WhatsApp is more secure than iMessage: Mark Zuckerberg | Hacker News Reader

WhatsApp is more secure than iMessage: Mark Zuckerberg

facebook.com

57 pointsamrrs93 comments

Except you can never trust Facebook to care for user's metadata in a privacy-preserving way, which, to me at least, seems like a security risk. While the actual messages are encrypted, everything else (i.e the metadata such as your contacts, your connections, etc.) is not and is probably used/mined by Facebook. Why anyone would trust that company to do the right thing at this point is beyond me.

This is why I recommend friends & family use Signal, and they've actually adopted it due to the really easy on-boarding. It's probably the best iMessage alternative out there.

That's why I run an XMPP server for family and friends. It's the IETF standard, no vendor lock-in and has Signal-style encryption nowadays.

How hard was it to onboard less tech savy friends and family?

I am not sure op actually runs that server or was just being sarcastic

Not that hard. Everyone already knows how email works: you have to get an address first, download a client and login. I then showed them where to register (https://providers.xmpp.net) and how to download Conversations. It got easier once a good chunk of my friend group was already available there.

I tried this. and it didn't work! network effect is a thing and its hard to move away as people have to maintain 2 messengers.

It helped a lot that I refuse to be reachable on messengers that are not XMPP compatible. Most of the people I care about actually have reachable chat addresses now. For the rest I fallback to SMS and Email.

> network effect is a thing

Sure is. So is getting anyone to do more than the default.

I have an extended family SMS group, an "after hours" work SMS group, and an SMS group of some people I play online computer games with.

Nobody across any of these groups is happy with the down-sampled videos, the inconsistent emoji reactions, and other SMS oddities. It's a constant complaint across all groups.

I have suggested we switch to Telegram or Signal multiple times. Not a single person is happy with SMS. Not a single person has even bothered to install Telegram or Signal.

I love XMPP but I onboarded 20+ extended family members just by giving them the Signal group link. I don't want to think what kind of headache introducing my 92 year old grandfather to XMPP would be.

Funny you should say this. It's exactly why I started the Snikket project. I already ran a family XMPP server, but it was nowhere near user-friendly enough, and I was tired of provisioning accounts manually and explaining what an XMPP client was every time someone got a new phone.

I started the project early 2020, obviously with no knowledge of what was around the corner. Then during lockdown managed to onboard ~11 family members entirely remote by sending them a simple invitation link (some via SMS, some via email). The best part of the whole thing was how it enabled my (then) 4 year-old to independently video call 80 year-old grandparents (using an old Android tablet).

Happy to report that a couple of years later it's still the primary method of communication between family members. Obviously it hasn't fully replaced WhatsApp/etc. which they still use for most of their contacts. But still, gotta start somewhere!

Checked out your website, this is an excellent idea and a great approach to fixing XMPP UX issues. Best of luck with your project!

Signal is dropping SMS support soon. It was one of the main features that I was able to convince my friends and family to use this app, a convenient all-in-one messaging app. Without it I'm not sure anymore, quite a baffling decision on their part.

Many years ago when Signal was quite new I thought that they should implement SMS mirroring, similar to how you can access iMessage on your phone/laptop, and how services like Pushbullet and Project Fi offered SMS mirroring. It'd be a great "carrot" to get people using Signal and the more that did, the less would actually be using SMS!

I submitted a feature request and it was promptly denied. I got the impression they never really wanted to support SMS from the beginning. It was just a carrot even then, and they weren't going to focus any more effort on it.

I am disappointed by this but my family is 50/50 iPhone and Android. I'm not sure anyone knew of the SMS integration.

Seems to be the same with my crowd. The only people who messages me over text is my dad and distant relatives. But I haven't tried to push Signal on them. While I do understand the "need" here, I do think it is easier to push on Gen Xers and younger as they are far more comfortable with multiple messaging apps (and I don't know of one that doesn't have multiple. Minimum SMS + WA, but usually includes GroupMe, Telegram, and Facebook Messenger). I know this is an issue people are pretty vocal about but I'm having a hard time believing it just isn't a sampling bias.

And to onboard iPhone users you just need to get them frustrated with not being able to send photos and videos to Android users. Thanks Apple. Apple users get tired of sending videos to Android users and them responding "email it to me" or "let's use Signal."

I was chatting with a friend on whatsapp about a guy we used to play sports with in our childhood. Hadn't really seen or heard of him in decades. Very next day, top recommended friend on facebook was that guy. Seems unlikely to be a wild coincidence. That said, I wouldn't(and don't) trust Apple either.

WhatsApp may be sharing your contacts with Facebook to provide friend suggestions.

Reference: https://webapps.stackexchange.com/a/117130

This is different though. Never had this person's contact, we just mentioned his name in a chat a couple times cause we were talking about stuff from when we were kids.

It could be because your friend looked him up. Or friended him. They don't go through messages.

This is likely a recognition of a hit and ignorance of misses. If the friend was suggested before then you probably wouldn't notice. But there's still a lot here that even me with little information can give reason to suggest that friend. For one, you mention that it was an old mutual friend. Facebook is going to use the metadata (you talking to your friend) and search for potential mutual connections. But there's more. If that friend recently talked with that other friend (likely a prompt for that discussion), Facebook knows (either by GPS or by mutual conversation on one of their platforms, or even a friend of that friend connection).

I'm not trying to say that Facebook isn't reading your messages (I doubt they do tbh, because ->) but rather trying to demonstrate that they don't need to in order to make these creepy connections. This is the importance of metadata. Data you may not even know about!

Think about it this way: a private investigator sees who you talk with, how long, where you go, etc. But they don't have the actual record of your conversations. The PI is working on metadata. We find this creepy and invasive because we can recognize how this information can be used to gather intimate aspects of our lives. Companies like Facebook are essentially doing the same thing but at scale. And you can probably imagine how the scale both helps and hinders this invasion (but likely overall helps).

> old mutual friend

Just someone we played sports with. He didn't live in our city, moved away in his youth, and we had zero friends in common on facebook. Haven't seen him suggested as a friend since he disappeared as a suggestion a couple of weeks after that.

I think you've missed the important information I was trying to convey. What sparked the conversation about that friend? Did your other friend say "Hey, I ran into so and so recently"? If so, then that's more than enough information for FB to make that connection (FB sees that these two people were in close proximity, through GPS, and stayed near one another for an extended period of time. Meaning they probably were talking). But that's not the possible path to the suggestion.

There is also the psychological aspect of we recognizing hits more than misses (in this case. Often it is the reverse but context matters).

People care about utility, usability, and cost. Except for the 10 neckbeards in Hacker News, no one cares about privacy in the real world. People won't stop using Apple products which is built on slave labor in China but will froth in the mouth about privacy.

The mainstream media will be frothing at the mouth at how Apple products are built on slave labor, while all phones, Apples and their competitors, are built in mostly those same factories.

The only difference is that Apple publishes their yearly Supplier Responsibility report, which, yes, does contain reports that their audits found violations. And then the violations are resolved or the supplier is banned. What more are they to do?

There is a long way to go, that’s why it’s a progress report. And yes, there are aspects that are left unmentioned, like the unionization debacle in the stores. But really Apple is not who you should be focusing on for slave labor.

https://www.apple.com/supplier-responsibility/pdf/Apple_SR_2...

Nailed it. WhatsApp was the first or among the first few kids on the block... and maybe if FB didn't acquire them, they'd have improved or heck, even gotten subsumed by Signal. Signal's non-profit and for now, well funded... nowhere near the coverage of WhatsApp but I steer everyone toward Signal when I can...

I don't trust Apple either.

WhatsApp also doesn't get screwed up by weird carrier sms integration like iMessage does.

Just traveled overseas and used a different sim card with my phone. Not only does this screw up iMessage while overseas (it shouldn't), but for 2 weeks after getting back iMessage would occasionally just not receive texts. Did 3 Network resets and the last one (at 2 week mark) finally fixed it.

I'm sure this is more verizon's fault, but Apple needs to work around it.

You must have never had to transfer WhatsApp on a new carrier and find out that the carrier MITMs your SMS and you cannot activate that way and you have to ask your carrier for that. Not common in the US or western EU I suppose, but there are lots of countries that aren't in those areas and they have carriers too...

I had this problem too. Call your carrier and convert your domestic SIM to an eSIM and pop a new physical one in.

Turn off roaming on main SIM card and iMessage still works, but uses the data of the other SIM card.

I've tried doing this, only the other way around — kept my provider's physical SIM and bought an eSIM for travel.

Turned off roaming on the physical SIM and made data only go through eSIM, but it still got all messed up. :(

Interesting and thanks! I'll give this a shot.

Ugh, this is the worst. And then people are like "why are you suddenly messaging me from this other account".

Started using whatsapp few weeks ago in new area where is common.

Very annoying UI to get started. You need to add new contact, then from massive list select country code and finally you get to paste number.

For iMessage - default yourself and others to use apple id email address.

On the face of it, this is true. Since most people enable iCloud backups of messages, which are not encrypted, you should basically think of iMessage as unencrypted, unless you are very sure both you and the person you are messaging do not have iCloud backups enabled.

On the other hand, I'm not sure how much to trust Zuck's claims of WhatsApp encryption, or if external people have attempted to verify the claims, but it seems like such a big deal to lie about, that it's probably true?

Of course, that's only going to provide you passive protection from things like automated scanning of messages. If you become a target, it seems as though there are always exploits floating around which can be used to hack your phone, and then all bets off.

iCloud backups are encrypted, just not end to end. Which is as good as not encrypted.

How good it is depends on the actor/threat model. I'd say that server-side encryption is always a good thing when you include someone trying to steal disks from a SAN array to see if there's tasty data on it.

On the other hand, if your adversary wants to get your stuff, they will find a way. The whole cryptography thing is just imposing cost on a potential attacker, not a universal warranty against any possible attack. Someone can still locate you and beat you with XKCD's $5 wrench for your password.

Ideally we'd have end-to-end encryption on everything without adding complexity for end-users. But a lot of that stuff seems to be hard to build and at least just as hard to retroactively bolt on to a system. iMessage (iChat) goes back a long time and supports many platforms (yes, within the apple ecosystem, that is) which means they can't easily nuke every legacy API at once.

> if your adversary wants to get your stuff, they will find a way.

This is true, and to add to it: for state level actors, “wanting to get your stuff” expands to passive collection of data as well as well trodden paths to more targeted surveillance. End to end at least throws up a few more barriers.

They are end to end encrypted, but you are not the only one holding the key. So although you can’t see for yourself, Apple does control who gets to look and there is no analytics going on.

And you can of course always chose to run local, encrypted backups.

They are not end to end encrypted, per Apple’s KB entry here: https://support.apple.com/en-us/HT202303

True, it depends on what you consider the ends. If you consider the ends to be the device and the storage, it’s encrypted all the way. But if you consider the ends to be the original device and the new device, it is not end to end encrypted because indeed Apple does have access to the key and password recovery is possible. But it is encrypted so it is possible to control and log who has access, IE not any random developer, support person or analytics system.

WhatsApp backups also aren't encrypted by default. You need to turn that feature on manually.

There was an external audit in 2021 – https://research.nccgroup.com/2021/10/27/public-report-whats....

This is generally true, though there's an asterisk: https://www.rollingstone.com/politics/politics-features/what...

Whatsapp adding end to end encryption for backups is a big deal, though. The FBI pressured Apple to not do so for iMessage.

> The other tech giant that can be compelled by law enforcement to hand over potentially large amounts of sensitive messaging data is Apple. iMessage, Apple’s text-message service, comes loaded on the iPhone and is used by 1.3 billion people worldwide. According to the FBI’s “Lawful Access” guide, if served with a court order or a search warrant, Apple must hand over basic subscriber information as well as 25 days’ worth of data about queries made in iMessage, such as what a targeted user looked up in iMessage and also which other people searched for that targeted user in the app. That doesn’t include actual message content or whether messages were exchanged between different users.

> But the amount of data available to law enforcement is potentially far greater — greater even than the user data provided by WhatsApp — if a targeted user backs up their iMessage activity to iCloud, Apple’s online storage platform. If that’s the case, the FBI document says, then law enforcement can request back-ups of the target’s device, including actual messages sent and received in iMessage if they’re backed up in the cloud.

> While Apple describes iCloud as an encrypted service, it comes with a giant loophole. Apple holds an encryption key that can unlock user data in iCloud, and so police departments or federal agencies can request that key with a search warrant or a customer’s consent to access certain user data. “You’re handing someone else the key to hold onto on your behalf,” says Mallory Knodel of the Center for Democracy and Technology. “Apple has encrypted iCloud but they still have the keys, and as long as they have the key, the FBI can ask for it.”

Except for the fact that a new exploit which allows RCE is found every year.

It's beyond me how WhatsApp has had so many exploitable memory bugs compared to e.g. Signal or Telegram. Is it really just because security researchers would rather look at WA than Signal because of it's bigger user base?

Except for the fact iMessage is well known for its RCEs as well: search for "iMessage RCE" you will find them.

Furthermore (this may not be the case anymore), iMessage is more privileged than other apps and so once exploited an attacker has a far greater reach.

Yup. That's why I don't use iMessage. :)

Probably because they're a large target and because it's more financially worthwhile. I imagine their bug bounty program pays out more, plus I know they've awarded $50,000 per research grant in the past.

That's not a statement that is supported by Whatsapp's own privacy policy, and it's deliberately vague to subvert from how Meta uses your available data for advertising purposes.

To use a few examples:

- When sharing your location with a contact. This feature is provided by sending your location to Meta, not directly to the contact through E2EE. Even when not sharing your location Meta will approximate your location from your IP address and other available information such as the phone number area codes. For both of these scenarios Meta feed this information back into their system for other uses.

- Your contacts, and all metadata are taken by Meta for their usual purposes.

- Any kind of status update is immediately provided to Meta. Whatsapp's E2EE applies to only a specific subset of the app's functions.

- There are a range of automatically collected pieces of information that the app provides whatsapp, anecdotal evidence also indicates that whatsapp reports back conversation keywords. Such reporting usually presents unseen security risks to users.

Meta have been attempting to dilute the conversation about privacy and security by providing sly talking points for how their products are "private" and "secure". For example: They have stated that facebook is private because their servers are well maintained against hackers. They're currently heavily advertising whatsapp as secure because it offers E2EE messaging - neither of these statements address the underlying issue with Meta: it's an advertising company based on invasive data collection. Meta build profiles on users which are unacceptably detailed, we wouldn't trust our own elected representatives with such detailed profile building.

From a personal standpoint, why should I care about having profiles built for ad targeting anyway?

This would be a long reply that duplicates a lot of information you can find online about the dangers resulting from such profiling, such as how that information is shared and joined with other sources to accurately identify individuals. The short answer is that it's not just ad targeting and Meta have proven repeatedly that they're not good custodians of such data. Additionally this presents scenarios where such information can be subpoenaed - to use a recent example there are now legitimate concerns for such data since the rolling back of abortion rights in the USA.

Independent Fact Checkers have confirmed this is false.

Would you mind sharing who those independent fact checkers are?

I think it's a joke, this is the text that Facebook puts at the bottom of some false information.

As with all jokes though, I think there's an element of truth to it. May not be independent fact checkers, but discussion in this thread covers the iMessage comparison and I wouldn't say it's as clear cut as Zuckerberg would like to make out.

Hmmm... Except for the fact that people who don't use Facebook are never going to get the joke...

I don't use Facebook, but I know enough about their half attempt at fact checking to get the reference.

Never use any Zuckerberg products. Delete them all.

this is technically correct. Yet missing the bigger point of the privacy war between Apple & Meta

Maybe the fact that Apple is worse in one of the few areas the user can actually verify should make us second-guess our preconceived notions? What if Apple is just better at PR?

I've been trying to figure out how end-to-end encrypted communication is supposed to work in these apps. From what I can gather you need two things, a central server, and public key encryption. To start a conversation your first task is getting the public key of your intended recipient. This is supplied by a central server that acts as a public key repository and message relay/store. Then you can send your message by leaving it at the central server for later delivery to the recipient (encrypted with their public key.) This is also the start of some form of key exchange in the hopes of switching to symmetric encryption for future communication.

I see problems with this setup. The central server is responsible for relaying communication since there is no directly link between those trying to communicate. It is also responsible for handing out public keys. It is literally a man in the middle. What is stopping the central server from lying about the public keys? What is stopping the server from decrypting everything?

Hopefully my understanding of this is wrong. It is certainly incomplete.

Apple should make iMessage backups E2E encrypted but I otherwise trust Fb far less.

Client-side encrypted, rather.

Or, maybe or, they are both closed source and given the USA mass spying and secret tribunal we gotta assume they all have a backdoor. And that this backdoor has been found and exploited by black hats and corrupted employees or politicians.

I think people are missing the point here. The reason he is calling it more secure is because it is multi-platform. iMessage isn't secure if you aren't talking to another iMessage user. Apple's walled garden is a great strength but also their Achilles heel.

But of course, this is why I use Signal instead. If I'm going to use a 3rd party app, why not use one that is actually secure.

But given his history of acquiring the product he has no right to talk; what he did is blatantly criminal

I'm not sure what that has to do with my comment though. I think we are all in agreement that Zuckerberg is not a "cool dude". But that seems relevant for a different thread and not a response to what I wrote.

My wife was planning a trip with a friend on Whatsapp and for the first time in her life mentioned something about renting a car. She never searched for it in Google or anywhere else but not 24h after that, car rental ads for the specific city she will be visiting started to appear in her Instagram feed.

So I guess when Zuck talks about security that doesn't include privacy.

lol.

(I know we should have more substantive comments, but honestly, anything Mark says, I assume is false on its face)

I agree with you regarding Zuckerberg -- he's in the same camp as every politician (imho). Nevertheless, if you don't have anything substantive to say, it's always an option to just not say anything. Just saying.

I usually do refrain. This time, I just couldn't. In all honesty, replying with "lol." was at least the safe for work version of what was actually in my head.

He's not wrong in this case, though.

He's probably right but, based on past experience, there's significant risk of Meta changing this in the future for revenue-generation reasons. Trust is hard to earn and easy to lose.

How about this: neither are secure. If you want security, use PGP or something like Wickr (if you trust Wickr's security claims).

Mark Zuckerberg says his product is more secure than his competitors. I would expect him to say that, regardless of the 'truth'.

Isn't WhatsApp messages sent to Apple's Push Servers without e2e encryption. Just stating the obvious

Then adopt Signal's GPL and prove it. Or any other free license. Until then, any claims are hollow.

Shouldn't he be cracking a whip over at the 'legs in vr' division?

The Zuck cares about our security and privacy? Cute.

Only an open protocol like Matrix will end this race of platforms/apps for users and their data. WhatsApp or iMessage is not a real decision from a user perspective...

lol. Zuck, you spied on people with Onavo and kicked Acton and Koum out of the company, you have no moral standing whatsoever

If it is, then why would he be so desperate for us to use it?

I would assume he has a bone to pick with Apple (see the not-so-subtle jab at Connect as well).

And yet, nothing Zuck says will help me to trust him. Makes me wonder what Meta / Fb could be with a different leader. He’s not a product visionary.

He created facebook and is responsible for the purchase of Instagram. That makes him a product visionary in my book.

The question is whether he still is one or the market has moved past him. No one stays relevant forever.

There you go.

Founding the fastest $1 trillion dollar company in the 21st century sounds like what a product visionary would make and Zuckerberg is undisputed over that claim, while many have told him the Instagram purchase was a mistake, after finding another billion users again.

The proclaimed death of Meta Platforms. Inc has been greatly exaggerated (again).

He created facebook but over time the number of people using it dramatically decreased and it will never be same again. All the ads make me feel controlled by their product.

Everday I ask this question to myself. Will the world a better place without Facebook and Instagram?

> over time the number of people using it dramatically decreased

Eh?

https://www.statista.com/statistics/264810/number-of-monthly...

It does not show the amount of time each user spend on facebook.

I don't think being a product visionary would make his statements about messaging privacy more trustworthy. Or at least, they shouldn't. Peter Molyneux is a product visionary, but I'm still not playing the full release of Godus.

Not true https://www.livemint.com/news/india/whatsapp-says-indian-gov...

Reply on news.ycombinator.com