Hacker News Reader

Comment by FirmwareBurner | Hacker News Reader

Ha, in Europe WhatsApp is even used by doctors and teachers to discuss patient/student matters, and even some government offices use it.

It's wild how entrenched it is in every aspects of society, from social to business.

Goes to show you how far good UX, simplicity and ease of use can take you.

View on HN

At least in the UK, group messaging over sms was always broken, and sending pictures still costs me extra money. The phone carriers brought it on themselves.

It's not the phone carriers' problem FYI.

It is in that if they supported MMS then we would not need to use WhatsApp

All phone carriers support MMS.

In the UK at least you need to pay for it - SMS and WhatsApp are free

The phone companies aren't bothered. You're the one locked into facebook.

I hope [1] is an example of that tide turning.

[1] ICO reprimands NHS Lanarkshire for sharing patient data via WhatsApp - https://ico.org.uk/about-the-ico/media-centre/news-and-blogs...

Same practically everywhere in South America. You basically could not survive without using WhatsApp due to its prevalence.

I'm sure it's mostly used for convenience rather than anything nefarious. Most of my doctors are in a medical group that uses an app with built in messaging. It's at least an attempt to allow texting that's compliant.

In Turkey when police stops you on a street they take photo of your ID card and then send those images through Whatsapp to a police station. And then you wait for an answer. Happens very often.

Is there not a way to query a database with the ID from a phone?

Why the extra steps?

I am not aware of such thing. May be they didn't want every police to query the database.

But it appears that there is a face recognition app https://youtu.be/l8R6ZwSTLzU?t=105 the guy who is using the app in the video was the interior minister.

Also security. WhatsApp end-to-end encryption or even better, Signal where messages can't be replicated to any other device is more reassuring than a custom implementation ...

But it looks like this lawsuit is exactly about the opposite, that messages cannot be accessed and reviewed easily. It's also easy to understand why banks prefer using secured applications like Signal when discussing secret deals rather than taking the risk that such conversations leak to e.g. competitors...

Signal is not designed for situations where an intended recipient is intentionally aiding an eavesdropper. It does not prevent an intended recipient from making copies of messages via the regular clipboard even with disappearing messages turned on, and even if it did, could not stop someone from taking a video of their screen.

that’s different than cryptographic proof someone sent the message. anyone can fake the above.

I doubt that more than 1% of people using WhatsApp actually care about E2E encryption

Yes, most people are using whatsapp because it was one of the first to use phone number as account handle and to dig into your contacts to find. No risk of mispelling a complicated account name, auto discovery + group chats. The rest is inertia helped by the additions of features like voice messages, video calls, stickers way way way before encryption in order to stay current with the competitions.

If you ask most people how can they be sure that meta is really encrypting end to end, most shrug off saying that meta already knows everything about their lives through FB, Instagram anyway.

> WhatsApp end-to-end encryption or even better

so they claim… not that fb has ever given us a reason to trust them.

Why risk lying about something like this? It makes no business sense, and I can't imagine the Facebook employees being so loyal as not to spill the beans here.

I am still waiting for someone to explain me why you can forward medias (image or videos) in whatsapp to new recipients without uploading it again completely if those images and videos are encrypted with the public keys of your recipients.

Since the forward is instantaneous and not involve a reupload, it looks to me the files are cached on the servers. If the recipient can see thee files and they are encrypted, it means that the server itself encrypted it using their public cryptographic key. If the server can do that, it means it either: - can decrypt your own files - cache them unencrypted

Correct me if I am wrong.

It is easy to test by sending a large video recording over a crappy connection, then forwarding it to another recipient. First upload can literally take a minute or more, the second action is immediate.

Consider the following:

You encrypt and upload the media to the storage server.

You share the download URL and key with person #1

Now how long would it take to forward that same message with the url and key to person #2...n?

Are you saying they would be using symmetric encryption?

Not necessarily, sender generates a private key for the piece of media, and shares the public key for that media item along with the download location to person 1&2 over their encrypted chat channels.

Zoom risked lying out this.

https://theintercept.com/2020/03/31/zoom-meeting-encryption/

Really? Then explain this:

https://newatlas.com/computers/facebook-not-secretly-listeni...

And this:

https://www.pcmag.com/news/facebook-app-caught-activating-ph...

And this:

https://www.wired.com/story/whatsapp-facebook-data-share-not...

And of course this:

https://www.propublica.org/article/how-facebook-undermines-p...

Buried in the Propublica piece (2021) is the ELI5 of the fundamental uncloaking mechanism:

>WhatsApp reviewers gain access to private content when users hit the “report” button on the app, identifying a message as allegedly violating the platform’s terms of service. This forwards five messages — the allegedly offending one along with the four previous ones in the exchange ...

This may not have much to do with the more specific abuse case of criminal financial conspiracies.

That’s not the point. The issue is whether Facebook has surreptitiously gotten data you don’t think they’d be getting, and get caught doing it. With regard to video audio and metadata the answer is YES. Will you now trust them with your “encrypted” conversation content?

You don’t need to trust Meta, there’s tons of regulatory oversight

Same in India.

How often is the use GDPR compliant?

I guess people don't care unless someone sues

Well, banks need this to prove their are not fixing price rates (e.g. as the Libor Scandal about 10y ago), and that they did their part in KYC and prevention of AML for the client, or that they not miss-sold a product in case of a legal procedure or claim.

So everything is recorded, encrypted, some is monitored in near RT by engines, and only accessed by human employees when necessary. A full log of who accessed what is kept.

This falls under Fair Use (not sure about the exact term) under GDPR, as is a sensible way for the bank to uphold their legal obligations.

> This falls under Fair Use (not sure about the exact term) under GDPR, as is a sensible way for the bank to uphold their legal obligations.

The term you're likely looking for is "Legitimate Interest", but that's not quite the same. You're looking for the bigger picture.

Full disclosure: I was the DPO of a gambling company and had to interpret the cross-regulation conflicts quite routinely. One of the big things with GDPR is that it can not overrule industry or domain-specific regulations. It will certainly influence how the data may be accessed, but as far as internal collection and storage goes, GDPR changes nothing material in finance.

Banks and trading shops are required to record and store all work-related communications. No exceptions, no excuses. The reasons are as you stated. To prove (or disprove) cases of insider trading, collusion, price fixing, front running, and all the other forms of fraud/abuse that would allow the financial outfits and/or their traders to break the rules and fleece their customers and/or counterparties. (They still manage, but at least it's not as blatant.)

The main impact of GDPR is that the financial industry has one additional reason to purge old records once the statute of limitations has expired.

Well put. Thanks for the comment.

It's not GDPR compliant but some governments don't offer any alternatives.

Which ones do, and what alternative do they offer then?

Never heard of it. Perhaps not in the entire europe?

I've lived in both eastern and western Europe and it's used a lot almost everywhere. As far as I can tell, the more Russian-influenced countries tend to use other services.

It's still crazy to me how people use Viber en masse in a lot of those places. The UX is abysmal and it's full of manipulative ads. Habits are hard to change.

Definitely not everywhere. It's not widely used in my country.

Can't speak for the entire Europe obviously, usage varies from country to country, but where I've been it's pretty well entrenched for bot social and business.

WhatsApp is widely used by UK ministers to communicate with potential donors, lobbyists and other politicians. I don't know why it's allowed; in-person meetings are supposed to have a civil servant present and taking notes. WhatsApp gets them off the FOI hook.

Case in point: The ongoing Covid-19 inquiry request for access to government WhatsApp messages: https://www.ft.com/content/208263bf-b6bb-4ea6-8e6b-ee2e522ac...

I thought it doesn't, the law just doesn't seem to be enforced properly?

is it feasible to have a reg where WhatsApp is allowed, as long as a copy of the transcript post-decryption goes to the national archives or whatnot?

> Never heard of it. Perhaps not in the entire europe?

Never heard of Whatsapp? Try removing the comments where you talk about it then.

I'm sorry you can't understand text.

Yeah, not entirely.

or how stupid people can be convinced that this is a SMS replacement because it uses phone numbers (When really it's just another internet messaging app that uses phone numbers as IDs). It took off due to social pressure in places with bad mobile texting networks. That's all.

Why does that have to involve people being stupid?

Reply on news.ycombinator.com