw that 2013 thing. My friends and I all had access until 2100 or something. Considering that implementation never really happened, it doesn’t mean much.

Yeah. Everyone in my country uses WhatsApp. There's nothing I can do about it so I've made peace with it. At least it has end-to-end encryption. It's even proven its effectiveness against my government's justice system.

Facebook own the keys so it's not real "E2EE".

Could you explain further? My understanding was that every WhatsApp user had their own private key.

For what it’s worth, OWS (whose co-founder created WhatsApp and which is now known as Signal Foundation) implemented Signal protocol for WhatsApp’s E2EE. WhatsApp’s technical paper[0] (last updated October 2020) describing the implementation indicates that only public keys, not private keys are stored on the server.

Unless there’s been an incident I’m not aware of, all I’m seeing is you claiming that WhatsApp/OWS engineers are lying with the only substantiation being questionable ethical practices of the parent company.

[0] https://scontent.whatsapp.net/v/t39.8562-34/122249142_469857...

That's likely true about the protocol, as far as I can tell. But that's never been true about data-at-rest on your device; which wouldn't have been much a of a problem, except ...

They used to have encrypted backups, but at some point in time, the Android backup (and AFAIK the iOS backup as well) dropped encryption. And since 99% or so of users back-up to the cloud, it means that Google and Apple have the unencrypted history for essentially everyone (remember, every message has two sides - they only need one side from each message)

This is an issue separate from “X owning your private keys”, but I agree it’s a problem.

Either way, secure messaging requires care from both sides; even if you both use Signal your counterpart can, say, let some spyware screenshot her jailbroken Android, and then it’s all for nothing. The only way of avoiding that is probably handling communication on a dedicated device, or a thoroughly locked down software ecosystem.

Anecdotally, a couple years ago I lost the entirety of my WhatsApp conversations and contacts after changing phone: I missed the opportunity to enter a code at some point and it got wiped without any way to recover it. I don’t know if that was an indication of backup encryption, but it sure felt like security trumping convenience.

Just pointing out that there’s a difference between one person being owned (your signal example) and essentially everyone’s data being available to state-level actors (what’s happening with WhatsApp)

True, the scale does matter.

> They used to have encrypted backups, but at some point in time, the Android backup (and AFAIK the iOS backup as well) dropped encryption.

Is this actually the case? I know they say it's not protected by E2EE, but my understanding is:

- images are unencrypted (just like they're accessible on your phone's external storage, where many apps can read them) - the text messages are encrypted, but the key is escrowed with Facebook, who will provide it to anyone who can pass SMS verification

This means that an attacker has to get access to both your Whatsapp account and your Google/Apple account. This isn't a very high hurdle (for governments, this likely just means two subpoenas, and for other attackers, it just means getting access to your phone number through one way or another, because in many cases that will let them hijack most of your accounts), but it seems slightly better than unencrypted.

The copy of the backup on Google drive/storage (whatever they call the app backup) is completely unencrypted.

Google won’t just give it to you - if you want it, you have to impersonate the WhatsApp app.

The local backup on your device is encrypted. Facebook will give it to anyone who can read their SMS message, as long as they also impersonate WhatsApp.

The bottom line is that without much work, google has full access to your data in whichever way they desire, but you only have access through the sanctioned app.

Which means for a state level actor, it’s at most one subpoena and likely they have streamlined that XKeyScore style, so not even that.

Can WhatsApp’s own backup be turned off? On the iOS side of things, if WhatsApp data gets backed up to iCloud alongside the rest of the device, it will be encrypted but not E2E (which makes it largely pointless)—however, you can turn iCloud backup off.

It can be turned off, but IIRC it's on by default, and probably on for 99% of all users.

> The copy of the backup on Google drive/storage (whatever they call the app backup) is completely unencrypted.

Any idea why they do that, instead of applying exactly the same encryption? Also, is there any place where this is documented (where I can point people to that ask me the same question)?

As another one who dislikes WhatsApp these day and defend Telegram I think we should still stick to the facts instead of going down to this level:

I've seen no credible or verifiable claim that Facebook currently has access to the keys.

That said: credible and preferably verifiable sources are very welcome.

However, depending on your threat model WhatsApp might still be a huge problem, and this is public information so you can verify it for yourself:

If anyone you communicate (or you) enable backups in WhatsApp, any chats that person is part of is uploaded to Google as unencrypted data, i.e. I believe the upload channel is encrypted but it is stored in a way that everyone who can force Google to give them access can read them.

Which means that you group chats might very well be readable to Google and everyone they have to obey without you even knowing.

It's apparently possible [1] to use an android emulator like anbox [2] to run whatsapp in a sandbox. I'd like to know if anyone here has experience with this approach as as a long term solution?

https://anbox.io/

https://security.stackexchange.com/questions/188040/whats-sa...

> wish I could convince the few people i talk to on there to use something else

You can use Watomatic to give these people an auto-reply each time they send you a message, and tell them about the better alternative you prefer to communicate with.

https://github.com/adeekshith/watomatic

Make sure they know how to contact you in other ways. Tell them to write it down once a day for like 2 weeks until they confirm it works by using it.

Then never launch the app again.

Reply on news.ycombinator.com