And if so, why exactly? It says it’s end-to-end encrypted. The metadata isn’t. But what is metadata and is it bad that it’s not? Are there any other problematic things?

I think I have a few answers for these questions, but I was wondering if anyone else has good answers/explanations/links to share where I can inform myself more.

  • amanneedsamaid@sopuli.xyz
    link
    fedilink
    English
    arrow-up
    36
    arrow-down
    1
    ·
    edit-2
    1 year ago

    Metadata is all the content of a message besides the actual text content of the message (i.e. what you type). Examples would be the date and time it is sent, what users these messages were sent to / from, and the IP addresses of both parties. (The availability of metadata varies from messenger to messenger).

    I like this example: If you only text your Aunt Sally, who lives in Alaska, twice per year to wish her a happy birthday and Christmas, just by looking at the metadata someone could infer the meaning of your messages, as well as your relationship to the person you’re messaging. To a point this is true about any messages you sent.

    As for Whatsapp specifically, it being end-to-end doesn’t really matter imo, as the application is not open source and is owned by an advertising / social media company. As long as the code is closed source, you cannot be sure:

    1. That your messages are encrypted at all
    2. That your encryption keys are kept on-device, and not plainly available to a centralized party
    3. That the encryption the application is using is securely implemented

    At least for applications handling truly sensitive information (for the average person only their messenger and browser), you should be using open source software. The easiest recommendations I can make are:

    1. Browsers: Firefox, Thorium, Brave (disabled all cryptocrap)
    2. Messengers: Signal, SimpleX Chat, XMPP

    Anyways, I hope this was a satisfactory answer.

      • Thisfox@sopuli.xyz
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        Fascinating.

        I have no facebook account, but family members who insist on Whatsapp instead of something more secure. I use it to contact them. How is it associated with a facebook id? Did they generate one? Or am I piggybacked on them?

    • BraveSirZaphod@kbin.social
      link
      fedilink
      arrow-up
      4
      arrow-down
      1
      ·
      edit-2
      1 year ago

      That your messages are encrypted at all
      That your encryption keys are kept on-device, and not plainly available to a centralized party
      That the encryption the application is using is securely implemented

      This is true, but something that should be noted is that, to my knowledge, no law enforcement agency has ever received the supposedly encrypted content of WhatsApp messages. Facebook Messenger messages are not E2E encrypted by default, and there have been several stories about Facebook being served a warrant for message content and providing it. This has, as I understand, not occurred for WhatsApp messages. It is possible, of course, that they do have some kind of access and only provide it to very high-level intelligence agencies, but there’s no direct evidence of that.

      I would personally say that it’s more likely than not that WhatsApp message content is legitimately private, but I’d also agree that you should use something like Signal if you’re genuinely concerned about this.

        • BraveSirZaphod@kbin.social
          link
          fedilink
          arrow-up
          2
          arrow-down
          1
          ·
          1 year ago

          Sure. My point is that, as far as I believe anyone is currently aware, there is no evidence that any law enforcement agency has ever accessed the content of encrypted WhatsApp messages. That does not mean that it has never happened either, but anyone positively claiming so is doing it without actual evidence, which is something we should probably avoid doing.

      • BearOfaTime@lemm.ee
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        If you log into WhatsApp on another device, does your history show up?

        If it does, that means they hold your encryption keys on their server. It’s the only way this could work.

        It’s why with Signal you need to maintain your keys and keep backups. No one else has your keys, so logging in to other devices won’t get history without that backup and the keys.

        Works this way with encrypted XMPP too, of course.

    • Azzu@lemm.eeOP
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      1 year ago

      What use is this knowledge through metadata to them? Let’s say I have no Facebook account and no other apps by Meta. There are no ads within WhatsApp. What do they gain by having this data about me?

      • amanneedsamaid@sopuli.xyz
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        They know your relationships with other people, and could infer things about you which will be stored in their servers regardless of whether you have a Facebook account, I believe if you search for “shadow accounts” you can read more about that

      • noodlejetski@lemm.ee
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        they can sell the information tied to your phone number or IP address to other companies, so they in turn now what ads to bombard you with.

    • Azzu@lemm.eeOP
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      How do I know other browsers/messengers actually include the code that is published when they arrive on my phone? Wouldn’t it be possible to simply add tracking/malicious code outside of the open-source repository, build an APK from it and put that on the Play Store instead of the “clean” code on the repository?

      • amanneedsamaid@sopuli.xyz
        link
        fedilink
        English
        arrow-up
        5
        ·
        1 year ago

        You could compile the software yourself, and the builds they do publish are reproducable, therefore any hidden malicious code would almost certainly be noticed in any popular application.