Germany's data chief tells ministries WhatsApp is a no-go

My work phone is an iPhone, my personal an Android, and across the family there is a multitude of old and new, Android and Apple.

Telegram is using (or used) some homebrew encryption protocol and I simply don't trust it. As it doesn't have a proper tried and tested encryption I'm not going to use it. (The encryption may have changed by now, as I haven't kept tabs on it.)

Signal is okay. There are 2 main things that irk me. Signal's Windows App is bad. Long loading times, bad UI. Keeps crashing for me. I also frequently video chat with family. Signal's quality is considerably worse than that of other services. The sound is choppy and video may or may not work. This is on all devices I own, regardless of network speed.

iMessage and FaceTime are good but platform locked. The video call quality on FaceTime is the best one across all services for me. The picture and sound is just significantly clearer than anywhere else. If I talk to family members with an Apple device I will generally use FaceTime.

WhatsApp still remains my main one for the simple reason that it gives me the best average experience across all devices and circumstances. Video and phone calls could be better but are acceptable. Chats are easy to use and work. Service quality is generally good. WhatsApp for me stands out because it doesn't really negatively stand out anywhere else. Yes, owned by Facebook is something I'm not entirely comfortable with, but right now, there simply isn't any other application that for me is consistently average across every platform.

I’ve been using WhatsApp daily for years, how did I not know this? Thanks! (This is why I read HN)

If you use Google’s backup for WhatsApp, it is NOT encrypted. Your local backup IS encrypted. It’s not your data - you can’t have it except through the app. But google can (and does) have that data for likely 95% of android WhatsApp users; E2E with this state of affairs is not very useful. (I assume the iOS situation is similar, but don’t know for sure)

Also, a copy of your phone book, continuous IP (and likely location) and all your conversation metadata is stored on Facebook’s servers even if you don’t use the google drive backup.

Yes, WhatsApp is useful and works well, But the E2E aspect is false safety. For many practical purposes, you should assume there’s No encryption. For the purposes that inconvenience you, it’s obviously there.

Uneducated users just use what everybody else uses that is "free". This tends to be stuff that is provided by big US based companies like Google, Facebook, Apple, etc. Free here is primarily about pricing and convenience. Recently, people value encryption a bit more but most users lack the expertise to make good decisions for this. So, they'll use something that supports encryption without realizing that might need configuration or turning on.

Companies have to deal with employees using non-sanctioned devices and solutions (i.e. uneducated users), which means the above tools are used. Additionally, they tend to have internal tools that are required to used for internal communication. Typically these too are provided by big US based companies (Slack, Microsoft, Facebook, Google) but are optimized for corporate requirements (better security, team features). A problem with these tools is that they are useless for communicating with people outside the company. Most companies are part of a complex supply chain involving companies that typically don't align on this. So, things like Skype, Google Meets, Zoom, etc. are popular in this space. Or email. A surprising amount of communication still happens via unencrypted email.

Finally, educated users tend to pick solutions that are a bit more on the paranoid side of the spectrum when it comes to privacy, encryption, data ownership, etc. Additionally, open source clients and servers are important in this space. Signal, Matrix, etc. are some better known solutions in this space. Unfortunately, these solutions tend to be not widely adopted and make it harder to communicate with "normal" people in the above two groups. I have signal on my phone but less than 99% of my phone book actually is reachable via it (not counting sms messages here for obvious reasons).

Companies are increasingly valuing this type of solutions from a security point of view. Industrial espionage is a thing and it's a thing companies with representatives in countries like China, Russia, or even the US have to worry about. These countries have very active intelligence agencies and a long track record of actively serving local businesses with basically any information they can get their hands on. Therefore companies that care about keeping secrets ought to be highly paranoid about popular solutions controlled by US incs that must be assumed to be actively under the attention of intelligence agencies.

IMHO OSS, federated solutions, with multiple implementations, clients, and no central control is what is needed. Unfortunately the dominant business models in this space favour closed source, non federated solutions with maybe some OSS clients but typically no independent server side implementations. Signal and matrix are exceptions in this space and neither has meaningful (> 1%) traction in the any market. I guess matrix is growing nicely regardless. Also signal has one big flaw: it uses phone numbers for authorizing users. This gives a large amount of control to operators.

I bet this is also why the intelligence agencies aren't pounding on them for having E2E encryption, obviously Google is an open book to them. And Google has access to all your history for their own purposes.

Of course you can choose to turn off the backups, but you can't be sure all your contacts are doing the same.