Live data from Hacker News

Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

news.ycombinator.com

51–60 of 473 posts

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#51
Are you sending each other links or just mentioning the ads in text?

If this is just in text—and I'm definitely not defending Meta here—could it also be that the ads you see have got us so figured out already? The topic you choose to talk about may be influenced or seeded by your environment (online/offline), and one thing leads to the other almost deterministically.

Here's an experiment: try rolling a die a few times or using a random number generator to pick one word or more from a list like the EFF wordlists [0], and then talk about that exclusively.

[0]: https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#52
post #5

Just because that the messages might be sent end-to-end encrypted from Sue to Joe does not mean Meta cannot read them. Meta has control over the app Sue uses. So they could send them to Meta unencrypted in addition to sending them to Joe in an encrypted fashion. Or they just extract the relevant terms: Sue->Joe: "Hello Joe, I'm so excited! We are going to have a baby! Let's call it Dingbert. You're not the father! Ji…

That’s of course because WhatsApp's privacy policy isn’t applicable in the Metaverse.

Looking at this from a reality perspective is not very helpful.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#53
post #5

Just because that the messages might be sent end-to-end encrypted from Sue to Joe does not mean Meta cannot read them. Meta has control over the app Sue uses. So they could send them to Meta unencrypted in addition to sending them to Joe in an encrypted fashion. Or they just extract the relevant terms: Sue->Joe: "Hello Joe, I'm so excited! We are going to have a baby! Let's call it Dingbert. You're not the father! Ji…

I have a suspicion as well that this is what they're doing: before the message is encrypted and sent, the app (on your phone) does analysis and picks out keywords relevant for advertising. So they can claim and be technically correct that they are not reading your messages. Although if their algorithm is doing it on your phone, is it... reading?

Or they can say, technically it wasn't a message before it was sent. The dictionary definition[1] even mentions "send".

[1] https://www.oxfordlearnersdictionaries.com/definition/englis...

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#55

Can someone working on WhatsApp weigh in on this or are there very restrictive NDA's? I would expect it's an interpretation of the TOS, so WhatsApp should be able to communicate if this is a possibility or not.

I work on a competing product (not for any of the named companies in this thread).

I don't think there is any fault with the e2e encryption. Humans are very bad at seeing causality when there is none, or accidentally leaking their thoughts into the search box.

There could also be leaks with the clipboard, photo gallery or keyboard - all things that freemium apps love to scan in the background. The way real-time-bidding ad markets work, anyone that the data leaks to can influence ad ranking - doesn't have to be FB/Meta.

If you did a true blind study, I think you'd find no link.

For example, start with a list of 1000 products images and accompanying text. Select 2 at random each day. Flip a coin to decide which to send (keep the other as control). Cover the screen so the user can't see what they've sent/received. Then, a few days later ask the user to select which product they think they sent.

I'd bet that even after months of doing this, there will be no finding of a leak.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#56
WhatsApp make no specific claims about who this encryption is keeping you safe from. And they also require you to agree that they can use your information and interactions for their legitimate business needs. I mean, WhatsApp is standing right there when you stuff the message into the box regardless of how safe the package is in transit once it's left your phone. And consider basically every 'enchancement' to security or privacy around Facebook was done under duress for years. Pre-acquisition WhatsApp is a different story, but that story is ancient history.

I didn't agree to the recent WhatApp nor Facebook's TOS so no longer have their product on my devices. I suggest you do the same, or just sit back and enjoy the specialised, relevant, targeted ads, but think twice before each send.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#57
post #17

Some options: 1. Nobody is reading your WA messages, the same topics can be learned from your browsing activity or other msgs, eg. by reading your sms texts. 2. Meta is reading your messages directly in-transit, server-side. 3. Meta is not reading your messages server-side, but the Meta apps extract keywords from your conversations and request relevant ads from the ad servers. 4. Another non-Meta app is doing the abo…

If 2 is true, then it is not end-to-end encrypted, and I don't think that WhatsApp is lying. They have ways of doing their things without lying, so I don't expect 2 to be true.

I think that 1 is the most plausible, however the original post is about "topics they never talk about", so assuming that WhatsApp is the only channel and they don't leak data in other ways (and there are many other ways to leak data), then 1 becomes unlikely.

3 is the most compatible. All the targeting can be done locally, so no end-to-end unencrypted message leaves the app. The app then sends your topics of interests to Meta.

4 again assuming WhatsApp is the only channel, then there is probably some malware somewhere, and it is unlikely that Meta accepts illegally collected data (they can do it legally, better, and with less potential trouble). There are however a few legitimate apps that can do the above. I am thinking about things like predictive keyboards, accessibility apps (screen readers, ...), backup apps (end-to-end encryption is about transmission, not storage), and the OS itself. I don't think Meta controls any of these, and I don't think they would buy data from them (Google and Apple are competitors after all).

So I would go for an accidental leak (case 1). For example, for the experiment to be meaningful, you shouldn't tell anyone about the test topic before you receive the ads. Or with the WhatsApp app hinting Meta about your topics of interest.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#58

Earlier quoted context omitted.

Well, my wife sent me a picture of my daughter working on a puzzle. Less than 24 hours later, her Instagram was showing ads for a store that was selling the same type of puzzle as the one my daughter was playing with. So it's not just terms but images too.

That doesn’t even make sense. Why go through the trouble of retargeting based on images? If you took a photo of something you likely already own it.

> If you took a photo of something you likely already own it.

Tell that to Amazon who never fail to recommend me things I just bought.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#60
post #18

Whatsapp FAQ: WhatsApp's end-to-end encryption is used when you chat with another person using WhatsApp Messenger. End-to-end encryption ensures only you and the person you're communicating with can read or listen to what is sent, and nobody in between, not even WhatsApp. This is because with end-to-end encryption, your messages are secured with a lock, and only the recipient and you have the special key needed to un…

> only you and the person you're communicating with can read or listen to what is sent, and nobody in between, not even WhatsApp I guess the key lies in "what is sent" in the above statement. The casual reader might reasonably interpret as "no-one except the intended recipient can see _what I type_". But it doesn't say that. It only covers what gets _sent_. It doesn't say anything about what happens to the content ou…

Maybe Meta are not as trustworthy as I imagined.
Post reply on HN