Hacker News Reader

Comment by keikobadthebad | Hacker News Reader

Facebook is not removable from many android devices... does this mean Zuckerberg has been seeing all user traffic for years regardless of tls?

View on HN

Yes and No.

for TLS traffic you need to also install onavo.

But the app does scan your contact list every couple minutes and send diffs to their servers. Even if you have never opened the app. And on previous android versions all your recently open apps list too.

But again, if you install whatsapp you must give them the contact list permission anyway otherwise the app is intentionally broken and annoying.

> for TLS traffic you need to also install onavo.

I'd be interested to know if it shipped as part of the Facebook SDK, as well.

I really think you are a fool if you install WhatsApp. I do think you are higher intelligence than normal if you install Signal. When I hear friends talk about WhatsApp I cringe. The few who have signal I regard highly.

Real life is full of compromises. If your grandma is on WhatsApp, and you want to talk to her, it might be a good idea to install WhatsApp.

(However, if you have time on your hand and principles, you can use WhatsApp on a burner phone, I guess?)

Or educate grandma on why she should use signal and that fools use WhatsApp since meta is balls deep inside the app and watching what you do.

outside of the imperium center, you'd be lucky to have one provider of some product or service. and usually they will only be reachable via whatsapp. because metabook used whatsbook as a backdoor for for their failed oneinternet(?) project.

remember the backlash fb got when they offered free internet in india and africa but only for the Facebook app?

well, everywhere in the world you get free whatsapp traffic, so everyone now is on whatsapp.

good luck convincing a business who get hundreds of sales call via WhatsApp tobuse signal.

or convincing people who can barely afford their water bill that they now need a data plan to use signal instead of free whatsapp.

metabook won on this.

> metabook won on this.

They won on distributing E2EE and the Signal Protocol to 99% of the world, which previously transmitted everything in plain? Sounds like a pretty good win to me.

Sure, if you have time on your hand and principles, you can try convincing your grandma to change her ways.

Security SWE here. I have worked with WhatsApp's security engineers, I donate hundreds to the Signal Foundation every year, and I like to think I have a good amount of experience by now in the security industry.

> you are a fool if you install WhatsApp [...] meta is balls deep inside the app and watching what you do.

WhatsApp uses the same protocols as Signal under the hood. The Signal team even helped WhatsApp implement it. Furthermore, the app has been extensively RE'd by third parties to validate it's doing what it says on the tin.

https://signal.org/blog/whatsapp-complete/

> When I hear friends talk about WhatsApp I cringe. The few who have signal I regard highly.

Your clear lack of knowledge on the subject matter combined with your judgement of others says far more about you than your friends. It seems that you have fallen victim to the Dunning-Kruger curve, so consider not judging people until that is rectified.

> Furthermore, the app has been extensively RE'd by third parties to validate it's doing what it says on the tin.

thats a freaking lie and you should feel bad for repeating it.

it was barely reviewd years ago. before all the shady features that even caused the original founder to leave the company (and a few billions worth of golden handcuffs) with an open letter about how fb destroyed privacy in WhatsApp.

EU and all sane state actors forbid its use (some recommends signal)

all recent political leaks was from fb (e.g. brazil, italy)

> thats a freaking lie and you should feel bad for repeating it.

It's trivial to RE the app. Plenty of 3Ps continually RE the app.

Support your claims of WhatsApp being backdoored with facts, not random assertions you pull out of - where, exactly?

> EU and all sane state actors forbid its use

Because it is E2EE. You don't want government employees to use an E2EE service because it kills transparency.

> some recommends signal

WhatsApp and Signal share the same exact protocol.

> all recent political leaks was from fb (e.g. brazil, italy)

Irrelevant to WhatsApp. They're run by a completely separate team within Meta, have completely different leadership and reporting chains, and has a completely separate codebase and architecture.

Again, support your claims with actual facts instead of incoherent angry rambling. Is it backdoored? Can Meta access your messages? Provide proof.

Consider using a different metric to judge people than the messaging app they use ;)

Only when they used Onavo, it seems?

https://en.wikipedia.org/wiki/Onavo is slightly more readable than the legal document submitted as the link.

I might be wrong but I think you need the onavo VPN installed

Then your YouTube, Snapchat analytics would get man in the middled

Reply on news.ycombinator.com