The Fediverse is not perfect, but it actually blew my mind a bit how much it lowered my blood pressure to not see the constant ragebait, and the calm of not being exposed and monitored at all times. I still have Snapchat just for one person, and WhatsApp which is Meta but still E2EE. Other than that, I’m all in on FOSS privacy approved apps and man does it feel great.
They have had some third party audits. It is not totally convincing to me as being trustworthy, but I see it as more of an acceptable necessary evil. Better than Discord, Snapchat, Facebook Messenger, probably even SMS. My wife’s whole family uses just WhatsApp, and so do some businesses even in her country. Believe me though, anyone I can get on Signal, Matrix, Session, etc, I do.
There have been third party audits, but the conclusions have been that you can’t know if it’s implemented correctly or at all. Nature of closed source. Because you can’t know where the keys are.
I get the doing business in their country. That is so difficult to overcome. I will not do it. Foot down on that one, and it does make it hard. My wife’s family does the same as you mentioned. I just tell them they are literally paying for fascism. They don’t care. Or you can pick from many of the ills of Meta products (energy use, AI, misinformation, or even simply making someone a billionaire by contributing nothing to society).
I’m working on it and avoid it when I can as I mentioned. The only reason I mentioned it is that it’s one of the last vestiges of apps I don’t fully trust. I treat it like SMS or email, I don’t send anything I don’t expect could be audited by the government with the right subpoenas.
But sometimes I’m in a weird position. If I need to order food in my wife’s country, I am not going to be able to contact the restaurant without WhatsApp. Then I, as a white American who doesn’t know them, am going to explain to the delivery guy the reasons why they shouldn’t support American fascism, in their native language that I am not 100% fluent in?
It isn’t American fascism of course. It’s everywhere.
But I get it, I find myself in the same boat traveling and visiting family. It really is pervasive. So in your scenario you can’t just go pick it up yourself?
I know there are other ones though: Everything in some places works like this where they want to do a call back - deliveries, doctors appointments, services. WhatsApp has almost, if not completely, replaced the phone, so even getting a local sim doesnt help.
I simply refuse to play along. I wont do it. Somehow we seem to work it out.
It is actually verified e2ee. However, they do keep a ‘spare key’ for every single user and chat, you know, in case they need to help you, the good guys at Meta.
Also, their e2ee is built on the signal protocol. Now, their server code and client code are not open source, so they could have left all types of doors open for their benefit. Also, the Metadata is not encrypted at all, something they actually brag about for some reason.
And just to be clear, I am a genuine 'everything-meta-hater" (and Google, MicroShit, Crapple, Crapsung, etc.), but spreading misinformation doesn’t help preaching about privacy and security.
That verified if their backups were end to end encrypted though right?
It’s also interesting what was out of scope:
Limitations
The following components were not in scope; NCC Group was therefore unable to evaluate and identify issues with them:
• Third-party and proprietary HSM vendor implementation.
• Backup encryption implementation.
• Side-channels in the access, creation, modification and deletion of backup data on third-party cloud storage.
Dude, you seem to be under the impression that I’m somehow defending meta, and you’re evidently in battle mode. I said my piece, provided the evidence as requested. I guess this is where I drop off of this convoy for ith you, buddy. Make of it what you will. Have a good day.
No, I am not in battle mode. I just read the link and found it interesting and responded with things I saw in it.
What I didn’t do, was realize you sent TWO links, and I failed to read the second one. But believe me I am not trying to argue in any way. I am just responding.
The second link was also just for backups.
Again, I am just saying that they are not able to demonstrate that they are actually implementing this, AND that both of those links are for backups only. Thats all.
And I totally get what you were driving at: it doesn’t matter, they have a “spare key”.
I don’t think it will. It’s just another outside audit (no idea if país by meta or not though). It is E2ee, that’s the bottom line. Now, the implementation is what dictates what that’s worth. It’s no different than client-side scanning or Microsoft co-pilot. What’s the point of having e2ee if someone else can get access either before encryption or by a third party, like meta, having a master key to decrypt anyway?
The first thing was if there was any indo of e2ee being implemented, there’s plenty, even Cloudflare audited them at one point if I recall correctly. But, nobody knows how it’s implemented, except for meta, and that’s where the lack of trust resides, because we all trust meta as far as we can throw our cars.
The Fediverse is not perfect, but it actually blew my mind a bit how much it lowered my blood pressure to not see the constant ragebait, and the calm of not being exposed and monitored at all times. I still have Snapchat just for one person, and WhatsApp which is Meta but still E2EE. Other than that, I’m all in on FOSS privacy approved apps and man does it feel great.
As far as you are told. There is no verification that is true.
They have had some third party audits. It is not totally convincing to me as being trustworthy, but I see it as more of an acceptable necessary evil. Better than Discord, Snapchat, Facebook Messenger, probably even SMS. My wife’s whole family uses just WhatsApp, and so do some businesses even in her country. Believe me though, anyone I can get on Signal, Matrix, Session, etc, I do.
There have been third party audits, but the conclusions have been that you can’t know if it’s implemented correctly or at all. Nature of closed source. Because you can’t know where the keys are.
I get the doing business in their country. That is so difficult to overcome. I will not do it. Foot down on that one, and it does make it hard. My wife’s family does the same as you mentioned. I just tell them they are literally paying for fascism. They don’t care. Or you can pick from many of the ills of Meta products (energy use, AI, misinformation, or even simply making someone a billionaire by contributing nothing to society).
Makes it hard.
I’m working on it and avoid it when I can as I mentioned. The only reason I mentioned it is that it’s one of the last vestiges of apps I don’t fully trust. I treat it like SMS or email, I don’t send anything I don’t expect could be audited by the government with the right subpoenas.
But sometimes I’m in a weird position. If I need to order food in my wife’s country, I am not going to be able to contact the restaurant without WhatsApp. Then I, as a white American who doesn’t know them, am going to explain to the delivery guy the reasons why they shouldn’t support American fascism, in their native language that I am not 100% fluent in?
It isn’t American fascism of course. It’s everywhere.
But I get it, I find myself in the same boat traveling and visiting family. It really is pervasive. So in your scenario you can’t just go pick it up yourself?
I know there are other ones though: Everything in some places works like this where they want to do a call back - deliveries, doctors appointments, services. WhatsApp has almost, if not completely, replaced the phone, so even getting a local sim doesnt help.
I simply refuse to play along. I wont do it. Somehow we seem to work it out.
Lol, story of my life. But the best part is looking at people’s faces when you say ‘I don’t have whatsapp’ 🤣
But there is a nearly continuous stream of occurrences where Meta is caught lying.
deleted by creator
It is actually verified e2ee. However, they do keep a ‘spare key’ for every single user and chat, you know, in case they need to help you, the good guys at Meta.
Can you show me where it’s verified? Did someone get to see the code?
https://www.nccgroup.com/media/fzwdxklh/_ncc_group_whatsapp_e001000m_report_2021-10-27_v12.pdf
https://eprint.iacr.org/2023/843.pdf
Also, their e2ee is built on the signal protocol. Now, their server code and client code are not open source, so they could have left all types of doors open for their benefit. Also, the Metadata is not encrypted at all, something they actually brag about for some reason.
And just to be clear, I am a genuine 'everything-meta-hater" (and Google, MicroShit, Crapple, Crapsung, etc.), but spreading misinformation doesn’t help preaching about privacy and security.
That verified if their backups were end to end encrypted though right?
It’s also interesting what was out of scope:
Dude, you seem to be under the impression that I’m somehow defending meta, and you’re evidently in battle mode. I said my piece, provided the evidence as requested. I guess this is where I drop off of this convoy for ith you, buddy. Make of it what you will. Have a good day.
No, I am not in battle mode. I just read the link and found it interesting and responded with things I saw in it.
What I didn’t do, was realize you sent TWO links, and I failed to read the second one. But believe me I am not trying to argue in any way. I am just responding.
The second link was also just for backups.
Again, I am just saying that they are not able to demonstrate that they are actually implementing this, AND that both of those links are for backups only. Thats all.
And I totally get what you were driving at: it doesn’t matter, they have a “spare key”.
I don’t think it will. It’s just another outside audit (no idea if país by meta or not though). It is E2ee, that’s the bottom line. Now, the implementation is what dictates what that’s worth. It’s no different than client-side scanning or Microsoft co-pilot. What’s the point of having e2ee if someone else can get access either before encryption or by a third party, like meta, having a master key to decrypt anyway?
The first thing was if there was any indo of e2ee being implemented, there’s plenty, even Cloudflare audited them at one point if I recall correctly. But, nobody knows how it’s implemented, except for meta, and that’s where the lack of trust resides, because we all trust meta as far as we can throw our cars.
Why use WhatsApp instead of Signal? I don’t go near WhatsApp because of Meta, so I genuinely know very little about it.