WhatsApp CEO on the controversy surrounding proposed German communications laws
spiegel.de
spiegel.de
To solve this problem, they provided a Docker stack that would essentially spin up a specialised WhatsApp Client on the customer’s infrastructure - so you’d be running the API locally, send and receive messages in your own network, and the client would handle encryption before transmitting to the WhatsApp servers. All containers would connect to a local SQL database to store their data, and included a REST API (curiously written in PHP). To handle high load, you had to spin up more images in distinct patterns and configure sharding per stack.
This was a nice, albeit highly technical solution to the problem. As WhatsApp partners we built lots and lots of additional infrastructure to manage 12000 individual Docker-Compose stacks in a distributed, reliable way. That worked surprisingly well, but obviously is way too complex. So in the end WhatsApp concluded it would be easier to take care of the container hosting themselves, shoving them into AWS, integrated with the Facebook business manager. And all this lead to a necessary change in the terms of service, as WhatsApp hosting containers in AWS opened the possibility of e2e no longer being given.
If WhatsApp is doing things that are just on the border of legal, or let's say unpleasant for a lot of people, every time the terms of service get updated, people will be confronted with them. That is a risk, looking at what WhatsApp is doing. If I were CEO of WhatsApp I would want to be as quiet as possible about what kind of things that are happening outside of view. Every change to these terms of service, every time you point them out, you run the risk of people complaining about all the unpleasant things that are happening.
Were businesses not ready to run the client themselves ?
The delegation is still in place in terms of encryption: Everything the client sends or receives is encrypted or decrypted using a client-local private key, even if the client is running on AWS servers, rented by WhatsApp. In theory, noone but the business itself has access to the data the client processes, plus it's an optional service: You're still free to host the client yourself. It's just easy to mess up. Take a look at the documentation for a recommended production setup if you'd like to get a peek: https://developers.facebook.com/docs/whatsapp/installation/p...
Not just typically privacy sensitive people, but also lots of normal people.
Most people still have WhatsApp for that one or two friends and relatives that don't want to switch. But most activity has moved on.
I mean, I too trust Durov more than Zuckerberg but that's an extremely low bar to clear, and you're giving them a lot more data.
I got signal, telegram and element.io . I encourage non technically savvy people to go to signal and technically savvy people to go to element. But I see a lot of normal people switching to telegram.
Possibly just network effect due to the whatsapp exodus. If somebody you want to communicate with only has telegram, you also download it.
Then why is it ?
This is far nicer on smaller home servers, but matrix.org is the "default experience" of element and that's what people are judging it by.
Funny how you mention this - scrolling back manually is literally the only way to go to past conversations on mobile, as the search does not work with inflected languages. The only way to search for past content is to dump your whole message history on the desktop client and run grep on it.
Disassembly and analysis is also harder with binaries than original sources and an open, reproducible build process.
WhatsApp messages have E2E encryption by default, you can not opt out, and the keys (each message has a different one) are never sent to WhatsApp or anybody else.
Users may OPTIONALLY enable a cloud backup, which puts an encrypted backup on iCloud or Google Drive. WhatsApp (Facebook) holds the key for this, but not the data, and law enforcement would need the cooperation of Facebook and Google/Apple to access the messages.
But that is all completely opt-in. By default, messages are not backed up, contrary to what you said.
Full disclosure: I use WhatsApp but am eager to switch away from it a soon as Signal implements a local backup on iOS.
It is a plaintext backup to Google Drive, whatsapp does not encrypt it before uploading it to Drive or iCloud.
https://news.ycombinator.com/item?id=26458102
> But that is all completely opt-in
You cannot control your contacts backup settings. Every contact I have (100+) has enabled the backup option, meaning all my 'e2ee' chats are uploaded in plaintext to Google servers.
With Telegram, I can be sure e2ee/secret chats with my contacts are not going anywhere other than the device they were delivered to.
So you have no idea whether it's actually E2E encrypted, and by default it is not.
Sure, if your threat model means you are worried about the key backups and particularly your friends key backups, you shouldn’t use WhatsApp.
I’m not sure how you end up at Telegram with that threat model.. but whatever floats your boat.
I’d wager most people care more about FB not being able to read their messages. And they can’t. Maybe one day that changes but they will be required to communicate those changes.
Encryption is literally not E2EE if the private keys are uploaded to some random third party, maybe even without your knowledge (you have no idea what your contacts have done).
When you read how the cloud encryption works in Telegram, with the encryption keys stored in different data centres and even different countries to protect against any one person or group being able to read them, I personally feel pretty happy with that. (See https://telegram.org/privacy#3-3-1-cloud-chats)
Having the messages stored in the cloud and not having to rely on my phone (except for registration) is a huge win for me personally. Especially during the lockdown I almost exclusively use desktop versions of these and the Telegram one is great.
And you do this every time there is a new WhatsApp version? How confident are you that you can find any backdoor in the binary? And it doesn't have to be in the encryption/decryption part, all it would need to do is hide the encryption key in a message back to the server, so you'd have to inspect the entire binary every time. Even if you do have the time and skill to do this it's not exactly feasible for most people.
I'm not trying to argue that there is a backdoor, just that in both cases you have to rely on trust.
> You should only trust it if you believe that organizations who want your data can’t invent a good story.
It's not just inventing a story though, their backend is also open source so they've also implemented this story. Of course that doesn't mean there isn't a backdoor in the production version, but you see how the trust you need in both cases is the same.
Edit: Actually the backend isn't open source, I was thinking of signal
Secondly, Telegram secret messages have been repeatedly proven to be E2E encrypted, including by independent researchers, so "Pavel can read all your messages!" is just misinformation.
As for the alternatives, well Signal is very likely compromised given their server repo is abandoned and they refuse to address why (they maintain a closed source version). Why else would an "open source project" act that way, if not gagged?
You’re referring to the optional backup that requires users to opt-in. This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key (but not the data) to that. Both companies would need to cooperate to read your messages, and this is OPT-IN by default.
This isn’t E2EE, but it’s opt-in by default. It also has nothing to do with the key exchange for E2EE messages.
You’re comparing WhatsApp, with all messages end-to-end encrypted and where the only way to compromise that is an opt-in cloud backup, to Telegram, where the vast majority of people (anyone using cloud chats) do not use Telegram’s encryption.
Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.
It is a plain text backup to Google Drive. There is no key Whatsapp holds. Google can read it all, and has revealed the chats to help the Govt in multiple high profile cases here in India.
You can extract it yourself, with the credentials of your Google account- https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre...
> You’re referring to the optional backup that requires users to opt-in.
With telegram, if you enable secret chats, it is never backed up to the cloud. It is a guarantee, unlike Whatsapp where you do not know whether your contact has enabled cloud backups
Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.
Signal has client-side E2E encryption.
People are killed over metadata.
Show me how you can prove what they publish on github is running on Signal servers and I'll agree here. Otherwise this point is moot.
They could publish cute cat pics on the repo instead for all I care, it's the same level of trust involved.
His public image carries more weight than Zuckerberg ever could (I don't think Zuckerberg could become a public figure in the next decades like Gates is).
From https://en.wikipedia.org/wiki/Pavel_Durov:
> On 16 April 2014 Durov publicly refused to hand over data of Ukrainian protesters to Russia's security agencies and block Alexei Navalny's page on VK.[4] Instead he posted the relevant orders on his own VK page [23][24] claiming that the requests were unlawful.
> On 21 April 2014 Durov was dismissed as CEO of VK. The company claimed it was acting on his letter of resignation a month earlier that he failed to recall.[4][25] Durov then claimed the company had been effectively taken over by Vladimir Putin's allies,[25][26] suggesting his ouster was the result of both his refusal to hand over personal details of users to federal law enforcement and his refusal to hand over the personal details of people who were members of a VK group dedicated to the Euromaidan protest movement.[25][26] Durov then left Russia and stated that he had "no plans to go back"[26] and that "the country is incompatible with Internet business at the moment".[4]
Is he a russian agent? Probably not. But, he's not dead or in prison, I'd say that counts against him. He's complied with fighting "extremeism" in Russia. If Russia did want a view into international communications they would have to publicly distance themself from him. I'm not saying it is the case, but I think the chance is pretty far from 0. Certainly everyone benefits from the appearance that he and Russia do not get along. The chance his co workers are russian is higher, and therefore the chance that Russia has leverage (money/property/family/blackmail etc) directly over at least one employee seems pretty non trivial.
I don't see any good reason to believe Russia or himself are distant on purely the grounds that both of them say so.
Is freedom/what's morally right a guiding light? Well, it's run out of Dubai, the middle east isn't exactly a shining star of liberal ideals. Not everything is encrypted automatically.
Are they consistent? Company is supposed to be a non profit entity but isn't structured that way.
Are they aligned with privacy? Their revenue model is ads, a revenue model with deep precedence for violations of privacy. I see no reason that he wouldn't take a zuckerbergian approach.
I don't find telegram to be any more trustable than Facebook. If I were using a platform for political speech, something I could be blackmailed for, or anything else that would get a state actor interested in me both seem like equally bad choices.
If you don’t have it, people understand why. If you’re in a small to medium sized chat group, people are willing to move it to Signal or an alternative, they are not afraid anymore to try the non-default option.
Now to see if this momentum will last...
I've so far not accepted the new whatsapp terms of use just because I'm curious to see if they will actually pull the trigger on this and disable access. I know many people that are sufficiently annoyed to refuse to click "agree" on that one for the same reason.
My prediction is that Whatsapp will weasel their way out of that one when their self imposed deadline comes up by simply forgetting about it. I agreed to terms of use when I first used the app. So, they could just drop the whole thing and accept defeat. If there's something in these new terms that they need me to agree to, they just need to come out and tell us what that it is exactly. Either it matters or it never did. They are basically saying it doesn't matter but we still need to agree. The corporate weaseling is what is generating the suspicion. And of course Facebook doesn't have a great track record in general.
The alternative may be having to disable millions of accounts which would predictably lead to lots of the remaining users discovering Signal or other solutions when their exiled friends start using those exclusively. I don't see why Facebook would want to let that just happen. So postpone, silently drop the the new terms of use (because as they assure us over and over again there's nothing new in there anyway), and move on.
She was on Android and was able to recover her account and we set up 2FA. Her friends were not so lucky, many of those with iPhones apparently had to change phone numbers to make it stop. I don't understand why but I also couldn't see their phones.
Anyhow, I encouraged people to give Signal a try. It at least doesn't send links that can hand over your account by text.
It is not. Consuming it is absolutely legal. It is even in our constitution that the state does not censor.
What is illegal is "making" (for lack or a better word) hate speech and inciting violence.
Example: You can buy Hitler's "Mein Kampf" since 2015. Before that it wasn't possible just because Bavaria held the rights after Hitler's death and refused to publish uncommented full versions. Since books enter the free domain 70 years after the author's death, Mein Kampf entered it in 2015.
Except the way they manage contacts. It is a complete mess - I have contacts that changed their phone and there is NO WAY to remove them from the Signal contacts.
They are not present in any of my phone contacts but somehow cannot leave Signal.
1. Settings -> Users & Accounts -> Signal.
2. Click on the trash icon to remove Signal. Don't worry Signal itself will not "forget" your messages or your contacts.
3. Launch Signal. Touch the pencil icon to create a new message. Click on the "..." three dots at the top right of the screen and refresh.
Et voilà, your contacts are in sync and the ghost contact should have disappeared.
No idea how it works on an iOS device though. Sorry.
Would you have an idea how to do the same exercise on a (Windows) desktop? I will just uninstall and reinstall but if there is a less invasive solution that would be wonderful.
Thanks a lot!
Sorry, I use a Mac so can't advise about Windows, though I have the same problem on the Mac app and I'm stuck with a few old contacts that I just can't remove without reinstalling the application itself.
>DER SPIEGEL: Soon after you announced your new privacy policies, chain letters started circulating on WhatsApp. People recommended other messenger apps like Signal, Threema or Telegram and said WhatsApp would read phone books and misuse the contacts.
Cathcart: There is a lot of incorrect or inaccurate information. That’s why we have delayed the update and send additional information to users directly in WhatsApp. Let me be very clear: We cannot read your messages, we cannot listen to your calls. When you send your location over WhatsApp, we do not know where you are.
>WhatsApp would read phone books and misuse the contacts?
We cannot read your messages, we cannot listen to your calls. When you send your location over WhatsApp, we do not know where you are.
The content doesn't matter, it knows who you communicate with and how often, and that's already a privacy concern (wife wants to know if husband cheats on her with someone else? and so on).
But of course the WhatsApp CEO doesn't mention this ... much easier to say "we don't look at your content" to give it the spin they need.
DER SPIEGEL: Do you share these numbers with your parent company Facebook?
Cathcart: No, we don’t. The updated privacy policies will actually not change anything globally in our ability to share data with Facebook.
That's the weakness of current chat tools right there. They can't listen in but they do know when you talked to whom and how long, how often, etc. In fairness, Signal and Telegram are similarly dependent on phone numbers. The traffic might be encrypted but even just knowing who talked to whom, when is useful.
Funny as if saying "just the phone numbers and not the names" should make us feel safe, Facebook already asks for your phone number, and could correlate your data that way.
the only thing the number is needed for is to create a new account.
> we can hand over, for example, the IP address, user name or profile photo
Seems to me that they don't have to collect the name from the phone book, they just match it with the profile information (at least)
Wonder what the alternatives are? I'm no expert and might be completely wrong but my assessment re usual suspects goes like this: Telegram? No E2E! Signal? Ceased to update their self-hosting software! Matrix: not a really open protocol to begin with!
Over ten years ago, XMPP used to work just fine (and IRC before that) so I'm just wondering why we have to reinvent the wheel all the time. Messaging isn't exactly rocket science.
I won't tie my online presence to a proprietary vendor with no alternative clients and service providers since that's strictly worse than what we have today. Remember WhatsApp started like those other providers but then got acquired by Fb.
So it's SMS/MMS for me I guess.
If you have Android contacts then Quicksy is on the app store and an easy jump from WhatsApp, with the benefits of an open federated network. I believe iOS is planned, but in the meantime Siskin is a decent choice.
There is a lot of development activity going on in XMPP across a very wide range of projects, and I'm hopeful that as people realize that all this centralization onto single providers has been a recipe for abuse of power, that open networks may gather more public interest.
In the interview he explicitly says that they do not share phone book data with Facebook.
> messages ... calls ... location
The response ignores the question.
> Der Spiegel: The government says it needs this technology to read messages from terrorists at a point before they are encrypted on their phone. What’s wrong with that?
Maybe Der Spiegel is asking the question simply to elicit the interviewee's opinion. But it strikes me as very strange that a German paper aimed at a German audience would be asking why citizens need protection from government surveillance. Germans are possibly the most privacy conscious folks in the world because of a history of invasive government surveillance.
The CEO of WhatsApp says - continues to say the whole controversy around the new TOS is fake news - WhatsApp are still growing - Does not like privacy labels because they are confusing due to each app defining what they put on it (example given: you can't tell from them that Telegram doesn't have E2E but WhatsApp does) - Does not like that the German Government wants them to actively help the police track criminals, including silently installing malware on their phone. - Is against weaking their own encryption for the government.
Communicating with a business will not be e2e, per their new TOS.
Simple “Privacy nutrition labels”, like apple recently introduced in the App Store are a neat idea, but because they are self reported and not standardized they can do more harm than good. Eg it’s not clear from the labels that WhatsApp is e2e for personal comms while telegram isn’t by default and never for groups.
WhatsApp confirms they keep some of your personal data including phone numbers from your address book but doesn’t currently share that with Facebook.
> Once reported, WhatsApp receives the most recent messages sent to you by a reported user or group, as well as information on your recent interactions with the reported user.
https://faq.whatsapp.com/general/security-and-privacy/stayin...
If I have received a message I can report that message.
If you actually read the PP and TOS, you see that:
1. Nothing you share (content, pictures etc.) will be VISIBLE on Facebook for others to see (literally what they say), but it is pretty clear that this does not include what facebook does with the data aka sell it for ads. This is the only absolute protection that the PP/TOS affords you. They promise not the go an post your pictures or locations on some random facebook profile. That's it.
2. Naturally, they say that CURRENTLY do not share "sensitive" data with facebook for ad purposes. To quote: "Today, Facebook does not use your WhatsApp account information to improve your Facebook product experiences or provide you more relevant Facebook ad experiences on Facebook." But what about tomorrow? Why this wording, which appears several times in the PP/TOS?
The intention of this PP is clearly to pave the way to use Whatsapp to enrich the ad targeting in Facebooks network. This was always the goal for Facebook, and they will fight tooth and nail to get that done.
So where do we stand? You can accept the TOS/PP, allowing Facebook to do all the nefarious things it wants, simply because Whatsapp tells you that currently, "today", your data is safe. But you explicitly allow them to do all sorts of things.
To wit, they also tell us (less prominently) that they will immediately share all data with facebook once an agreement with the Irish government is reached. However, even without that, you can count on them doing so if profit > fine.
Beyond all the bull that has been produced by FB and Whatsapp, the reality is obviously that the singular goal of this entire exercise is to syphon off as much data from Whatsapp as they can get away with, relative to the fines they will have to pay.
Anyone who agrees to this is naive.
>Cathcart: It’s true that we do have some information about how people use WhatsApp and that we do know, for example, the device ID. We collect this only to secure our services and protect from attacks. When you use WhatsApp and allow access to your phone book, we only see the phone numbers, not the name.
In particular, they have (meta)data regarding specific messages being sent, as evidenced by their approach to curtailing misinformation:
>Cathcart: Messages that are highly forwarded can only be forwarded to one chat since last spring. That led to a drop in 70 percent of these messages. More recently, we are additionally showing you a link to the Google search on those messages, to let you check the facts directly.
I'm not sure how easy it is to figure out whether those 'highly forwarded messages' are all the same, or somehow link them without knowing anything about their content or linking them to information you already know about people. Maybe it's easy and I'm making a mountain out of a molehill, I don't know.
I am pretty sure they are using hashes to stop the child exploitation from being spread on WhatsApp.
They use a counter. I don't know, however, if it is enforced on only client side or it is in a unencrypted metadata which can be checked on server side.
> Forwarded messages contain a counter that keeps track of how many times a message is forwarded. [1]
[1] https://faq.whatsapp.com/general/chats/about-forwarding-limi...
While we are debating the pros and cons of WhatsApp's policy update, I can bet anything we will see more user hostile policy changes, data sharing, data mining and exploitation in future, because this is the business model of the parent company. It makes no sense to not exploit the gold mine of metadata and personally identifiable information if that's the foundation of your business model.
At this point, I don't even mind using vanilla SMS compared to WhatsApp or FB messenger since it's my telco who's doing the data collection, and the telco is governed by a different and far stricter legislation in my country.