Hacker News Reader

Comment by philliphaydon | Hacker News Reader

I’m convinced WhatsApp’s e2e is BS. Because multiple times I’ve mentioned something I’ve never even googled and then had Facebook ads for those things show up minutes later.

The most notable one being renting an apartment. I viewed an apartment then sent a message to the agent requesting window grills or latches and then had adverts for that stuff straight away.

When ever I mention this on HN I get downvoted with lame excuses as to why it happened but none of them are plausible.

My friend messaged me saying he needed to go buy kitty litter and I get adverts for cat toys and supplies on Facebook despite not even replying to him?

Anyone who believes WhatsApp is really e2e is a fool IMO.

View on HN

Did you view the apartment with…?

- the agent present - you both had smartphones on you - they both had bluetooth data enabled - they are both signed into location services - you'd added the agent to your contacts or they add you to theirs - you took pictures (and didn't strip the EXIF data) - you exchanged emails with the agent via gmail - you rang each other via a VOIP service - you used a map app to find the place - you found the apartment via an online listing - you found your current place some multiple of a standard contract length ago (e.g. 1 year) - your data in aggregate statistically matches that of other people's who also looked for new apartments

The metadata just drips off and they sell it, it's repackaged, bundled up and sold on to others who then target you (personally or as part of a group) in their ad campaigns.

The agent is a friend so I had in my contact list for years.

We exchange listings to apartments to view so absolutely they know I'm looking at apartments and all that stuff.

Getting adverts for apartments is fine because I know I searched and browsed sites etc. The issue is for 2 weeks I looked at apartments. Got some adverts for AirBnb, other property sites, etc.

The particular apartment I looked at, I viewed it, walked around it, etc. Went home, pondered to myself about the apartments I had looked at that day...

Looked at facebook, etc...

Hours later I go to WhatsApp, message the agent, something like.

"I really like apartment X but the only issue is the windows don't have grills and its the 23rd floor, would you mind asking the landlord if we can get grills or window latches? If they are willing to do that then I think I'll take that apartment"

(give or take on the message as it was 3 years ago? That I took it...)

Agent had not read the message yet, infact he didn't read it until well after 6pm.

I go to facebook (2-3 minutes?) after messaging him, and I have adverts for grills and window latches.

I had not googled them, the only mention ever of grills or latches was a message on whatsapp a few minutes earlier...

---------------

Even if they are scanning the messages on the client, as far as I'm concerned it's no longer e2e. They are scanning my personal message, analysising it, building a profile on me, and using it for advertising.

That's certainly fishy but it doesn't rule out other methods that rely on statistics. For example, how many other people have visited that apartment and within a few hours searched for window grills and latches? Perhaps all of them.

Still, use Signal is the answer. The more people that use it, the more people will use it and the less we'll have to worry about whether messaging apps owned by ad companies are e2e.

What keyboard do you use?

That is always the one that worries me.....

Stock one on iOS. Never used a custom keyboard. (except when I used Android cos the stock one was terrible ~8 years ago.

I use the default as well (android) and turn off all of the fancy AI mumbo jumbo. I also (rarely) use an old one called "Hackers Keyboard" (seems to now be discontinued in the store but it gives me access still to download it). Not sure if it is available at all for iOS but it gives you basically a full keyboard which can be useful for doing terminal stuff

I mean the WhatsApp founders literally quit with millions left on the table over "disagreements with facebook senior leadership" and then promptly made a huge donation to Signal. If that wasn't them saying "HEY THEY ARE REMOVING E2E" without violating NDA I don't know what it was.

Whether or not this is a canary for negative impact to the integrity of WhatsApp e2e, this move was enough to move my primary communication to Signal.

Jan Koum not only had unvested shares, he was on the BOARD of Facebook and decided to quit. Along with the donation to Signal, I don't think the magnitude of this action was widely appreciated at the time.

I had a private family Slack instance, and we observed similar things. A question about buying a particular brand of soap would be spoken in the channel and ads for that exact soap would show up minutes later on Facebook. No searches or other activity, just a text query to a person through Slack.

I prefer to think that some of this is chance, or Facebook just guessing really, creepily well. But after the 3rd or 4th time we observed this same scenario play out, trust has eroded, even if I have no evidence as to how this is happening. It's time to change up the tools.

I now self-host an open source chat application, and we have not had another repeat of this kind of creepy ad invasion.

> I prefer to think that some of this is chance

Don't. People are way too tolerant of serial liars, psychopaths and rapacious corporations.

I wonder if there’s some kind of side channel leaking the ad targeting data, for instance if you type something into WhatsApp and they add words that you type into a user-specific autocomplete dictionary (or your lexicographical profile or whatever other aggregate they keep for various business purposes). Then they use those aggregates to target users based on the words they use in conversation without “decrypting their messages” so to speak. Depending on what phone you use, any custom keyboards, etc there may be other ways for typed text to leak.

Yup. Keyboards can read everything. I always turn off all the special features of the keyboard that seem sketchy even if its from a legit company like Google.

Isn’t that because they can read sender and recipient? So if you write someone who do a lot of renting stuff they believe you might like it, too? Just a guess.

In all your scenarios the likely answer , even with great e2e is that WhatsApp would still know who you messaged and they might have googled the words at some point.

Your agent might have searched for latches after you messaged them. Your friend likely searched for cat litter before he messaged you.

In each of those cases, E2E may still be active but you’re compromised by the human equivalent of the age old analog hole.

Jane googles topics A,B,C,D

Jane sends unknown message to John

John fits the target profile of topic C

John gets shown ad for topic C

---

coincidentally, Janes unknown message was about topic C. Likely because she too believed it to be applicable to John.

---

Going further...

Maybe topic A was trending in Janes area. Jane's friend Sally got ads for topic A. sally talked to Jane about topic A. Jane searches topic A

A trend emerged where people who searched topic A, very soon afterwards searched topic E.

Jane is very late to hear the news about topic A. She gets shown ads for topic E. Jane thinks advertisers are reading her mind because she was thinking about topic E but didnt talk to anyone about it.

I believe that it's automated, they scan every message with some embedded piece of code (that you can't really verify and have to trust that's harmless), that looks for key words and serve ads. And don't forget that with judicial order you get 24h-real-time access to any whatsapp account in question.

It's e2e encrypted, just they have the keys and use them :)

this is the point. too much evidence against it and not enough evidence for it. i just don't trust facebook, google, apple etc.

They're not in the same category. Two of those are advertisement firms, one is a hardware company.

I dont need to believe anything, its proven by mane scientific researches.

Can you link to some?

Couldn't find the one I have read before.

But here are a few that I could find.

https://eprint.iacr.org/2017/713.pdf

https://www.researchgate.net/publication/312778290_WhatsApp_...

https://www.ijrte.org/wp-content/uploads/papers/v8i2S3/B1093...

Reply on news.ycombinator.com