Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

news.ycombinator.com

Post reply on HN
Print view View original

451–460 of 473 posts

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#451

Post by rendaw »

brap wrote: post #398
moralestapia wrote: post #248

(wrt some comments in this thread) Is it so hard to believe that Meta is snooping on WhatsApp conversations? Meta, a company of unprecedented size that was built over monetizing your private data? A company who's been caught in plenty of scandals (like Cambridge Analytic) about this exact sort of thing (violating their users' privacy)? Someone from this community, which generally means educated, tech-literate and sen…

For anyone who has ever worked at a FAANG like company in the last decade, yes, this is actually very hard to believe. Despite the shady image they have, these companies go to great lengths to avoid doing shady things (because ultimately it’s bad for business). Not to mention the hundreds of tech employees that would have to be involved and keep quiet in this type of “conspiracy”. It’s incredibly unlikely, I truly be…

The PRISM "conspiracy" was very shady and involved probably hundreds of employees. And if they have hushed people punching holes for the government, it's not crazy to think some data could leak out into other parts of their pipelines too.

I'm not claiming this is real, but I agree with GP.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#452

Post by crazygringo »

GekkePrutser wrote: post #106

It's a shame this kind of thing is so hard to prove, otherwise it would be all over the media. People will write it off as 'coincidence'. "Perhaps you looked for or discussed it elsewhere". What happened with Skype before was that Microsoft would ping any links from their servers, so it was really easy to prove it by generating a new web server, publishing it nowhere and then mentioning it in a chat. This caused some…

It's incredibly easy to prove.

The reason it's not all over the media is precisely because it doesn't hold up.

Anybody who's dedicated to this can select truly obscure terms, fully document their private chats and full internet usage and ads shown, and show whether this effect is actually happening.

The reason we don't hear about this is because the snooping doesn't appear to be happening. So you just get a bunch of people sometimes claiming it "seems like" ads are coming from private chats, because coincidences do happen statistically so it will always happen to some degree to some people.

The reason it's not all over the media is simply because the phenomenon doesn't appear to exist, not because it's hard to prove.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#453

Post by mhio »

beiller wrote: post #436
lrvick wrote: post #301

Earlier quoted context omitted.

Google, Apple, or Meta retain the power to ship a tweaked binary with a compromised RNG to a subset of users if authorities order them to be it now or in the future after a privacy policy change. Proprietary encryption means users cannot verify or control the keys or the code that generates or uses the keys. The app can exfiltrate the keys or do any keyword processing on behalf of Meta as well which can include well…

If they modified the RNG of person A's phone app during a forced stealth update, then shouldn't person B not be able to decrypt the message? Have you ever had an app update to Whatsapp that you cannot communicate with other people until you are forced to update? The alternative is that there is a vast internal conspiracy at meta that hundreds of engineers, and hundreds of ex-engineers are somehow silent on, which wou…

> then shouldn't person B not be able to decrypt the message?

The RNG example is a way to create keys that make it trivial for "C in the middle" with the RNG details to extract the contents. They are still valid, just not useful as keys.

The Juniper attack and Dual EC exploit is a good real world example of compromising an RNG for passive decryption, although Dual EC was designed to be like that.

https://www.cs.utexas.edu/~hovav/dist/juniper.pdf

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#454

Post by hnjst »

I'd ask myself another set of questions: - can they extract information from conversations and exfiltrate it in a stealthy or obfuscated enough way so that they won't be noticed or have plausible deniability - do they have incentives to do so (assuming the absence of liability described above) - do they have a track record on related topics that makes you confident in the fact that they wouldn't act that way

My answers being yes - yes - no, the question of 'do they listen to target the ads they try to make me display' is pretty irrelevant to me. I can't trust them not to nor check reliably if they do.

If you try to address a different question such as 'do they really encrypt reliably to protect your conversations from being snooped on without their authorization', the threat analysis may differ. In that case they have incentives aligned with yours and are probably faithfully trying to effectively protect your/their data.

At the end, I'd estimate the probability of the scenario and how I value the consequent loss of privacy. Then accept/mitigate/refuse the risk accordingly.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#456

Post by codethief »

kome wrote: post #353
codethief wrote: post #352

Earlier quoted context omitted.

…and have no encryption at all? (Unless you manually enable it for a given conversation.)

Telegram has encryption (server-client encryption). Whatsapp may have e2e encryption, but then if it sends conversation or part of them to facebook to serve advertising, that's arguably even worse.

Wait, so Telegram, which is known for being able to read all your texts, is worse than WhatsApp where people are speculating that it might read your texts?

Not that I trust WhatsApp (I use Signal) but that's an odd comparison.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#457

Post by rhn_mk1 »

viraptor wrote: post #433
rhn_mk1 wrote: post #231

Earlier quoted context omitted.

E2EE most certainly does exclude analyzing messages anywhere for a third party. Notice that "ends" in "end-to-end" are users, not applications. When an application forwards things to an entity, then that entity becomes an "end" of the conversation. When it displays a message to the user, the way the user wants, then the user is the end. When it processes the message and delivers results to Facebook, the way Facebook…

> Notice that "ends" in "end-to-end" are users, not applications. That's not right. First, it's technically an impossible, since users can't do encryption themselves - it's the application that does it. That's where the e2ee boundary is. Second, we've got e2ee communication between non-user entities as well. There's are servers using for example zerotier which communicate e2ee through other nodes. Third, applications…

It's not a distinction between softwares, it's a distinction between agents. I.e. who the software works for.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#458

Post by charcircuit »

jtbayly wrote: post #108
xuki wrote: post #79

Earlier quoted context omitted.

Whatsapp can't read the message on their servers but they can read it at clients, otherwise they cannot display the messages for users. Likewise, Apple/Google can read them too because they have to in order to render the texts.

This is just redefining terms, then. We know the app decrypts it to display it. But if the app decrypts it to send it to the parent company, then it is by definition not end to end encrypted anymore. If the app decrypts it, analyzes it and sends information about the message to the parent company, then the same thing is happening. The parent company is reading the message, INSTEAD of E2E encrypting it. It doesn't mat…

>then it is by definition not end to end encrypted anymore.

HTTPS is E2E between the client and the server.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#459

Post by xerxesaa »

pdntspa wrote: post #302
xerxesaa wrote: post #256

As someone who has actually worked on end to end encryption at Meta, I can tell you I am not aware of anything where the company reads your WhatsApp messages - either in transit or device. The company takes fairly serious measures to ensure it cannot even accidentally infer such contents. I don't know what is happening in this specific case. Perhaps the ads came from some other similar search queries. Perhaps they ca…

Are you absolutely sure that this is still the case? You say you "used" to work on it, but modus operandi for these companies is rugpulling protections like this as soon as nobody is looking

I feel quite confident based on first hand knowledge of code, system design, and the many, many privacy reviews we had to go through when building new features to ensure we didn't accidentally log or otherwise infer data we weren't supposed to.

WhatsApp architecture is designed with the assumption that the server could be compromised and yet such an event should not result in any message contents being revealed. Furthermore, the encryption function is designed to ratchet and rotate keys so that a leak of a key at a given point in time would not compromise past and future messages.

So yes, I have a strong sense of confidence that message contents are not exposed to Meta and, given the bar set by privacy reviews, I don't think Meta would do some backdoor workaround like scraping the contents off the device and sending an unencrypted copy. To be clear, my claims are specifically around message contents and when it comes to certain metadata (ex. the sender/receiver, the names of groups, etc) I don't recall the exact details of how they are treated.

Now, despite the fact that I've said all this and that my knowledge on the matter is fairly recent, I'm not sure I could ever say anything with absolute confidence. The code base is huge and not open source. I obviously have not seen every line of code and as you pointed out, there's always a chance some company policy changes happened without my awareness. So I would say "highly" confident but not "absolutely" confident.

Re: Ask HN: Ads triggered by WhatsApp “end to end encrypted” messages?

#460

Post by kome »

codethief wrote: post #456
kome wrote: post #353

Earlier quoted context omitted.

Telegram has encryption (server-client encryption). Whatsapp may have e2e encryption, but then if it sends conversation or part of them to facebook to serve advertising, that's arguably even worse.

Wait, so Telegram, which is known for being able to read all your texts, is worse than WhatsApp where people are speculating that it might read your texts? Not that I trust WhatsApp (I use Signal) but that's an odd comparison.

you are also speculating that Telegram read our messages, in transit. For sure, unlike WhatsApp, the Telegram client is FOSS (and you can download it from FDroid).
Post reply on HN